fix: address security vulnerabilities while maintaining Python 3.9 support

[KRRT7]

Summary

Resolves 12 Dependabot security alerts by constraining vulnerable packages to Python 3.10+ where patches are available.

Changes

Python Dependencies

• filelock: Pin <3.20.3 for Python 3.9, >=3.20.3 for Python 3.10+
  • Fixes 2 medium-severity TOCTOU symlink vulnerabilities
• tensorflow: Only install on Python 3.10+ (brings keras >=3.12.1, pillow >=12.1.1)
  • Fixes 8 high-severity keras vulnerabilities including:
    • Arbitrary code execution (CVE-2025-1550, CVE-2025-26257)
    • Directory traversal (CVE-2025-1549)
    • Local file disclosure (CVE-2024-12687)
    • SSRF vulnerabilities
  • Fixes 1 high-severity pillow out-of-bounds write (CVE-2025-26082)

JavaScript Dependencies

• vitest: Update to 4.0.18 in test fixture directory
  • Fixes moderate-severity esbuild SSRF vulnerability (GHSA-67mh-4wv8-2f99)

Python 3.9 Impact

• Python 3.9 reached EOL in October 2025
• filelock 3.19.1 remains for Python 3.9 (has known medium-severity TOCTOU vulnerabilities)
• tensorflow/keras/pillow excluded from Python 3.9 test dependencies
• All high-severity vulnerabilities are resolved for Python 3.10+

Test Plan

• CI will verify compatibility across Python 3.9-3.14
• Python 3.9: Uses filelock 3.19.1, no tensorflow
• Python 3.10+: Uses filelock 3.24.3, tensorflow 2.20.0 with patched keras/pillow

[claude]

PR Review Summary

Prek Checks

✅ Passed — no Python files changed in this PR, so no linting/formatting issues to check.

Mypy

✅ N/A — no Python source files changed.

Code Review

✅ No critical issues found. Changes are well-structured:

• CI consolidation: Windows tests correctly merged into main unit-tests.yaml workflow using matrix include entries. The PYTHONIOENCODING: utf-8 env var and runs-on: ${{ matrix.os }} are properly set.
• filelock dependency: Correctly split with Python version markers (>=3.20.3 for 3.10+, <3.20.3 for 3.9) to address TOCTOU symlink vulnerabilities.
• tensorflow restriction: Properly constrained to python_version >= '3.10' in both main dependencies and test group, resolving 8 high-severity keras CVEs + 1 pillow CVE.
• vitest update: Bumped from ^2.0.0 to ^4.0.18 in test fixture directory, fixing the esbuild SSRF vulnerability (GHSA-67mh-4wv8-2f99).
• uv.lock: Correctly updated to reflect all dependency constraint changes.

Test Coverage

N/A — no Python source files were changed in this PR. Changes are limited to:

• CI workflow files (.github/workflows/)
• pyproject.toml (dependency constraints only)
• uv.lock
• JS test fixture packages (code_to_optimize/js/)

No coverage regression possible from these changes.

---

Last updated: 2026-02-19