[gbeane]

Bumps the locked versions of the packages flagged by Dependabot past their first patched release, and raises the security floors in [tool.uv] constraint-dependencies to match so a later uv lock cannot resolve back down. All alerts are in uv.lock; no direct dependency specifiers change.

Notable upgrades:

• mlflow 3.15.2 -> 3.18.0 (also clears GHSA-h7x2-h6g9-p789, which has no listed patched version but only affects <= 3.15.2)
• cryptography 49.0.0 -> 50.0.2 and setuptools 81.0.0 -> 84.2.1. Both were previously held back by caps in mlflow 3.15 and torch 2.11; those caps are gone, so the explanatory comment is removed.
• torch 2.11.0 -> 2.14.1 (Python 3.10) / 2.15.0 (3.11+), torchvision 0.26.0 -> 0.29.2
• pillow 12.3.0 -> 13.0.0, gitpython, aiohttp, pyasn1, virtualenv, urllib3, anyio, certifi, fsspec, graphql-core, hydra-core, mako, werkzeug, multidict, opentelemetry-api

Python 3.10 remains on vulnerable pillow / filelock

pillow 13.0.0 and filelock 4.2.1 require Python >= 3.11, so their floors carry a python_full_version >= '3.11' marker and the 3.10 fork stays on pillow 12.3.0 / filelock 4.1.0. Dependabot will likely keep those alerts open until 3.10 support is dropped (3.10 reached end of life in October 2026).

Testing

Full CI environment (uv sync --all-packages --all-extras --all-groups), Python 3.13: root, jabs-core, jabs-io, jabs-behavior and jabs-vision suites all pass.