[peterfoldes]

Clears the 17 open filelock Dependabot alerts (50–66: 1 high, 12 medium, 4 low; all filelock <= 4.2.0 in uv.lock).

Root cause

uv.lock forks on Python version. Under python_full_version < '3.11' it resolved filelock 4.1.0; 3.11+ already had 4.2.4. Every patched filelock release (4.2.1+) requires Python >= 3.11, so the 3.10 fork could never be upgraded. The only path to filelock on 3.10 was dev-only:

dev group -> pre-commit 4.6.2 -> virtualenv 21.15.1 / python-discovery 1.6.7 -> filelock 4.1.0

(This chain appeared with the virtualenv 20 -> 21 bump in #88.)

Fix

Gate the dev dependency to pre-commit; python_version >= '3.11' and relock. No runtime dependency changes. CI is unaffected: the test workflow installs via pip install ".[test]", and the pre-commit workflow does its own pip install pre-commit on Python 3.x.

Side effect: developers on Python 3.10 no longer get pre-commit from uv sync; use 3.11+ (or install it separately) to run the hooks.

Verification

Every [[package]] entry for the alerted package, all resolution forks:

Alert(s)	Range	Before	After
50–66 (filelock)	<= 4.2.0 (narrowest lower bound varies)	4.1.0 [py<3.11] vulnerable; 4.2.4 [py>=3.11] ok	4.2.4 only (reachable on py>=3.11 via pre-commit) ok

Also dropped from the 3.10 fork: pre-commit 4.6.2, platformdirs 4.12.4.

• pip-audit (PyPI source) on the exported lock, evaluated per Python 3.10 / 3.11 / 3.12 / 3.13 / 3.14 x linux / darwin / win32: before = 17 filelock vulns on 3.10 only; after = no known vulnerabilities in any combination.
• All 53 locked registry packages checked against the GitHub Advisory Database (/advisories?ecosystem=pip&affects=<pkg>@<ver>): 0 hits.
• pytest tests/: 315 passed on 3.10, 3.11 and 3.14. On 3.10 neither filelock nor pre_commit is installed.
• pre-commit run --all-files passes on 3.11.

🤖 Generated with Claude Code

[salty-hambot]

Reviewed by Salty Hambot 🤖🧂 at 8c1b82e

No issues found.
_{💰 $0.0701 · 36.9k in / 1.1k out tokens · ⏱️ 10.3s · us.openai.gpt-6-sol high, prompt coverage-v1
💬 To request a re-review, comment @salty-hambot review}