Merge branch 'main' into feat/bootstrap-action-map

Author: scottschreckengaust

.github/workflows/deploy.yml

@@ -22,7 +22,7 @@ jobs:
       run_id: ${{ github.event.workflow_run.id }}
     steps:
       - name: Download deploy intent
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: deploy-intent
           run-id: ${{ github.event.workflow_run.id }}
@@ -145,7 +145,7 @@ jobs:
           persist-credentials: false
 
       - name: Download CDK artifact (${{ matrix.compute_type }})
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: cdk-${{ matrix.compute_type }}-out
           path: cdk/
@@ -220,7 +220,7 @@ jobs:
           persist-credentials: false
 
       - name: Download CDK artifact (${{ matrix.compute_type }})
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: cdk-${{ matrix.compute_type }}-out
           path: cdk/

agent/pyproject.toml

@@ -36,6 +36,11 @@ dependencies = [
     "cedarpy==4.8.0", #https://github.com/k9securityio/cedar-py — EXACT pin (no ^/~), parity with @cedar-policy/cedar-wasm@4.10.0
 ]
 
+[tool.uv]
+constraint-dependencies = [
+    "pyjwt>=2.13.0",  # PYSEC-2026-175/177/178/179 — transitive via mcp; remove when mcp bumps floor (#267)
+]
+
 [tool.bandit]
 exclude_dirs = ["tests", ".venv"]
 skips = [