fix(deps): bump click to 8.4.2 for VULN-88801

[shuningc]

Summary

• Remediate VULN-88801 (command injection in click.edit(); fixed in 8.3.3, ≤8.3.2 vulnerable).
• poetry.lock bumps click 8.1.8 → 8.4.2 (transitive; no pyproject.toml change, content-hash unchanged).
• Example pin elastic-chatbot-rag-app/requirements.txt → click==8.3.3; langgraph-fsi-agent/before/poetry.lock → 8.4.2.

Notes

• 8.4.2 satisfies all dependents: crewai >=8.1.7, litellm >=8.0.0,<9.0, httpx ==8.*, uvicorn >=7.0.
• The langgraph example lock update also reconciled a ruff entry declared in its pyproject but missing from the stale lock.

Test plan

• poetry check
• poetry run pytest tests/ (1988 passed, 10 skipped)

Jira

VULN-88801

[etserend]

Code Review — AI-Assisted Feedback

Reviewed by Claude Code (Claude Opus), automated review to assist human reviewers.

Verdict: Approve with comments

Minimal, well-scoped CVE fix. One optional consistency nit noted below.

---

P3 — Inconsistent click version pin across examples (Claude Code)

File/Section: examples/rag/elastic-chatbot-rag-app/requirements.txt
Issue: This example pins click==8.3.3 while the main poetry.lock and examples/agent/langgraph-fsi-agent/before/poetry.lock both resolve to 8.4.2. Both versions are past the CVE fix boundary (8.3.3+), so this is not a security concern — purely a consistency nit.
Recommended fix: Optionally bump the example pin to click==8.4.2 to eliminate version drift across examples.

---

Reviewer	Model	Key Contribution
Claude Code	Claude Opus	Version drift between example pin and lockfile