Fix CI failures: linting and dependency vulnerabilities

- Apply code formatting fixes (black) to resolve test workflow failures.
- Update `pyproject.toml`, `src/requirements.txt`, and lock files to upgrade vulnerable dependencies:
  - aiohttp -> 3.13.3
  - cryptography -> 46.0.5
  - orjson -> 3.11.7 (CVE-2025-67221)
  - pillow -> 12.1.1 (CVE-2026-25990)
  - pynacl -> 1.6.2 (CVE-2025-69277)
  - starlette -> 0.52.1 (CVE-2025-62727)
  - urllib3 -> 2.6.3 (CVE-2025-66418, etc.)
  - cbor2 -> 5.8.0 (CVE-2025-68131)
  - pyasn1 -> 0.6.2 (CVE-2026-23490)
  - python-multipart -> 0.0.22 (CVE-2026-24486)
- Manually sync `requirements.lock` from `poetry.lock` as `pip-compile` is unavailable in the environment.

Co-authored-by: PR0M3TH3AN <[email protected]>

src/requirements.txt

@@ -1,11 +1,11 @@
 colorama>=0.4.6,<1
 termcolor>=1.1.0,<4
-cryptography>=40.0.2,<46
+cryptography>=46.0.5
 bip-utils>=2.5.0,<3
 bech32>=1.2,<2
 coincurve>=18.0.0,<22
 mnemonic>=0.21,<1
-aiohttp>=3.9,<4
+aiohttp>=3.13.3,<4
 bcrypt>=4,<5
 pytest>=7,<9
 pytest-cov>=4,<7
@@ -20,6 +20,10 @@ hypothesis>=6,<7
 mutmut>=2.4.4,<4
 pgpy>=0.6,<1
 pyotp>=2.8,<3
+pynacl>=1.6.2,<2
+cbor2>=5.8.0,<6
+pyasn1>=0.6.2,<1
+urllib3>=2.6.0,<3
 
 freezegun>=1.5.4,<2
 typer>=0.12.3,<1
@@ -29,14 +33,14 @@ pyperclip>=1.9,<2            # Clipboard support for secret mode
 qrcode>=8.2,<9               # Generate QR codes for TOTP setup
 fastapi>=0.110,<1            # API server
 uvicorn>=0.29,<1             # API server
-starlette>=0.47.2,<1         # API server
+starlette>=0.49.1,<1         # API server
 httpx>=0.28.1,<1             # API server
 requests>=2.32,<3            # API server
-python-multipart>=0.0.20,<0.1  # API server file uploads
+python-multipart>=0.0.22,<0.1  # API server file uploads
 PyJWT>=2.10.1,<3             # JWT authentication for API server
-orjson>=3.11.1,<4            # Fast JSON serialization for API server
+orjson>=3.11.5,<4            # Fast JSON serialization for API server
 argon2-cffi>=21,<26          # Password hashing for API server
 toga-core>=0.5.2,<1          # Desktop GUI
-pillow>=11.3,<12             # Image support for GUI
+pillow>=12.1.1,<13             # Image support for GUI
 toga-dummy>=0.5.2,<1         # Headless GUI tests
 slowapi>=0.1.9,<1            # Rate limiting for API server

src/seedpass/api.py

@@ -38,7 +38,9 @@ logger = logging.getLogger(__name__)
 async def dynamic_cors_headers(request: Request, call_next):
     response = await call_next(request)
     origins = {
-        o.strip() for o in os.getenv("SEEDPASS_CORS_ORIGINS", "").split(",") if o.strip()
+        o.strip()
+        for o in os.getenv("SEEDPASS_CORS_ORIGINS", "").split(",")
+        if o.strip()
     }
     request_origin = request.headers.get("origin")
     if request_origin and request_origin in origins:

src/seedpass/cli/agent.py

@@ -85,7 +85,9 @@ def _load_policy(*, strict: bool = False) -> dict:
             raise ValueError(
                 f"agent policy has invalid deny_private_reveal entries: {invalid}"
             )
-        policy["deny_private_reveal"] = [v for v in deny_private if v in ALL_ENTRY_TYPES]
+        policy["deny_private_reveal"] = [
+            v for v in deny_private if v in ALL_ENTRY_TYPES
+        ]
     if isinstance(data.get("allow_export_import"), bool):
         policy["allow_export_import"] = data["allow_export_import"]
     return policy

src/tests/test_imghdr_stub.py

@@ -164,6 +164,7 @@ def test_what_preserves_file_position():
     assert res == "png"
     assert f.tell() == original_pos
 
+
 def test_what_with_bytes_io_jpeg_exif():
     """Test what() with a BytesIO object containing JPEG Exif header."""
     # JPEG magic number: FF D8 FF E0 .. .. Exif

src/tests/test_key_validation_utils.py

@@ -14,31 +14,49 @@ from utils.key_validation import (
     validate_seed_phrase,
 )
 
+
 def test_validate_totp_secret_exception(monkeypatch):
     """Test that validate_totp_secret returns False when an exception occurs."""
-    monkeypatch.setattr("utils.key_validation.pyotp.TOTP", Mock(side_effect=Exception("TOTP Error")))
+    monkeypatch.setattr(
+        "utils.key_validation.pyotp.TOTP", Mock(side_effect=Exception("TOTP Error"))
+    )
     assert validate_totp_secret("any_secret") is False
 
+
 def test_validate_ssh_key_pair_exception(monkeypatch):
     """Test that validate_ssh_key_pair returns False when an exception occurs."""
-    monkeypatch.setattr("utils.key_validation.serialization.load_pem_private_key", Mock(side_effect=Exception("SSH Error")))
+    monkeypatch.setattr(
+        "utils.key_validation.serialization.load_pem_private_key",
+        Mock(side_effect=Exception("SSH Error")),
+    )
     assert validate_ssh_key_pair("priv", "pub") is False
 
+
 def test_validate_pgp_private_key_exception(monkeypatch):
     """Test that validate_pgp_private_key returns False when an exception occurs."""
-    monkeypatch.setattr("utils.key_validation.PGPKey.from_blob", Mock(side_effect=Exception("PGP Error")))
+    monkeypatch.setattr(
+        "utils.key_validation.PGPKey.from_blob",
+        Mock(side_effect=Exception("PGP Error")),
+    )
     assert validate_pgp_private_key("priv", "fp") is False
 
+
 def test_validate_nostr_keys_exception(monkeypatch):
     """Test that validate_nostr_keys returns False when an exception occurs."""
     # The function calls Keys.bech32_to_hex(nsec) first
-    monkeypatch.setattr("utils.key_validation.Keys.bech32_to_hex", Mock(side_effect=Exception("Nostr Error")))
+    monkeypatch.setattr(
+        "utils.key_validation.Keys.bech32_to_hex",
+        Mock(side_effect=Exception("Nostr Error")),
+    )
     assert validate_nostr_keys("npub", "nsec") is False
 
+
 def test_validate_seed_phrase_exception(monkeypatch):
     """Test that validate_seed_phrase returns False when an exception occurs."""
     # The function calls Mnemonic("english").check(mnemonic)
     mock_instance = MagicMock()
     mock_instance.check.side_effect = Exception("Seed Error")
-    monkeypatch.setattr("utils.key_validation.Mnemonic", Mock(return_value=mock_instance))
+    monkeypatch.setattr(
+        "utils.key_validation.Mnemonic", Mock(return_value=mock_instance)
+    )
     assert validate_seed_phrase("mnemonic") is False

src/tests/test_modify_entry_validation.py

@@ -82,16 +82,16 @@ def test_modify_entry_invalid_fields(
     """Test that modify_entry raises ValueError for invalid fields based on EntryType."""
     # Setup entry
     if entry_type == EntryType.TOTP:
-         # add_totp returns a URI string, need to fix the index manually or check implementation
-         # Checking implementation: add_totp returns URI string, but index is predictable (0)
-         # However, we should verify the index.
-         # For simplicity, we assume index 0 as it's the first entry.
-         setup_func(entry_manager)
-         index = 0
+        # add_totp returns a URI string, need to fix the index manually or check implementation
+        # Checking implementation: add_totp returns URI string, but index is predictable (0)
+        # However, we should verify the index.
+        # For simplicity, we assume index 0 as it's the first entry.
+        setup_func(entry_manager)
+        index = 0
     elif entry_type == EntryType.PASSWORD:
-         index = setup_func(entry_manager)
+        index = setup_func(entry_manager)
     else:
-         index = setup_func(entry_manager)
+        index = setup_func(entry_manager)
 
     # Verify entry exists and has correct type
     entry = entry_manager.retrieve_entry(index)