[napetrov]

Summary

Bumps virtualenv in the hashed tools lock so pip-audit passes again.

 dokimi/requirements-ci.lock.txt
-virtualenv==21.14.7      # CVE-2026-113722, fixed in 21.14.9
+virtualenv==21.14.12
 header: + --exclude-newer-package=virtualenv=false   # same exemption as certifi, uv

Evidence

Before: the locks pip-audit job fails on main's lock (seen on #120): virtualenv 21.14.7 CVE-2026-113722.
After: the lock is regenerated with the command in its header, and only the virtualenv pin and the header line change.

Merge Danger

Door: two-way. This is a one-package bump in a lock used only by CI tools.
Blast Radius: CI only. The exemption skips the 7-day cooldown for virtualenv; drop it once Renovate's next bump is past the window.

🤖 Generated with Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.41%. Comparing base (ac89502) to head (bc23be4).
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #152      +/-   ##
==========================================
+ Coverage   91.40%   91.41%   +0.01%     
==========================================
  Files         216      216              
  Lines       26741    26741              
  Branches     4377     4377              
==========================================
+ Hits        24442    24446       +4     
+ Misses       1635     1632       -3     
+ Partials      664      663       -1     

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[vchamarthi]

@exai-bot /review

[exai-bot]

Note

AI-generated review of bc23be4f275f, requested by @vchamarthi, using the default review skill. It can be wrong: verify a finding before acting on it. React with a thumbs up or down on a finding to tell the bot whether it helped.
Model us.anthropic.claude-sonnet-5-5, effort default, 7 of 93 turns, 0.3 of 48 minutes, 63k in / 2k out tokens.

This bumps virtualenv in the hashed tools lock from 21.14.7 to 21.14.12 to clear the pip-audit finding. It adds --exclude-newer-package=virtualenv=false to the lock's header command and updates the exemption-set test to match. The change is small and consistent: the header, the test and the pin agree, and virtualenv appears in no other lock, so the stacked-lock drift tests are unaffected. All checks passed, including pip-audit (locks). I could not independently verify the new hashes.

1 finding is on the changed lines, as comments below.

[exai-bot]

Minor (plausible, maintainability): virtualenv cooldown exemption is permanent and not tied to a removal condition

• Problem: virtualenv is a transitive dependency (via pre-commit) with no exact pin in requirements-ci.txt. With --exclude-newer-package=virtualenv=false in the header, every later --upgrade refresh can take a virtualenv release younger than 7 days, with no review of that release.
• Why it matters: the PR text says to drop the exemption later, but nothing enforces it. test_tools_lock_exempts_only_pins_younger_than_the_cooldown now asserts the exemption is present, so removing it means editing the test too.
• Evidence: dokimi/tests/test_dependency_locks.py:176-183.

Suggested fix:

Track removal of the exemption in an issue. Alternatively, once the cooldown window has passed for 21.14.12, regenerate the lock without the exemption, since 21.14.12 would then satisfy P7D.

[napetrov]

Agreed, it should not stay. virtualenv 21.14.12 was uploaded 2026-10-21T01:58Z, so it clears P7D on 2026-10-28. After that I will regenerate the lock without --exclude-newer-package=virtualenv=false and drop it from test_tools_lock_exempts_only_pins_younger_than_the_cooldown. That will be a follow-up PR, because without the exemption the lock cannot resolve to a fixed version today.

[xaleryb]

• Ran: the pip-audit locks step from each tree, the lock header command with uv from the tools lock (with and without --upgrade-package=virtualenv), a --require-hashes install plus pip check, the full test suite, and mutations of the new test_dependency_locks.py assertion.
• pip-audit on main fails with virtualenv 21.14.7 CVE-2026-113722 and passes on the head. The header command reproduces the committed lock byte for byte. Each mutation of the virtualenv=false assertion turns the test red.
• No must-fix items remain and no commits will be pushed.
• Left for the author: the open review thread on the permanent cooldown exemption. Removing it now would leave the header command on 21.14.7 until the fixed release is past the 7-day window. A tracked follow-up to drop the exemption and its test assertion after that date would close the thread.

[xaleryb]

Approved at bc23be4. Every earlier point re-run at this head passes, no must-fix or mid item is open, and CI is green.