chore(security): upgrade pypdf past 21 advisories, SDK 2.x, Dependabot

.github/dependabot.yml

@@ -0,0 +1,16 @@
+# Keep the lockfile and pinned actions current. Security audit 2026-10-22:
+# pypdf sat 7 minor versions behind with 21 open advisories because nothing
+# watched the lock. Dependabot PRs still go through the offline CI gate.
+version: 2
+updates:
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      python-deps:
+        patterns: ["*"]
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

pyproject.toml

@@ -6,10 +6,8 @@ readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
     "typer>=0.12",
-    "httpx>=0.27",
     "pydantic>=2.7",
-    "pyyaml>=6.0",
-    "anthropic>=0.40",   # extraction model call (GATE-1 approved dependency)
+    "anthropic>=2.0",    # extraction model call (GATE-1 approved dependency); 2.x verified by the live golden 2026-10-22
     "pypdf>=5.0",        # PDF -> text for the extractor
 ]
 

tests/fixtures/tsmc_n2_2025/expected.json

@@ -1,12 +1,14 @@
 {
-  "_note": "Golden expected output (schema v2). Shape matches extract.ExtractionResult.model_dump(mode='json'). Every entity attribute now carries a grounded attribute_citation, and every location_type is 'unknown' — validate.py forces that under flat-text extraction (fail-safe), rather than laundering claims into 'body'. The relative speed claim keeps its ratio (1.15x) and names its baseline (N3E). All quote_spans are verbatim substrings of raw.pdf.",
+  "_note": "Golden expected output (schema v2). Shape matches extract.ExtractionResult.model_dump(mode='json'). Every entity attribute now carries a grounded attribute_citation, and every location_type is 'unknown' \u2014 validate.py forces that under flat-text extraction (fail-safe), rather than laundering claims into 'body'. The relative speed claim keeps its ratio (1.15x) and names its baseline (N3E). All quote_spans are verbatim substrings of raw.pdf.",
   "entities": [
     {
       "entity_id": "tsmc_n2",
       "entity_type": "process_node",
       "vendor": "TSMC",
       "name": "N2",
-      "aliases": ["N2"],
+      "aliases": [
+        "N2"
+      ],
       "node": {
         "density_mtx_mm2": null,
         "transistor_type": "gaa_nanosheet",
@@ -18,7 +20,7 @@
       "attribute_citations": {
         "node.transistor_type": {
           "page": 1,
-          "quote_span": "N2 is TSMC's first gate-all-around (GAA) nanosheet process node.",
+          "quote_span": "N2 is TSMC\u2019s first gate-all-around (GAA) nanosheet process node.",
           "location_type": "unknown"
         },
         "node.backside_power": {
@@ -38,7 +40,9 @@
       "entity_type": "process_node",
       "vendor": "TSMC",
       "name": "N3E",
-      "aliases": ["N3E"],
+      "aliases": [
+        "N3E"
+      ],
       "node": {
         "density_mtx_mm2": null,
         "transistor_type": "finfet",
@@ -80,7 +84,9 @@
         "precision": null,
         "sparsity": null,
         "thermal_config": null,
-        "stated_caveats": ["at iso-power"]
+        "stated_caveats": [
+          "at iso-power"
+        ]
       },
       "completeness": "complete",
       "citation": {

tests/fixtures/tsmc_n2_2025/llm_response.json

@@ -5,9 +5,7 @@
       "entity_type": "process_node",
       "vendor": "TSMC",
       "name": "N2",
-      "aliases": [
-        "N2"
-      ],
+      "aliases": [],
       "node": {
         "density_mtx_mm2": null,
         "transistor_type": "gaa_nanosheet",
@@ -18,7 +16,7 @@
       "chip": null,
       "attribute_citations": {
         "node.transistor_type": {
-          "quote_span": "N2 is TSMC's first gate-all-around (GAA) nanosheet process node.",
+          "quote_span": "N2 is TSMC\u2019s first gate-all-around (GAA) nanosheet process node.",
           "page": 1,
           "location_type": "body"
         },
@@ -39,9 +37,7 @@
       "entity_type": "process_node",
       "vendor": "TSMC",
       "name": "N3E",
-      "aliases": [
-        "N3E"
-      ],
+      "aliases": [],
       "node": {
         "density_mtx_mm2": null,
         "transistor_type": "finfet",

tests/test_validate.py

@@ -58,7 +58,7 @@ def _golden_proposal() -> dict:
                 "chip": None,
                 "attribute_citations": {
                     "node.transistor_type": {"page": 1, "location_type": "body",
-                        "quote_span": "N2 is TSMC's first gate-all-around (GAA) nanosheet process node."},
+                        "quote_span": "N2 is TSMC’s first gate-all-around (GAA) nanosheet process node."},
                     "node.backside_power": {"page": 1, "location_type": "body",
                         "quote_span": "N2 does not use backside power delivery."},
                     "node.hvm_date_claimed": {"page": 1, "location_type": "body",