Prepare exp-mitmproxy 12.2.3.post2 security dependencies

[kfallah]

Summary

• Prepare exp-mitmproxy 12.2.3.post2 with patched cryptography, Tornado, MessagePack, pyasn1, PyOpenSSL and urllib3 dependencies.
• Require cryptography 50.0.1, Tornado 6.5.10 and MessagePack 1.2.2 in published metadata so fresh installations cannot select the affected releases.
• Upgrade the web dependencies, replace the old esbuild-jest dependency tree with the existing Jest 29 runner's Babel transformer, and rebuild the packaged web assets.
• Apply compatible Babel, humanfs, once and AJV updates for the remaining patchable moderate and low advisories.
• Patch h2 4.4.1, hpack 4.2.0, IDNA 3.15, Flask 3.1.3, Werkzeug 3.1.6, setuptools 83.0.0, uv 0.11.15 and Pygments 2.20.0. Match the HTTP/2 wrapper's input annotation to h2's buffer protocol contract.

Validation

• Python 3.13 installation, including the pinned native Capture package: passed.
• Whole-repository Ruff: passed.
• Mypy: passed for 253 source files after the HTTP/2 update.
• npm ci, TypeScript, ESLint and production web bundle: passed.
• npm audit: zero high, critical or low advisories; seven moderate package entries remain. Six trace to UUID through Jest's desktop notification dependency; the seventh is Bootstrap 3. Capture imports Bootstrap's LESS styles, and no Bootstrap JavaScript import was found.
• GitHub CI: passed on final commit 3863dc9, including Linux, macOS and Windows package jobs.
• Greptile: requested, but no review has started. Repository review access needs confirmation before the required 5/5 can be obtained.

Dependency order

This PR targets codex/capture-package, the branch supplying Experiential's immutable Capture pin. It hardens the dependencies from #1 and aligns one type annotation with patched h2. The equivalent main-branch hardening is #2.

The updated lockfiles remove the affected ranges for all 38 baseline high-severity records and 71 of 73 records across all severities. The remaining baseline records are the development-only UUID notification dependency and pytest 8's temporary-directory advisory. The pinned pytest-asyncio 1.2.0 requires pytest <9, so the pytest >=9.0.3 fix needs a paired framework upgrade. Capture additionally retains Bootstrap 3, as shown by the npm audit. No alerts are dismissed.

Publish exp-mitmproxy 12.2.3.post2 from the final reviewed commit before publishing the Experiential repin. The existing Experiential release workflow requires the Capture dependency to be available from PyPI before publication.

Compatibility

Cryptography 49 and later stopped publishing Intel Mac wheels. The new security floor requires 50.0.1; Intel Mac Python installations consequently need a compatible source build. The existing Capture package CI covers Linux, Apple Silicon macOS and Windows. The main-branch dependency PR's Intel Mac install/build job passed with the same cryptography floor.

[kfallah]

@greptileai review

[kfallah]

@greptileai review

[kfallah]

@greptileai review