SIGN IN SIGN UP

fix(deps): update dependencies with published security fixes (#3680)

# Summary

This continues our work to reduce the SDK’s dependency surface and keep
dependencies on releases with published security fixes.

- Update jiter and exclude affected Pydantic releases while retaining
Pydantic 1.x and 2.x support.
- Retain security floors for the development-only Azure authentication
and test updates already merged in #3676, and update the isolated
wheel-test pins. Bump Hatchling to 1.27 so the patched Pygments release
can still build from source.
- Keep the eight-day policy and existing package count unchanged. Add an
offline regression test and contributor guidance to prevent private
registry URLs from entering the public lockfile.

The development lockfile bumps landed in #3676 while this PR was in
flight. After merging current main, only jiter and Hatchling change
versions here; none of the newly landed fixes is downgraded. The root
lock has 74 package names and 76 exact versions, with no active reviewed
Python advisory matches. Separate native-dependency findings in Pydantic
remain follow-up work pending a compatible stable upstream release.

<details>
<summary>Published advisories covered by the updates and retained
security floors</summary>

- Pydantic’s supported version range:
[GHSA-mr82-8j83-vxmv](https://github.com/advisories/GHSA-mr82-8j83-vxmv).
- jiter’s PyO3 update:
[GHSA-36hh-v3qg-5jq4](https://github.com/advisories/GHSA-36hh-v3qg-5jq4),
[GHSA-chgr-c6px-7xpp](https://github.com/advisories/GHSA-chgr-c6px-7xpp).
- Azure Core and Requests:
[GHSA-jm66-cg57-jjv5](https://github.com/advisories/GHSA-jm66-cg57-jjv5),
[GHSA-gc5v-m9x4-r6x2](https://github.com/advisories/GHSA-gc5v-m9x4-r6x2).
- PyJWT:
[GHSA-993g-76c3-p5m4](https://github.com/advisories/GHSA-993g-76c3-p5m4),
[GHSA-752w-5fwx-jx9f](https://github.com/advisories/GHSA-752w-5fwx-jx9f),
[GHSA-w7vc-732c-9m39](https://github.com/advisories/GHSA-w7vc-732c-9m39),
[GHSA-xgmm-8j9v-c9wx](https://github.com/advisories/GHSA-xgmm-8j9v-c9wx),
[GHSA-jq35-7prp-9v3f](https://github.com/advisories/GHSA-jq35-7prp-9v3f),
[GHSA-fhv5-28vv-h8m8](https://github.com/advisories/GHSA-fhv5-28vv-h8m8).
- Cryptography:
[GHSA-m2h6-j472-rp4c](https://github.com/advisories/GHSA-m2h6-j472-rp4c),
[GHSA-jwv3-5hgf-82ww](https://github.com/advisories/GHSA-jwv3-5hgf-82ww),
[GHSA-g6cj-pr64-35w5](https://github.com/advisories/GHSA-g6cj-pr64-35w5),
[GHSA-537c-gmf6-5ccf](https://github.com/advisories/GHSA-537c-gmf6-5ccf),
[GHSA-p423-j2cm-9vmq](https://github.com/advisories/GHSA-p423-j2cm-9vmq),
[GHSA-m959-cc7f-wv43](https://github.com/advisories/GHSA-m959-cc7f-wv43),
[GHSA-r6ph-v2qm-q3c2](https://github.com/advisories/GHSA-r6ph-v2qm-q3c2).
- pytest and Pygments:
[GHSA-6w46-j5rx-g56g](https://github.com/advisories/GHSA-6w46-j5rx-g56g),
[GHSA-5239-wwwm-4pmq](https://github.com/advisories/GHSA-5239-wwwm-4pmq).

</details>
A
Alex Chang committed
53aa4fc68b65f42456cafaaa5ff4b0d317184752
Parent: 370fcc6
Committed by GitHub <noreply@github.com> on 8/19/2026, 4:22:10 PM