[pre-commit.ci] pre-commit autoupdate

[pre-commit-ci]

updates:

• github.com/astral-sh/ruff-pre-commit: v0.15.16 → v0.15.17

[amrit110]

Security Vulnerability — No Patch Available Yet

aieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:

Package	Version	Vulnerability	Status
torch	2.12.0	CVE-2025-3000	No fix available on PyPI

Why this cannot be auto-fixed

The vulnerability (CVE-2025-3000) exists in torch itself. A fix requires the upstream maintainers (PyTorch) to release a new version. The current latest PyTorch version on PyPI is 2.12.0, which is already the installed version and still listed as vulnerable. Once a patched release is published to PyPI, aieng-bot can re-run and apply the update automatically.

What was fixed automatically

• tornado 6.5.5 → 6.5.7: Fixed CVE-2026-49854 (websocket mask buffer overread)
• aiohttp 3.14.0 → 3.14.1: Fixed CVE-2026-54273 through CVE-2026-54280

Recommended next steps

1. Monitor the CVE-2025-3000 advisory for a PyTorch patch release
2. Consider whether a pip-audit ignore/exception can be added temporarily with justification (requires human review)
3. Consider whether this dependency can be replaced with an alternative

This PR will not be auto-merged until the vulnerability is resolved.