Possible fix(deps): 27 vulnerable dependencies in uv.lock

[begininvoke]

Came across something in sandboxes/llm_local/uv.lock around line 1 that looked worth flagging.

HIGH risk — CVE-2025-66418 in urllib3 2.5.0 (sandboxes/llm_local/uv.lock). urllib3 versions >=1.24 and <2.6.0 do not bound the number of decompression steps applied to a response chain. A malicious or compromised HTTP server can return a response with an effectively unlimited stack of Content-Encoding layers (e.g., nested gzip/deflate), causing the client to burn excessive CPU and allocate huge amounts of memory decompressing it — a classic remote decompression-bomb DoS. Impact: any code path in the LLM sandbox that fetches URLs from untrusted or attacker-controlled endpoints (external API calls, web content retrieval, redirect following) can be hung or OOM-killed, degrading availability of the entire sandbox/service. No authentication or user interaction is required; the attacker only needs to control or intercept the endpoint the client connects to. Remediation: upgrade urllib3 to 2.6.0, which caps the decompression chain. After upgrading, verify no other dependency pins urllib3 <2.6.0 (e.g., via requests/botocore constraints) and re-run the scan to confirm the finding is resolved.

Something like this might fix it:

uv.lock is a generated lockfile, so the fix should upgrade the locked version via uv (regenerating hashes) rather than hand-editing:

```bash
cd sandboxes/llm_local
uv lock --upgrade-package 'urllib3>=2.6.0'
uv sync
```

Resulting change in sandboxes/llm_local/uv.lock (hashes/URLs regenerated by uv):

```diff
--- a/sandboxes/llm_local/uv.lock
+++ b/sandboxes/llm_local/uv.lock
@@
 [[package]]
 name = "urllib3"
-version = "2.5.0"
+version = "2.6.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/.../urllib3-2.5.0.tar.gz", hash = "sha256:<old-hash>" }
+sdist = { url = "https://files.pythonhosted.org/packages/.../urllib3-2.6.0.tar.gz", hash = "sha256:<regenerated-by-uv>" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/.../urllib3-2.5.0-py3-none-any.whl", hash = "sha256:<old-hash>" },
+    { url = "https://files.pythonhosted.org/packages/.../urllib3-2.6.0-py3-none-any.whl", hash = "sha256:<regenerated-by-uv>" },
 ]
```

Also verify sandboxes/llm_local/pyproject.toml does not upper-pin urllib3 (remove any `urllib3==2.5.0` or `urllib3<2.6` constraint; `urllib3>=2.6.0` is acceptable). Commit the updated uv.lock and re-run CI/scanning to confirm the vulnerability is cleared.

For reference: rule CVE-2025-66418. Rated high.

I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.