[jothimani-rajendran]

Summary

Bumps semgrep 1.175.0 -> 1.183.0 in requirements/semgrep.in and regenerates requirements/semgrep.txt with uv pip compile --generate-hashes --python-platform linux --python-version 3.12 (plus -P urllib3 -P mcp -P opentelemetry-api to force-upgrade).

pip-audit -r requirements/semgrep.txt --no-deps:

Package	Before	After
certifi	2026.7.22, 1 advisory	2026.10.23, 0
pyjwt	2.13.0, 14 advisories	2.15.1, 0
urllib3	2.7.0, 3 advisories	2.8.0, 0
mcp	1.29.0, 4 advisories	1.29.0, 4 (semgrep pins it exactly)
opentelemetry-api	1.37.0, 1 advisory	1.37.0, 1 (semgrep pins it exactly)

Total: 23 advisories before, 5 after.

Not in this PR: the setuptools, filelock, virtualenv, pillow and cairosvg bumps. Their lock files (binary, dev, runtime, brand-assets) include the agentseam archive URL. The session's proxy returns 403 for that download, so they could not be regenerated here. build.txt was left alone because tests/test_build_isolation.py requires its setuptools pin to equal dev.txt's.

Checks

• ruff check and ruff format --check: clean.
• Full pytest: 5089 passed, 99 skipped. The one failure was the build.txt/dev.txt setuptools consistency test described above, which passes now that the build.txt bump is dropped.
• The semgrep CI scan is the acceptance check for keeping 1.183.0.

---

Generated by Claude Code