fix(deps): upgrade msgpack to 1.2.1 for GHSA-6v7p-g79w-8964

[kevinmessiaen]

msgpack 1.1.2 is flagged by pip-audit (GHSA-6v7p-g79w-8964). Bump the transitive dependency in the lockfile to the fixed version 1.2.1.

Also add a fix-cve skill documenting the uv-lockfile CVE remediation procedure and verification gate.

Description

Related Issue

Type of Change

• 📚 Examples / docs / tutorials / dependencies update
• 🔧 Bug fix (non-breaking change which fixes an issue)
• 🥂 Improvement (non-breaking change which improves an existing feature)
• 🚀 New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to change)
• 🔐 Security fix

Coding agents

Autonomous agents with no human in the loop must read AUTONOMOUS.md before opening a PR.

PR title: agent-opened PRs must end the title with 🤖🤖🤖🤖 (exactly four robot emojis). Do not omit — that suffix is how the expedited agent PR workflow picks up the PR.

Checklist

• I've read the CODE_OF_CONDUCT.md document.
• I've read the CONTRIBUTING.md guide.
• I've written tests for all new methods and classes that I created.
• I've written the docstring in NumPy format for all the methods and classes that I created or modified.
• I've updated the uv.lock running uv lock (only applicable when pyproject.toml has been
  modified)

[gemini-code-assist]

Code Review

This pull request adds a new skill guide (SKILL.md) outlining the procedure for remediating Python dependency vulnerabilities using the uv lockfile, and applies this to upgrade msgpack from version 1.1.2 to 1.2.1 in uv.lock. The review feedback recommends expanding the guide to address resolution failures caused by version constraints, suggesting solutions such as upgrading parent dependencies or using tool.uv.overrides in pyproject.toml.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.