chore(deps): bump fastmcp, authlib, urllib3, python-multipart, PyJWT, cryptography (#8)

- fastmcp >=3.2.0 closes CVE-2026-32871 (critical), CVE-2026-27124 (high)

- authlib >=1.6.9 closes CVE-2026-27962 (critical), CVE-2026-28490, CVE-2026-28498, CVE-2026-28802 (high)

- urllib3 >=2.7.0 closes CVE-2026-44432, CVE-2026-44431 (high)

- python-multipart >=0.0.27 closes CVE-2026-24486, CVE-2026-42561 (high)

- PyJWT >=2.12.0 closes CVE-2026-32597 (high)

- cryptography >=46.0.5 (transitive requirement for authlib 1.6.9)

pip-lupa CVE-2026-34444 is being handled separately via Vanta risk register acceptance — no upstream fix exists.

Mirror PR will follow in sondera-ai/internal-cedar-python.

Co-authored-by: Tyler Predale <tpredale@sondera.ai>

Author: Tpredale

pyproject.toml

@@ -39,7 +39,14 @@ Repository = "https://github.com/sondera-ai/cedar-python"
 Issues = "https://github.com/sondera-ai/cedar-python/issues"
 
 [project.optional-dependencies]
-mcp = ["fastmcp>=2.0,<3"]
+mcp = [
+    "fastmcp>=3.2.0,<3.3",
+    "authlib>=1.6.9,<1.7",
+    "urllib3>=2.7.0,<2.8",
+    "python-multipart>=0.0.27,<0.0.28",
+    "PyJWT>=2.12.0,<2.13",
+    "cryptography>=46.0.5,<46.1",
+]
 
 [project.scripts]
 cedar = "cedar.__main__:cli"