[misc] fix: update virtualenv security dependencies

Merged
JO
4d ago
+14-9

What

  • Add virtualenv>=21.14.9 to the development group and update the lockfile from 21.7.13 to 21.14.9.
  • Update its required dependencies: distlib 0.4.0 → 0.4.4 and packaging 25.0 → 26.3. All other dependency versions and published runtime/extra requirements stay unchanged.

Why

Dependabot alerts #145–151 report five high-severity and two moderate-severity vulnerabilities in the virtualenv version pulled in by pre-commit, covering generated-script injection and symlink handling. Version 21.14.9 meets every reported patched-version floor; the explicit development constraint also protects future resolutions. The shared lockfile's packaging upgrade needs CI compatibility coverage.

How to Test

Passed locally:

  • .venv/bin/uv lock --check --offline --no-build --no-python-downloads with a temporary cache: 175 packages resolved.
  • .venv/bin/ruff check --no-cache .
  • .venv/bin/ruff format --check --no-cache .: 395 files already formatted.
  • .venv/bin/ty check --error-on-warning osmosis_ai/
  • git diff --check and the installed pre-commit checks.
  • A metadata check verified that the locked virtualenv version clears all seven alert ranges, the new floor belongs only to the development group, and only virtualenv/distlib/packaging versions changed.

The local environment was not synchronized with the new lockfile. Pytest and isolated installation checks remain for CI. The local Pyright invocation resolved a global SDK installation, so it is not counted as verification of this change. CI should run uv sync --locked --all-extras --group dev, the existing pytest suites, and uv run --no-editable pyright --verifytypes osmosis_ai --ignoreexternal.

Checklist

  • PR title follows [module] type: description format (labels are derived from it automatically — no need to add them by hand)
  • ruff check . and ruff format --check . pass
  • ty check --error-on-warning osmosis_ai/ passes; uv run --no-editable pyright --verifytypes osmosis_ai --ignoreexternal has no unexpected errors (see CONTRIBUTING.md for the Harbor baseline)
  • pytest passes (new tests added if applicable)
  • Public API changes are documented (no public API changes)
  • No secrets or credentials included