etserend · Oct 20, 2026 · Oct 21, 2026 · Oct 21, 2026
diff --git a/examples/agent/langgraph-fsi-agent/before/poetry.lock b/examples/agent/langgraph-fsi-agent/before/poetry.lock
diff --git a/examples/agent/startup-simulator-3000/requirements.txt b/examples/agent/startup-simulator-3000/requirements.txt
@@ -1,5 +1,5 @@
 annotated-types==0.7.0
-anyio==4.9.0
+anyio==4.14.2
 aiohttp==3.14.3
 attrs==25.3.0
 certifi==2025.4.26

diff --git a/examples/logging-samples/openai-responses/requirements.txt b/examples/logging-samples/openai-responses/requirements.txt
@@ -2,7 +2,7 @@
 #    uv pip compile pyproject.toml -o requirements.txt
 annotated-types==0.7.0
     # via pydantic
-anyio==4.12.1
+anyio==4.14.2
     # via
     #   httpx
     #   openai

diff --git a/examples/rag/elastic-chatbot-rag-app/requirements.txt b/examples/rag/elastic-chatbot-rag-app/requirements.txt
@@ -12,7 +12,7 @@ aiosignal==1.4.0
     # via aiohttp
 annotated-types==0.7.0
     # via pydantic
-anyio==4.9.0
+anyio==4.14.2
     # via
     #   httpx
     #   openai

diff --git a/poetry.lock b/poetry.lock
diff --git a/pyproject.toml b/pyproject.toml
@@ -68,6 +68,10 @@ filelock = ">=3.20.1"
 idna = ">=3.15,<4"
 python-dotenv = ">=1.2.2"
 requests = ">=2.33.0"
+# Security floor only (VULN-120002 / CVE-2026-63374): not imported directly under src/;
+# pulled in transitively via httpx (required), openai, mcp and starlette.
+# Do not remove as "unused".
+anyio = ">=4.14.2"
 # Security floor only (VULN-106433 / CVE-2026-69247): not imported directly under src/;
 # pulled in transitively via pdfminer-six (crewai/all) and mcp -> pyjwt[crypto] (openai).
 # Do not remove as "unused".