build(deps): cherry-pick 16 dependabot updates from pick-me PRs onto main

[Copilot]

Cherry-picks commits from 17 open dependabot PRs labelled pick-me into a single branch rebased on main. Where multiple PRs touch the same file, commits are ordered by descending line number to minimize merge conflicts. 2 PRs conflicted and were skipped; 1 security fix was applied manually after its containing PR conflicted.

Applied (16/17)

tools/base/requirements.txt (ordered highest→lowest line):

• setuptools 82.0.0 → 82.0.1 (build(deps): bump setuptools from 82.0.0 to 82.0.1 in /tools/base #43861)
• yarl 1.22.0 → 1.23.0 (build(deps): bump yarl from 1.22.0 to 1.23.0 in /tools/base #43706)
• slack-sdk 3.40.1 → 3.41.0 (build(deps): bump slack-sdk from 3.40.1 to 3.41.0 in /tools/base #43940)
• black 25.12.0 → 26.3.1 — security fix (arbitrary file write via unsanitized cache filename); pathspec 0.12.1 → 1.0.4 (required by new black) — applied manually from build(deps): bump the pip group across 1 directory with 2 updates #43978, which conflicted as a whole due to the pyopenssl part being already covered
• pyopenssl 25.3.0 → 26.0.0 (build(deps): bump pyopenssl from 25.3.0 to 26.0.0 in /tools/base #43972, CVE-2026-27459 / CVE-2026-27448)
• protobuf 7.34.0 → 7.34.1 (build(deps): bump protobuf from 7.34.0 to 7.34.1 in /tools/base #44080)
• orjson 3.11.6 → 3.11.7 (build(deps): bump orjson from 3.11.6 to 3.11.7 in /tools/base #43306)
• icalendar 7.0.2 → 7.0.3 (build(deps): bump icalendar from 7.0.2 to 7.0.3 in /tools/base #43740)
• cryptography 46.0.5 → 46.0.6 (build(deps): bump cryptography from 46.0.5 to 46.0.6 in /tools/base #44120, CVE-2026-34073)
• aiohttp 3.13.3 → 3.13.4 (build(deps): bump aiohttp from 3.13.3 to 3.13.4 in /tools/base #44163)

Independent files:

• moby/buildkit v0.27.0 → v0.28.1 (ci/Dockerfile-buildkit, build(deps): bump moby/buildkit from v0.27.0 to v0.28.1 in /ci #44119)
• requests 2.32.5 → 2.33.0 (docs/tools/python/requirements.txt, build(deps): bump requests from 2.32.5 to 2.33.0 in /docs/tools/python in the pip group across 1 directory #44112, CVE-2026-25645)
• google.golang.org/grpc 1.78.0 → 1.79.3 (go.mod/go.sum, build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 in the go_modules group across 1 directory #44016) — includes auth bypass security fix
• peter-evans/create-or-update-comment 4 → 5 (command.yml, build(deps): bump peter-evans/create-or-update-comment from 4.0.0 to 5.0.0 #43787)
• github/codeql-action 4.32.4 → 4.32.5 (3 workflow files, build(deps): bump github/codeql-action from 4.32.4 to 4.32.5 #43718)
• actions/upload-artifact 6.0.0 → 7.0.0 (scorecard.yml, build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 #43707)

Skipped (conflicts, left for next pass)

• build(deps): bump the pip group across 1 directory with 2 updates #43978 full (black+pathspec+pyopenssl group) — pyopenssl already applied; black/pathspec extracted manually above
• build(deps): bump pygithub from 2.8.1 to 2.9.0 in /tools/base #44079 pygithub 2.8.1 → 2.9.0 — conflicts with current requirements.txt state

[repokitteh-read-only]

As a reminder, PRs marked as draft will not be automatically assigned reviewers,
or be handled by maintainer-oncall triage.

Please mark your PR as ready when you want it to be reviewed!

🐱

Caused by: #44184 was opened by Copilot.

see: more, trace.