security: upgrade transitive dependencies to fix 100 Dependabot vulnerabilities (#1318)

* security: upgrade transitive dependencies to fix vulnerabilities

Run uv lock --upgrade on all packages (except assistant) to fix:
- h11 CVE-2025-43859 (critical)
- urllib3, cryptography, pillow, pypdf vulnerabilities

Key upgrades:
- cryptography 46.0.4 -> 46.0.5
- pypdf 6.6.2 -> 6.7.5
- h11 to 0.16.0
- pillow 12.1.0 -> 12.1.1

Also fix compatibility with jsonpath-ng 1.8.0 which changed the Index
class API from 'index' attribute to 'indices' tuple.

Skipped: assistant (blocked by robocorp-flet httpx/h11 conflicts)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* security: fix remaining dependabot vulnerabilities

Fix upper-bound version constraints that were blocking secure versions:
- packages/main: cryptography>=44.0.1,<45 -> >=46.0.5
- packages/recognition: pillow >=10.2.0,<12.0.0 -> >=10.2.0 (allows 12.1.1 on Python 3.10+)
- packages/pdf: pypdf >=6.6.2 -> >=6.7.5

Fix sema4ai cryptography via override-dependencies since robocorp-vault 1.3.9
hard-caps cryptography<46.0.0:
- packages/sema4ai: add override-dependencies = ["cryptography>=46.0.5"]

Add recognition and pdf as local uv sources in root pyproject.toml so the
root uv.lock resolves updated constraints (pillow 12.1.1 for Python >= 3.10).

Regenerate lock files for main, recognition, sema4ai, and root.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: mikahanninen

packages/aws/uv.lock

@@ -56,7 +56,7 @@ dependencies = [
 	"tweepy>=3.8.0",
 	"graphviz>=0.13.2",
 	"notifiers>=1.3.3",
-	"cryptography>=44.0.1,<45",
+	"cryptography>=46.0.5",
 	"mss>=6.0.0",
 	"chardet>=3.0.0",
 	"PySocks>=1.5.6,!=1.5.7,<2.0.0",

packages/core/uv.lock

@@ -21,7 +21,11 @@ def filter(self, fn: Callable[[JSONType], bool], data: JSONType) -> JSONType:
         for datum in reversed(self.find(data)):
             index_obj = datum.path
             if isinstance(data, dict):
-                index_obj.index = list(data)[index_obj.index]
+                # Convert numeric index to dictionary key.
+                # jsonpath-ng 1.8.0+ uses 'indices' tuple instead of 'index'.
+                numeric_index = index_obj.indices[0]
+                dict_key = list(data)[numeric_index]
+                index_obj.indices = (dict_key,)
             index_obj.filter(fn, data)
         return data
 

packages/devutils/uv.lock

@@ -27,7 +27,7 @@ dependencies = [
 	"rpaframework-core >=12.1.0",
 	"robotframework >=4.0.0, !=4.0.1, !=6.1.0, <8.0.0",
 	"pdfminer.six >=20251107",
-	"pypdf >=6.6.2",
+	"pypdf >=6.7.5",
 	"fpdf2 >=2.8.4",
 	"docutils>=0.21.2",
 ]