fix: bump mako 1.4.2, fsspec 2026.6.0, pymongo 4.18.2 (CVE-2026-102991)

[scale-prodsec]

Summary

• uv.lock only: mako 1.3.12 -> 1.4.2, fsspec 2025.9.0 -> 2026.6.0, pymongo 4.15.1 -> 4.18.2 (lowest OSV-clean releases at/above the fixed floors; 4.18.2 covers 4.18.1 and 4.18.2).
• Lock revision (3) preserved by using uv 0.9.5 (0.7.x rewrote it to revision 2).

Coverage

Tickets: GFDVR-163617, GFDVR-163618, GFDVR-163619
CVEs: CVE-2026-102991, CVE-2026-104851, CVE-2026-88029, CVE-2026-96748, CVE-2026-96747, CVE-2026-96749

Validation

• uvx uv@0.9.5 lock --upgrade-package ... moved exactly 3 packages; uv lock --check passes
• bot.version_gate (OSV): zero known advisories for all three targets
• Fresh venv with the three versions: imports of mako.template, fsspec, pymongo AsyncMongoClient/AsyncCollection/OperationFailure (the agentex consumers) succeed
• fsspec/mako have no direct first-party imports in agentex/src; pymongo usage is the async API only
• git diff --check clean; only uv.lock changed

[greptile-apps]

No reviewable files after applying ignore patterns.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​pymongo@​4.15.1 ⏵ 4.18.2		+24

View full report