[lhoupert]

Bumps three packages in uv.lock to clear Dependabot alerts #88–#92: certifi 2026.7.22 → 2026.10.23 (GHSA-6q48-6c7w-9gw2: the new release no longer trusts the eMudhra/emSign root and intermediates compromised on 20 Oct), filelock 4.0.7 → 4.2.4 (GHSA-v4x8-3wr5-3wq8, GHSA-567q-5qvw-pf92, GHSA-9vhv-jxww-xfm5) and setuptools 84.0.0 → 84.2.1 (GHSA-xmj3-9gf7-h52w). The diff also updates the project's own version line (1.0.0 → 1.0.2), which the lock hadn't caught up with; no other package moves. Dependabot's own security update for these alerts fails (it runs as pip for /), which is reported to GitHub separately.

How this was made

Claude Code re-locked the three packages (uv lock --upgrade-package certifi --upgrade-package filelock --upgrade-package setuptools) with uv 0.9.30 on a branch from main, which keeps the lock's current format, after @lhoupert asked for the bump. It checked that only those lines changed, that uv lock --check passes, that pip-audit finds no known vulnerabilities in the exported lock, and that the test suite passes (186 tests) against it.

— Claude Code, on behalf of @lhoupert

[github-actions]

✅ All test workflows behaved as expected

13 passed, 0 failed

Test	Name	Expected	Actual	Bandit	pip-audit	Result
01	requirements · flat · clean	success	success	—	—	✅
02	requirements · src/ · bandit HIGH	failure	failure	B105, B404, B602	—	✅
03	requirements · src/+scripts/ · bandit HIGH + pip-audit	failure	failure	B105, B404, B602	cryptography, idna, requests, urllib3	✅
04	uv · flat · clean	success	success	—	—	✅
05	uv · src/ · pip-audit vuln	failure	failure	—	certifi, idna, requests, urllib3	✅
06	uv · src/+scripts/ · bandit MEDIUM	failure	failure	B324, B506	—	✅
07	poetry · flat · clean	success	success	—	—	✅
08	poetry · src/ · bandit MEDIUM + pip-audit	failure	failure	B105, B324	certifi, cryptography, idna, requests, urllib3	✅
09	pipenv · flat · clean	success	success	—	—	✅
10	pipenv · src/+scripts/ · bandit HIGH	failure	failure	B404, B602	—	✅
11	requirements · flat · clean (root working dir)	success	success	—	—	✅
12	uv · flat · bandit-only (no pip-audit)	failure	failure	B404, B602	disabled	✅
14	uv · flat · low threshold (B101 assert)	failure	failure	B101	disabled	✅