fix(deps): bump orjson to 3.11.9 for VULN-88807

[shuningc]

Summary

• Remediate VULN-88807: orjson.dumps did not limit recursion for deeply nested JSON (fixed after 3.11.4).
• Main poetry.lock: orjson 3.11.2 → 3.11.9 (no pyproject change).
• Example pins → orjson==3.11.5; langgraph example lock → 3.11.9.

Lock regeneration note

Main poetry.lock was regenerated with Poetry 2.4.1. The explicit ruff 0.15.22 dev entry reflects an existing pyproject.toml dev dependency, not new scope for VULN-88807.

Test plan

• poetry check
• Installed orjson 3.11.9; poetry run pytest tests/ (1988 passed, 10 skipped)

Jira

VULN-88807

[etserend]

Code Review — AI-Assisted Feedback

Reviewed by Claude Code (Claude Opus), automated review to assist human reviewers.

Verdict: Approve with comments

Minimal security bump with two minor observations below.

---

P3 — Unrelated ruff dev dependency added alongside vuln fix (Claude Code)

File/Section: poetry.lock (ruff entry, dev group)
Issue: The main poetry.lock gained a new ruff 0.15.22 entry in the dev group, unrelated to the orjson vuln remediation. Low-risk (dev-only), but introduces scope creep for a security-only PR.
Evidence: Diff lines add [[package]] name = "ruff" version = "0.15.22" under groups = ["dev"].
Recommended fix: Acceptable as-is; consider noting the ruff addition in the PR description, or split into a follow-up PR to keep security fixes minimal.

---

P3 — Example pins at 3.11.5 while lockfile resolves to 3.11.9 (Claude Code)

File/Section: examples/agent/startup-simulator-3000/requirements.txt, examples/rag/elastic-chatbot-rag-app/requirements.txt
Issue: These example files pin orjson==3.11.5 while the main lockfile and langgraph example use 3.11.9. All are past the 3.11.5 fix boundary for VULN-88807, so no security concern — purely a consistency nit.
Recommended fix: Optional — align example pins to orjson==3.11.9.

---

Reviewer	Model	Key Contribution
Claude Code	Claude Opus	Identified incidental ruff addition and example pin version drift