Bump gitpython to 3.1.62 and soupsieve to 2.9.2

[lelia]

Dependency bumps

Both pins are flagged by pip-audit against the current lock.

Package	From	To	Advisories
gitpython	3.1.59	3.1.62	CVE-2026-87817, CVE-2026-87818, CVE-2026-87819
soupsieve (transitive)	2.8.4	2.9.2	GHSA-gjv8-xp57-g29c, GHSA-j934-xhv5-fg8f

Supersedes #361.

Pin casing

GitPython== becomes gitpython==, the only mixed-case requirement in the project; uv.lock already uses the normalized name. Dependabot's uv updater errors on this entry with dependency_file_content_not_changed, and the rename is a candidate fix. Inert either way, since PEP 503 names are case-insensitive to pip and uv and this was the only occurrence of the string.

Audit scheduling

pip-audit moves out of the Unit Tests workflow into a new Dependency Audit workflow with a daily cron, keeping the pull request trigger. The audit compares the lockfile against databases that publish continuously, so its result tracks the clock rather than the commit and needs a trigger to match. A failing scheduled run has no pull request to report on, so it opens a tracking issue and closes it once the audit is clean.

Check triggers

The paths filters come off the pull_request triggers for Unit Tests and Version Check. A status check behind a paths filter produces no check context on a pull request that misses the filter, so those jobs cannot be marked required while the filters are in place. The push triggers keep theirs. Each job finishes in under a minute.

Verification

uv lock --locked      exit 0
pytest                717 passed
import smoke          OK
pip-audit --strict    No known vulnerabilities found
ruff check            All checks passed!

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​gitpython@​3.1.59 ⏵ 3.1.62

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​gitpython@​3.1.59 ⏵ 3.1.62

View full report

[Oskar Haarklou Veileborg (BarrensZeppelin)]

[agent] Approving. This is a comments-only pass over the three workflow files. Three notes inline, all about comments that speak to a reviewer of this diff rather than to someone reading the workflow later; the first is the one I'd actually act on.

[human] LGTM - thanks! 🎉