build(deps): raise pyjwt floor to >=2.13.0 and format bump_version

pyjwt 2.12.1 (pulled transitively by mcp and msal) carries four disclosed CVEs fixed in 2.13.0; add a uv constraint-dependencies floor and refresh the lock. Also apply ruff formatting to the changelog scaffold f-string in the version-bump script.

.github/scripts/bump_version.py

@@ -64,16 +64,7 @@ def update_changelog(version: str) -> bool:
         print("  ERROR: Could not find '## [Unreleased]' in CHANGELOG.md")
         return False
 
-    section = (
+    section = f"## [{version}] - {today}\n\n### Added\n\n### Changed\n\n### Fixed\n\n"
-        f"## [{version}] - {today}\n"
-        f"\n"
-        f"### Added\n"
-        f"\n"
-        f"### Changed\n"
-        f"\n"
-        f"### Fixed\n"
-        f"\n"
-    )
 
     # Find the next section header after Unreleased; insert the new section
     # immediately before it (or at end-of-file if Unreleased is the last one).

pyproject.toml

@@ -131,6 +131,15 @@ explicit = true
 [tool.uv.sources]
 torch = [{ index = "pytorch-cpu" }]
 
+# =============================================================================
+# uv: raise the floor on vulnerable transitive dependencies
+# =============================================================================
+# pyjwt is pulled in transitively (by mcp and msal). 2.12.1 carries four
+# disclosed CVEs that are fixed in 2.13.0; constrain the floor so the resolver
+# picks a patched release while leaving the direct dependents' own ranges intact.
+[tool.uv]
+constraint-dependencies = ["pyjwt>=2.13.0"]
+
 # =============================================================================
 # RUFF Configuration
 # =============================================================================

uv.lock

@@ -19,6 +19,9 @@ resolution-markers = [
     "python_full_version < '3.11' and sys_platform == 'darwin'",
 ]
 
+[manifest]
+constraints = [{ name = "pyjwt", specifier = ">=2.13.0" }]
+
 [[package]]
 name = "alembic"
 version = "1.18.4"
@@ -3752,14 +3755,14 @@ wheels = [
 
 [[package]]
 name = "pyjwt"
-version = "2.12.1"
+version = "2.13.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/c2/27/a3b6e5bf6ff856d2509292e95c8f57f0df7017cf5394921fc4e4ef40308a/pyjwt-2.12.1.tar.gz", hash = "sha256:c74a7a2adf861c04d002db713dd85f84beb242228e671280bf709d765b03672b", size = 102564, upload-time = "2026-03-13T19:27:37.25Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e5/7a/8dd906bd22e79e47397a61742927f6747fe93242ef86645ee9092e610244/pyjwt-2.12.1-py3-none-any.whl", hash = "sha256:28ca37c070cad8ba8cd9790cd940535d40274d22f80ab87f3ac6a713e6e8454c", size = 29726, upload-time = "2026-03-13T19:27:35.677Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" },
 ]
 
 [package.optional-dependencies]