[Amir-R25]

Summary

Closes Dependabot alert 209 (GHSA-xcq7-p3pf-p88h): opentelemetry-api up to 1.45.0 is vulnerable, and uv.lock has 1.39.1.

This should also clear the Pillow, pypdf, aiohttp, mcp and oauthlib alerts that are still open even though #1732 fixed them. GitHub's dependency graph (what Dependabot checks alerts against) last read uv.lock when #1731 merged. It never re-read it for #1732, so it still thinks main has Pillow 12.3.0 and aiohttp 3.14.3; gh api repos/RailtownAI/railtracks/dependency-graph/sbom shows those old versions. A graph update runs when a push to main changes uv.lock, so merging this should refresh it.

What changed

Only uv.lock, via uv lock --upgrade-package opentelemetry-api:

• opentelemetry-api, -sdk, -proto, -exporter-otlp-proto-common and -exporter-otlp-proto-grpc: 1.39.1 -> 1.45.1. The SDK pins the API version exactly, so they move together.
• opentelemetry-semantic-conventions: 0.60b1 -> 0.66b1, and opentelemetry-exporter-otlp-common 0.66b1 is new (pulled in by the 1.45.1 exporter).
• Kept revision = 3, as in fix(deps): bump certifi and hash-pin CI's pip for the emSign CA incident #1728 and fix(deps): bump Pillow, pypdf, aiohttp, mcp and oauthlib for Dependabot alerts #1732.

Nothing in railtracks imports OpenTelemetry; it only comes in through chromadb. The published package doesn't pin any of this, so nothing changes for people installing railtracks from PyPI.

Testing

• uv lock --check passes.
• Installed the lock into a fresh Python 3.11 venv (uv sync --frozen --all-packages --all-extras --group dev). Created a chromadb collection, added a vector, and queried it back.
• Unit and integration tests pass on 3.11 (3946 passed, 9 skipped).