[rajnisht7]

What

Bumped filelock, msgpack, and setuptools in requirements/dev.in / requirements/dev.txt to versions that fix 3 CVEs flagged by pip-audit in CI.

Why

CI security scan failing on main, pip-audit found 5 known vulnerabilities across these 3 packages (filelock 3.32.5, msgpack 1.2.2, setuptools 84.0.0).

Security impact

None

Test plan

• pytest passes
• ruff check passes
• mypy passes
• Manual test performed (describe steps below if applicable)

executed the full CI security-scan step locally in a fresh env after installing the patched dev.txt with --require-hashes: bandit -r src/ -c pyproject.toml && pip-audit --skip-editable now exits clean with “No known vulnerabilities found”. Also recompiled runtime.txt against the updated constraints (no changes needed there, since those packages aren’t in its tree).

DCO sign-off

• I certify that I wrote or have the right to submit this contribution, and I agree to the
  Developer Certificate of Origin (https://developercertificate.org).

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dinakarjs]

Source/CI review at 5f25e11: the diff changes the development input constraints and generated lock for filelock, msgpack and setuptools; all 15 returned hosted checks are successful.

This overlaps my open #822, which covers filelock/setuptools. Please select one integration route rather than landing both independently: if #832 is accepted, #822 can be marked superseded after confirming its intended dependency repairs are included. #832 also covers msgpack and adds explicit input floors, so the two PRs are not identical.

I inspected the diff and hosted results; I did not independently reinstall this lock, verify artifact hashes or rerun the suite in this pass. This is a COMMENT, not independent approval of the overlapping work. Reviewed with OpenAI Codex.