#15 Bump remaining vulnerable dependencies

Clears the fixable open Dependabot alerts across all three scanned manifests (14 of the 17 currently open). The remaining three — hickory-proto (high + medium) and the low-severity lru 0.12.5 — need the rama 0.3.0 migration and a ratatui fork update respectively, and are tracked separately.

Bumps

Package	From → To	Manifest	Advisories
quinn-proto	0.11.14 → 0.11.15	codex-rs/Cargo.lock	GHSA-4w2j-m93h-cj5j (high)
serde_with	3.17.0 → 3.21.0	codex-rs/Cargo.toml + lock	GHSA-7gcf-g7xr-8hxj (medium)
tar	0.4.44 → 0.4.46	tools/argument-comment-lint/Cargo.lock	CVE-2026-33055, CVE-2026-33056, GHSA-3pv8-6f4r-ffg2 (3× medium)
datamodel-code-generator	0.31.2 → 0.64.0	sdk/python/pyproject.toml + uv.lock	CVE-2026-54621, -54653, -54654, -54690, -54691, -55389, -55391, -55415 (8× high), CVE-2026-55403 (low)

The tar alerts survived #13 because they live in the separate tools/argument-comment-lint lockfile, not the workspace one.

MODULE.bazel.lock is repinned via bazel mod deps --lockfile_mode=update (both crate universes feed it).

The datamodel-code-generator jump

sdk/python CI regenerates the checked-in v2_all.py and asserts it is unchanged, and 0.64.0 changes codegen behavior, so the bump carries two update_sdk_artifacts.py fixes plus the regenerated artifact:

• Generate for --target-python-version 3.10 to match the package's declared requires-python >= 3.10. 0.64 with the previous 3.11 target emits StrEnum, which doesn't exist on 3.10.
• Strip titles from single-value string-literal subschemas before codegen. The runtime schema titles discriminator consts (e.g. ApiKeyAccountType), and 0.64 with --use-title-as-name turns every titled subschema into its own named RootModel class. Without the strip, 233 discriminator fields that should stay inline Literal[...]s get wrapped, breaking payload.type == "apiKey"-style comparisons for SDK consumers. The old _set_discriminator_titles prepass is removed: the runtime schema already carries those titles, so adding them was a no-op, and titles on inline literals are now actively harmful.

With both fixes the regenerated v2_all.py has no class additions or removals. The diff is title metadata dropped from Literal fields plus 0.64 formatting cleanup (no redundant pass/model_config on RootModels, list → list[Any]).

Verification

• cargo check --workspace --all-targets — clean
• cargo deny check advisories bans licenses — all pass
• scripts/check-module-bazel-lock.sh — passes
• sdk/python: ruff check, ruff format --check, pytest — 119 passed, including the contract test that regenerates all artifacts against the new generator

---

Summary by cubic

Bumps quinn-proto, serde_with, tar, and datamodel-code-generator to clear 14 of the 17 open Dependabot alerts across the codex-rs, tools/argument-comment-lint, and sdk/python manifests. The remaining hickory-proto and lru alerts need the rama 0.3.0 migration and a ratatui fork update respectively.

Migration

• datamodel-code-generator jumps from 0.31.2 to 0.64.0, which changes codegen output.
• update_sdk_artifacts.py now targets Python 3.10 and strips titles from inline string-literal subschemas, keeping 233 discriminator fields as Literal[...]s instead of RootModel classes.
• The regenerated v2_all.py has no class additions or removals, only title metadata removal and formatting cleanup.