chore(deps): floor-pin pydantic-settings >=2.14.2 + msgpack >=1.2.1 for clean pip-audit

  pip-audit flagged two advisories at the resolved versions in the venv.
  Neither is reachable in shipped Bambuddy, but the pins are taken so
  the audit stays clean and a future reachable advisory in either
  package isn't masked by existing noise.

  pydantic-settings 2.14.2 patches GHSA-4xgf-cpjx-pc3j —
  NestedSecretsSettingsSource with secrets_nested_subdir=True followed
  symlinks pointing outside the configured secrets_dir, reading
  out-of-tree files into settings values and bypassing the documented
  secrets_dir_max_size cap. Affected: >=2.12.0, <2.14.2. Bambuddy uses
  pydantic-settings only for env-var-backed config; the secrets-dir
  loader is not used (grep clean on NestedSecretsSettingsSource /
  secrets_nested_subdir / secrets_dir under backend/).

  msgpack 1.2.1 patches GHSA-6v7p-g79w-8964 — reusing an Unpacker
  instance after it caught an error can crash with SEGV, which is a
  DoS vector on untrusted input. msgpack is not a runtime dep of
  Bambuddy; it enters the tree only as a transitive of CacheControl,
  itself pulled by pip-audit (the very tool that surfaced the
  advisory). Pin placed in requirements-dev.txt next to pip-audit so
  it travels with the security-scan tooling rather than implying a
  runtime use.

requirements-dev.txt

@@ -18,5 +18,9 @@ pyOpenSSL>=26.0.0
 # Security scanning
 bandit[sarif]>=1.7.0
 pip-audit>=2.7.0
+# Transitive of pip-audit→CacheControl. 1.2.1 patches GHSA-6v7p-g79w-8964
+# (Unpacker SEGV/DoS on reuse after caught error). Not a runtime dep of
+# Bambuddy — pinned here so the audit stays clean.
+msgpack>=1.2.1
 # Secrets scan: gitleaks (Go binary, not a Python package).
 # Install: go install github.com/zricethezav/gitleaks/v8@latest

requirements.txt

@@ -21,7 +21,10 @@ greenlet>=3.0.0
 
 # Pydantic
 pydantic>=2.0.0
-pydantic-settings>=2.0.0
+# 2.14.2 patches GHSA-4xgf-cpjx-pc3j (NestedSecretsSettingsSource follows
+# symlinks out of secrets_dir). Bambuddy does not use that source — pin
+# is precautionary so the audit stays clean.
+pydantic-settings>=2.14.2
 # Transitive of pydantic-settings, floor-pinned to patch CVE-2026-28684 (dotenv 1.2.1)
 python-dotenv>=1.2.2