[cdbartholomew]

Routine dependency maintenance for hindsight-system-evals/uv.lock.

Closes Dependabot alerts: #1723, #1724, #1755

Change

• urllib3 2.7.0 -> 2.8.0. All three advisories have upper bound < 2.8.0.

Lockfile-only, 3-line diff, produced with uv lock --upgrade-package urllib3. Consumers are requests (via google-genai / google-auth) and the in-repo hindsight-client. Neither caps urllib3 below 2.8.

uv 0.11.15 also re-recorded two redundant marker = annotations on scipy's numpy edges. These duplicate the existing resolution-markers and have nothing to do with this bump, so I dropped them to keep the diff minimal. uv lock --check passes on the result.

Verification (local)

No CI job runs on this lockfile (hindsight-system-evals is not under any path filter in test.yml), so the local results below are the evidence for this change.

• uv lock --check: OK
• uv build: OK
• uv sync --frozen: OK
• uv run pytest tests: 25 passed, 1 skipped. A clean origin/main checkout gives the same 25 passed, 1 skipped.
• Import check: urllib3, requests, hindsight_client, google.genai and hindsight_system_evals all import, and a live urllib3.PoolManager HTTPS request returned 200 on 2.8.0

[cdbartholomew]

CI coverage note for this PR: no pull_request job exercises hindsight-system-evals/. test.yml has no path filter or job for it. The only workflow that references it is perf-test.yml, which runs on a schedule or by workflow_dispatch. The three checks that ran here (detect-changes, build-docs, verify-generated-files) do not touch this lockfile and should not be read as coverage.

Local evidence for the change instead:

• uv lock --check, uv build and uv sync --frozen all OK
• uv run pytest tests: 25 passed, 1 skipped on this branch, and the same 25 passed, 1 skipped on a clean origin/main worktree. No new failures.
• urllib3, requests, hindsight_client, google.genai and hindsight_system_evals all import on urllib3 2.8.0, and a live PoolManager HTTPS request returned 200