[pre-commit.ci] pre-commit autoupdate

[pre-commit-ci]

updates:

• github.com/astral-sh/uv-pre-commit: 0.11.19 → 0.11.32
• github.com/astral-sh/ruff-pre-commit: v0.15.16 → v0.16.0
• github.com/pre-commit/mirrors-mypy: v2.1.0 → v2.3.0

[amrit110]

Security Vulnerability — No Patch Available Yet

aieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:

Package	Version	Vulnerability	Status
torch	2.11.0	CVE-2025-3000	No fix available on PyPI

Why this cannot be auto-fixed

The vulnerability exists in torch itself. A fix requires the upstream PyTorch maintainers to release a new version. Once a patched release is published to PyPI, aieng-bot can re-run and apply the update automatically.

What was fixed in this PR

The following vulnerabilities were fixed automatically:

• tornado bumped 6.5.5 → 6.5.7 (CVE-2026-49854)
• aiohttp bumped 3.14.0 → 3.14.1 (CVE-2026-54273, CVE-2026-54274, CVE-2026-54275, CVE-2026-54276, CVE-2026-54277, CVE-2026-54278, CVE-2026-54279, CVE-2026-54280)
• cryptography bumped 46.0.7 → 49.0.0 (GHSA-537c-gmf6-5ccf)
• starlette bumped 1.1.0 → 1.3.1 (CVE-2026-54282, CVE-2026-54283)

Recommended next steps

1. Monitor the CVE-2025-3000 advisory for a PyTorch patch release
2. Check if a pip-audit ignore/exception can be added temporarily with justification (requires human review)
3. Consider whether this dependency can be replaced with an alternative

This PR will not be auto-merged until the torch vulnerability is resolved.