fix(wren-ai-service): clear 16 high-severity Dependabot alerts

[PaulChen79]

Summary

Bumps eight vulnerable dependencies in wren-ai-service to resolve the remaining 16 high-severity Dependabot alerts (all live in wren-ai-service/poetry.lock). The other 5 alerts on main are handled in #2330.

Package	From	To	Alerts	CVE / GHSA
urllib3	2.6.x	2.7.0	#327, #328	CVE-2026-44431, CVE-2026-44432
GitPython	3.1.43	3.1.50	#301, #302, #318, #321, #324	CVE-2026-44243, CVE-2026-42284, CVE-2026-42215, CVE-2026-44244, GHSA-mv93-w799-cj2w
Mako	1.3.10	1.3.12	#293, #320	CVE-2026-44307, CVE-2026-41205
pillow	12.1.1	12.2.0	#286, #317	CVE-2026-42311, CVE-2026-40192
tornado	6.5.x	6.5.6	#225, #269	CVE-2026-35536, CVE-2026-31958
nltk	3.9.3	3.9.4	#237	CVE-2026-33231
pyasn1	0.6.2	0.6.3	#232	CVE-2026-30922
orjson	3.11.5	3.11.9	#226	CVE-2025-67221

mako, tornado, and pyasn1 are added as explicit security pins (they were transitive), following the same urllib3/werkzeug/marshmallow/pillow pattern already in pyproject.toml. orjson/nltk/gitpython caret constraints are bumped so the patched minimum is enforced.

Test plan

• poetry check --lock — passes (exit 0)
• Imports verified on a fresh Poetry 2.x venv (Python 3.12.13):
  urllib3 2.7.0, GitPython 3.1.50, mako 1.3.12, Pillow 12.2.0, tornado 6.5.6, pyasn1 0.6.3, orjson 3.11.9, nltk 3.9.4
• CI (ci/ai-service label needed): just test matrix on ubuntu-22.04

Add the ci/ai-service label so the full pytest suite runs.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 89541475-7cfc-4417-8d4c-d1020e5c1866

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/fix-dependbot-vulnerability-issues-legacy-v1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}