Summary

• Address VULN-88794 / CVE-2024-3651 follow-up: require idna >= 3.15 (DoS via idna.encode() on crafted long inputs; fixes incomplete in 3.10).
• Root poetry.lock resolves to 3.18.
• Previously locked at 3.10 transitively (httpx / requests / yarl, etc.).

Changes

• Add direct idna = ">=3.15,<4" in pyproject.toml.
• Refresh poetry.lock (idna 3.10 → 3.18).
• Bump example pins to idna==3.15 (minimum fixed) where pinned.
• Update examples/agent/langgraph-fsi-agent/before/poetry.lock for idna 3.18.

Verification

• poetry check
• poetry lock (no drift)
• poetry run pytest tests/ — 1988 passed, 10 skipped
• PyPI hashes for idna 3.18 match lockfile

Test plan

• CI green

Jira

• VULN-88794