chore(deps): move benchmark deps to PEP 723 scripts, patch vulns

.github/workflows/CI.yml

@@ -419,11 +419,12 @@ jobs:
         uses: actions/download-artifact@v4
         with:
           name: wheels-linux-x86_64
-      - name: Install dependencies
-        run: uv sync --extra benchmark --find-links ./ --reinstall
       - name: Start Uvicorn server
+        env:
+          BENCHMARK_HOST: 0.0.0.0
+          BENCHMARK_PORT: "8000"
         run: |
-          uv run uvicorn benchmark.server:app --host 0.0.0.0 --port 8000 &
+          uv run --script benchmark/server.py &
           sleep 10
       - name: Run benchmark
         run: |
@@ -433,11 +434,16 @@ jobs:
           else
             HTTPR_VERSION="dev"
           fi
-          uv run python benchmark/benchmark.py --httpr-version "$HTTPR_VERSION"
+          # The script declares `httpr` in its PEP 723 deps; --find-links lets uv
+          # pick the freshly-built wheel from the workspace instead of PyPI.
+          uv run \
+            --find-links ./ \
+            --refresh-package httpr \
+            --script benchmark/benchmark.py --httpr-version "$HTTPR_VERSION"
       - name: Generate and deploy benchmark image to gh-pages
         if: startsWith(github.ref, 'refs/tags/')
         run: |
-          uv run python benchmark/generate_image.py
+          uv run --script benchmark/generate_image.py
           git config --global user.name 'github-actions[bot]'
           git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com'
 

.github/workflows/benchmark.yml

@@ -37,14 +37,17 @@ jobs:
             rust-bench-${{ runner.os }}-
 
       - name: Install dependencies
-        run: uv sync --extra dev --extra benchmark
+        run: uv sync --extra dev
 
       - name: Build Rust extension (release mode)
         run: uv run maturin develop --release
 
       - name: Start benchmark server
+        env:
+          BENCHMARK_HOST: 127.0.0.1
+          BENCHMARK_PORT: "8000"
         run: |
-          uv run uvicorn benchmark.server:app --host 127.0.0.1 --port 8000 &
+          uv run --script benchmark/server.py &
           # Wait for server to be ready
           for i in $(seq 1 10); do
             if curl -sf http://127.0.0.1:8000/json/1 > /dev/null 2>&1; then