deps(python): update python-multipart requirement from >=0.0.31 to >=0.0.32 - #21

…ct (#3)

Bumps [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) from 0.312.0 to 0.575.0.
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/0.575.0/packages/lucide-react)

---
updated-dependencies:
- dependency-name: lucide-react
  dependency-version: 0.575.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [concurrently](https://github.com/open-cli-tools/concurrently) from 8.2.2 to 9.2.1.
- [Release notes](https://github.com/open-cli-tools/concurrently/releases)
- [Commits](open-cli-tools/concurrently@v8.2.2...v9.2.1)

---
updated-dependencies:
- dependency-name: concurrently
  dependency-version: 9.2.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…t 1.7.1

Supersedes Dependabot PRs #2, #4, #6. Build verified clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

… Handler, vLLM arrow direction corrected

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- STREAM_Architecture.png: dashed outbound connection arrows added for
  both Worker Task and HPC Proxy connecting to WebSocket relay, making
  the dual-channel firewall traversal visually explicit
- pearc26-stream-paper.tex: caption updated — Streaming Handler now
  correctly described as orchestrator invoking the Context Summarizer,
  outbound connection model explained
- pearc26-stream-paper-extended.tex: caption updated to match
- pearc26-stream-poster.tex: long caption rewritten to reflect correct
  pipeline order and dual-channel outbound connection model

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…rol Plane from left)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…eaks allowlist

- fastapi: exclude 0.136.3 (MAL-2026-4750, undocumented fastar dependency);
  uv resolves to 0.136.1 instead
- .gitleaks.toml: add docs/test-plan.md, docs/proxy-vm-deployment.md,
  docs/vm-hpc-as-api-migration.md to allowlist (placeholder curl examples)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

crypto.py and README.md contain placeholder values (my-shared-secret)
used in documentation examples, not real credentials.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

When a Globus access token is supplied, submit_streaming_inference()
creates a short-lived Executor authenticated as the caller so that
SLURM jobs appear under the user's own identity on the HPC cluster.
API-key callers continue using the persistent executor (stored creds).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: per-user Globus token + SSL fix for wss:// relay connections

…s-api)

vLLM streaming delta uses "reasoning" field, not "reasoning_content".
Both proxy and Globus Compute client now forward reasoning tokens as
reasoning_content in SSE delta chunks, matching hpc-as-api v0.3.9.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Gemma 4 31B Instruct is now running on ga-002 (2× A100 SXM4 80GB,
batch_gpuapi, ts_acer account). Qwen 2.5-VL-72B-AWQ remains registered
in LAKESHORE_MODELS for when ghi2-002 is re-allocated.

Changes:
- config.py: add lakeshore-gemma4-31b entry (ga-002:8001, hf_name=gemma4-31b,
  text-only); set as DEFAULT_MODELS lakeshore; add 131072/8192 context limits
- config.py: keep lakeshore-qwen-vl-72b as DEFAULT_VISION_MODELS lakeshore
  and in VISION_CAPABLE_MODELS (it's multimodal when running)
- litellm_config.yaml: add lakeshore-gemma4-31b model entry + timeout
- proxy/app.py: update context fallback to lakeshore-gemma4-31b
- context_window.py: update lakeshore tier summary to gemma4-31b (128K)
- .env: update VLLM_SERVER_URL to http://ga-002:8001

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix 14 CVEs flagged by pip-audit in CI:
- aiohttp 3.13.5 → 3.14.1 (CVE-2026-54273..54280)
- cryptography 48.0.0 → 49.0.0 (GHSA-537c-gmf6-5ccf)
- python-multipart 0.0.29 → 0.0.32 (CVE-2026-53538..53540)
- starlette 1.1.0 → 1.3.1 (CVE-2026-54282..54283)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Updates the requirements on [python-multipart](https://github.com/Kludex/python-multipart) to permit the latest version.
- [Release notes](https://github.com/Kludex/python-multipart/releases)
- [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md)
- [Commits](Kludex/python-multipart@0.0.31...0.0.32)

---
updated-dependencies:
- dependency-name: python-multipart
  dependency-version: 0.0.30
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>