[mrmx]

Summary

Bumps the transitive anyio dependency in uv.lock from 4.13.0 to 4.14.2, the first release
carrying the fix for CVE-2026-63374 (CVSS 9.3): TLSStream's IDNA 2003 host-name encoding left a
certificate-spoofing window.

anyio comes in through httpx, so this touches the generated client's transport stack.

Change

uv lock --upgrade-package anyio==4.14.2 - only the anyio entries change (version plus sdist and wheel
URL/hash). The unrelated zipp marker churn that uv also produced was reverted, so the diff is a single
package bump.

Verification (on top of current main, pyproject 0.128.37)

• uv sync --frozen --python 3.11 -> anyio 4.14.2 installed
• uv run ruff check src/ tests/ -> All checks passed
• uv run ruff format --check src/ tests/ -> 283 files already formatted
• uv run mypy src/ tests/ -> Success: no issues found in 283 source files
• uv run pytest -q -> 58 passed, 1 skipped (the skip is the pre-existing openapi.yaml-absent smoke check)
• uv lock --check -> consistent

No source changes and no API surface change.

Note: the build wheel + sdist job fails on the openapi.yaml-vs-pyproject version check. That is
pre-existing and unrelated - current main (pyproject 0.128.37) already fails it because upstream
openapi.yaml is now 0.128.41. The lint + mypy + pytest matrix passes.