[sgonorov]

Details:

• uv.lock bumps urllib3 2.7.0 to 2.8.0 (CVE-2026-97687, CVE-2026-97688, CVE-2026-97689), certifi 2026.6.17 to 2026.10.18 (GHSA-6q48-6c7w-9gw2) and filelock 3.29.4 to 4.2.1 (CVE-2026-112907, CVE-2026-112913, CVE-2026-112940). filelock is a major version update. The tests passed with it.
• The lock was stale after the 2026.5.1 version bump, so re-locking also moved other packages. openvino is now 2026.5.1.dev20261106 and openvino-tokenizers is 2026.5.1.0, as in pyproject.toml. It dropped the Python 3.10 entries of numpy, matplotlib and contourpy, and removed exceptiongroup and tomli, because requires-python is >=3.11.
• Impact: SAFE. No source file under python/ imports these packages. They reach only the tests, through requests (from tiktoken) and huggingface-hub, which uses filelock in snapshot_download.
• Tests: layer_tests.py and tokenizers_test.py ran before and after the bump (13732 passed, no new failures). No listed CVE is left in OSV.dev.

Tickets:

• CVS-196369
• CVS-197826
• CVS-198502

AI assistance used: yes
If yes: covbot (AI) triaged the findings, re-locked uv.lock and wrote this description.
Human validation performed: none yet (automated by covbot: lock file only, no listed CVE left (OSV.dev), impact analysis, pytest layer_tests.py, tokenizers_test.py (13732 passed, no new failures))

Checklist: