[dinakarjs]

What

Refresh only filelock 3.32.5 → 4.2.4 and setuptools 84.0.0 → 84.2.1 with their hashes in requirements/dev.txt. Universal regeneration preserves every other byte of the lock.

Why

Current #809 CI reports three filelock advisories and GHSA-xmj3-9gf7-h52w for setuptools, in addition to the separate certifi finding already addressed by #795. The older grouped #783 is broader and its description reports an empty setuptools target; this focused patch explicitly retains a fixed, hashed setuptools pin. It does not duplicate #795's certifi change.

Security impact

Updates development/audit tooling dependencies for published advisories. No runtime source, trust policy, workflow permissions or audit exclusions change. This PR alone is not a clean-audit claim: certifi remains vulnerable until #795 is integrated.

Test plan

Published source tree ded0310eb57044a9bd9dbcdd310128cc23bb6113, base 053b5e6. Linux/Python 3.11.17.

• Fresh hash-required dev install, no-deps editable checkout and pip check pass.
• Full unit selection: 2,539 passed, 6 skipped. The initial run had nine environment SOCKS-proxy import failures; clearing uppercase and lowercase proxy variables for local test traffic resolves them without source/dependency changes.
• Ruff src/tests, mypy runtime/verify (76 files), configured Bandit and whitespace checks pass.
• Hash-required Windows/Python 3.11 dependency resolution dry-run succeeds; this is not Windows execution.
• pip-audit of the changed lock now reports only the unchanged certifi PYSEC-2026-4320 finding. The failing-before hosted scan is docs: register MEASUREMENT_UNAVAILABLE and its recovery boundary #809 run 40138358542, job 121004615741. No audit bypass used.
• Mechanical block comparison proves only the two named version/hash entries change; the published tree equals the tested local tree.

Hosted supported-platform checks and independent maintainer review remain required. No hardware, release or deployment performed.

DCO sign-off

The contribution carries Signed-off-by: Srinivasa Dinakar Jainti dinakarjs@gmail.com. Prepared with OpenAI Codex; self-review is not independent approval.

Disposition

Closed as superseded by merged #832. Current main c51fba5 already contains filelock 4.2.4 and setuptools 84.2.1 with the same release hashes, together with the broader dependency-audit repair. The older certifi version on this unmerged branch should not be carried forward. This PR was not merged; its earlier local and review evidence remains historical.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[dinakarjs]

Current-head hosted follow-up: CI run 40200036057 reaches the security scan and reports only the unchanged certifi PYSEC-2026-4320 finding; the targeted filelock/setuptools findings are absent. #795 supplies certifi. CodeQL and Confinement reference pass. Matrix tests are skipped/cancelled after the audit failure, so the local suite is not being represented as successful hosted execution. @carloshvp independent review requested; the dependency and approval gates remain intact.

[carloshvp]

Reviewed exact head 133afd8eeaa525e638f84c8b695b094c3c9ebf4a in an isolated checkout.

Only the filelock and setuptools version/hash blocks change; the rest of the lock is preserved. I checked both distributions' hashes against official PyPI metadata and installed the locked environment. My fresh dependency audit now reports only the unchanged certifi finding: the targeted filelock/setuptools findings are absent. The remaining certifi repair is tracked in #795, so this is a bounded approval of these two dependency updates.

Independent validation in a fresh repository-hash-locked Python 3.12.10 environment: 2,525 tests passed, 20 skipped; pip check, configured Ruff, mypy, Bandit and diff whitespace checks passed. Commit sign-offs are present. Hosted CI and applicable independent maintainer/security gates remain separate prerequisites to merge.

Reviewed with OpenAI Codex.