fix(deps): require idna >=3.15 for VULN-88794

[shuningc]

Summary

• Address VULN-88794 / CVE-2024-3651 follow-up: require idna >= 3.15 (DoS via idna.encode() on crafted long inputs; fixes incomplete in 3.10).
• Root poetry.lock resolves to 3.18.
• Previously locked at 3.10 transitively (httpx / requests / yarl, etc.).

Changes

• Add direct idna = ">=3.15,<4" in pyproject.toml.
• Refresh poetry.lock (idna 3.10 → 3.18).
• Bump example pins to idna==3.15 (minimum fixed) where pinned.
• Update examples/agent/langgraph-fsi-agent/before/poetry.lock for idna 3.18.

Verification

• poetry check
• poetry lock (no drift)
• poetry run pytest tests/ — 1988 passed, 10 skipped
• PyPI hashes for idna 3.18 match lockfile

Test plan

• CI green

Jira

• VULN-88794

[etserend]

Code Review — AI-Assisted Feedback

Reviewed by Claude Code (Claude Opus), automated review to assist human reviewers.

Verdict: Approve with comments

Minimal, well-scoped CVE fix. One minor version drift noted below.

---

P3 — Example pins on minimum fixed version (3.15) while lockfile resolves to 3.18 (Claude Code)

File/Section: examples/agent/minimal-agent-example/requirements.txt (and other example requirements files)
Issue: Example requirements files pin idna==3.15 (the minimum version that fixes CVE-2024-3651), while the root poetry.lock resolves to 3.18. Both are safe, but the inconsistency could cause mild confusion in future audits.
Evidence: examples/agent/minimal-agent-example/requirements.txt: idna==3.15 vs poetry.lock: version = "3.18".
Recommended fix: Optional — align example pins to idna==3.18 for uniformity, or document the rationale for using the minimum-fixed pin in examples.

---

Reviewer	Model	Key Contribution
Claude Code	Claude Opus	Flagged version drift between example pins and root lockfile