fix(deps): bump requests/filelock/virtualenv to remediate CVEs (#2106)

- requests ^2.32.3 -> ^2.33.0 (CVE-2026-25645)
- pin filelock >=3.20.3 (CVE-2026-22701, transitive via virtualenv)
- pin virtualenv ^20.36.1 (CVE-2026-22702, transitive via pre-commit)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: RoiGlinik

poetry.lock

@@ -69,7 +69,7 @@ pydash = "8.0.0"
 botocore = "^1.42.19"
 boto3 = "^1.42.19"
 prometheus-api-client = "0.5.4"
-requests = "^2.32.3"
+requests = "^2.33.0"
 # Bump to fix certifi CVE flagged by customer scan; date-versioned, so use >= rather than caret
 certifi = ">=2026.4.22"
 regex = "2024.5.15"
@@ -81,6 +81,10 @@ postgrest = "0.16.8"
 h2 = "^4.3.0"
 # Pin to fix CVE-2026-30922 (transitive via google-auth)
 pyasn1 = ">=0.6.3"
+# Pin to fix CVE-2026-22701 (transitive via virtualenv/pre-commit)
+filelock = ">=3.20.3"
+# Pin to fix CVE-2026-22702 (transitive via pre-commit)
+virtualenv = "^20.36.1"
 
 [tool.poetry.dev-dependencies]
 pre-commit = "^2.13.0"