Clear pip-audit: raise anyio and audit uv.lock

[crossjam]

Summary

The blocking pip-audit step in QA has been failing on main since #56 (and on feat/datasette-readonly-enforcement). Lint, type checks and tests all passed; the audit flagged anyio 4.13.0:

• CVE-2026-63374
• CVE-2026-64847

Both are fixed in 4.14.2. anyio is transitive (via httpx, starlette and mcp, pulled in by pylast, datasette and datasette-mcp).

While in here, the audit itself was also fixed. It checked the installed environment, and pip-audit identifies installed packages by name and version only, so our loguru-config fork (a git source) was being matched against the unrelated loguru-config project on PyPI (erezinman/loguru-config).

Changes

• uv.lock: anyio 4.13.0 → 4.14.2; no other packages moved.
• pyproject.toml [tool.uv]: add anyio>=4.14.2 to constraint-dependencies, alongside the existing pip and msgpack floors, so a re-resolution can't drop back below the fix.
• pyproject.toml audit poe task: audit uv.lock instead of the environment:

  set -o pipefail
  uv export --frozen --all-extras --all-groups --no-emit-project --no-hashes --quiet \
    | pip-audit --requirement /dev/stdin --disable-pip --no-deps

  • The fork now reaches pip-audit as a URL requirement and is skipped rather than checked against the wrong project.
  • --no-emit-project drops the "scrobbledb not on PyPI" skip notice.
  • Covers every extra and dependency group, slightly more than CI's uv sync installs.
  • pipefail makes a failed export fail the task instead of auditing an empty list as clean.

Trade-offs

• pip-audit prints two warnings recommending hashed requirements; hashes can't be used because the git dependency has none.
• The fork isn't checked for vulnerabilities at all. No advisory database covers it, so that's more accurate than checking the wrong project.

Verification

• uv run poe audit: no known vulnerabilities found; loguru-config is the only skip.
• Same export with anyio pinned back to 4.13.0: both CVEs reported, exit 1.
• Corrupted uv.lock: the task exits 2.
• uv run poe test:quick: 883 passed, 2 skipped.

feat/datasette-readonly-enforcement will need a rebase onto main once this lands.

🤖 Generated with Claude Code

[crossjam]

LGTM! Fire in the disco!