fix: restore dependency audit and update Click

[Kritoooo]

Summary

• Replace the invalid, failure-suppressing Safety command with pinned pip-audit==2.10.1.
• Audit the checked lockfile, including optional MCP and dev dependencies; preserve nonzero exit codes and upload the JSON report even on failure.
• Update only Click from 8.3.0 to 8.3.3 (version and distribution hashes) to resolve PYSEC-2026-2132 / CVE-2026-7246 / GHSA-47fr-3ffg-hgmw.
• No vulnerability ignores, unrelated upgrades or production-code changes.

Validation

• Frozen install with the MCP extra.
• Local unit + real MCP stdio + localhost downloader suite: 361 passed, 1 existing skip (Python 3.12).
• Ruff lint, formatting and git diff --check: passed.
• Strict local audit: 46 dependencies, zero known vulnerabilities, zero skipped packages, exit 0. Linux/Python3.10 CI evaluates its own environment markers and may include additional compatibility packages.
• Exact-head GitHub Actions and uploaded audit JSON are being verified before merge.

The previous draft intentionally exposed the remaining Click8.3.0 advisory. This patch now upgrades that dependency rather than ignoring the finding.

Advisory: https://github.com/pypa/advisory-database/blob/main/vulns/click/PYSEC-2026-2132.yaml

Reproduce

uv sync --frozen --dev --extra mcp

uv run --no-sync pytest tests/unit tests/integration/test_mcp_stdio.py tests/integration/test_downloader_http.py

uv export --locked --all-extras --group dev --no-emit-project --format requirements-txt --output-file requirements-audit.txt

uv tool run pip-audit==2.10.1 --requirement requirements-audit.txt --require-hashes --disable-pip --strict --format json --output pip-audit-report.json

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-03T05:52:38.928486Z	0bfc7c6	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.