feat: migrate to Langfuse v4 and refresh vulnerable dependencies

[RasulOs]

Summary

• migrate Mobilerun tracing from Langfuse 3.12.1 to 4.15.1 using the public Langfuse client, OpenTelemetry preprocessing, and native media handling
• make tracing setup idempotent and concurrency-safe while preserving agent, LLM, screenshot, metadata, user/session, endpoint, and flush behavior
• update the dependency graph to satisfy the patched ranges for all 39 high-severity Dependabot alerts open on main
• use Phoenix 14.4.0 because 14.3.0's required prerelease graphql-core fails during import

Dependency refresh

Package	Locked version
aiohttp	3.14.3
Arize Phoenix	14.4.0
Banks	2.5.0
Black	26.5.1
cryptography	50.0.1
Langfuse	4.15.1
Mako	1.4.1
MCP	1.29.1
NLTK	3.10.3
Pillow	12.3.0
pyasn1	0.6.4
PyJWT	2.13.0
python-multipart	0.0.32
Starlette	1.6.0
Strawberry GraphQL	0.314.3
urllib3	2.7.0

The lock remains at 196 packages, adds defusedxml, and removes lia-web. Every patched threshold for the 39 currently open high alerts is satisfied by this branch; the alerts are expected to close after merge. No medium-only or low-only package was intentionally upgraded.

Validation

• complete suite: 646 tests and 3 subtests passed
• Ruff and Black 26.5.1 checks passed
• uv lock --check, package build, and git diff --check passed
• frozen all-extras/all-groups installs and imports passed on Python 3.11 and 3.13
• real MCP 1.29.1 stdio discovery, filtering, invocation, content conversion, and cleanup passed
• Phoenix 14.4.0 started with isolated state; health, OTLP ingestion, and trace retrieval passed
• Android 16 / SDK 36.1 emulator with Portal 0.7.22 completed a bounded Gemini 3.7 Flash agent run in 5 steps
• the local Langfuse-compatible capture received 38 unique spans in one trace: 1 root, 1 agent step, 5 LLM, and 6 screenshot spans; 6 native media uploads completed with no duplicate span IDs, raw screenshot attributes, upload errors, or tracing errors

Fixes #430

Dependency triage: DRO-2795

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T16:45:59.848629Z	065e865	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 065e86533d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve non-media strings that begin with data:

When a JSON-encoded chat or completion contains ordinary user, model, or tool text beginning with data: (for example, a prompt discussing data-URI syntax), this recursive sanitizer treats the string as image media. _prepare_image_for_native_upload rejects non-base64 content, so the value is replaced with an empty string and the exported Langfuse trace loses the original input/output. Restrict sanitization to structurally identified media fields such as image_url.url rather than every nested string.

Useful? React with 👍 / 👎.

[RasulOs]

@codex revew

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.

[mintlify]

Docs PR opened: https://github.com/droidrun/mobilerun-docs/pull/92

Updated Langfuse tracing docs to use LANGFUSE_BASE_URL as the canonical endpoint variable, with LANGFUSE_HOST as legacy fallback.