fix(deps): patch urllib3 security vulnerabilities

[Sam-24-dev]

Summary

• Patch the effective Python 3.11 lockfile from urllib3 2.7.0 to 2.8.0 for PYSEC-2026-4175, PYSEC-2026-4176 and PYSEC-2026-4177.
• Keep urllib3 transitive through requests. Preserve requirements.txt, all 28 other locked versions, and the existing lock-generation convention.
• This is a manual one-line lock amendment; pip-compile was not available and was not run or installed.

Scope and evidence

• Base: 1fd069b.
• Only backend/requirements.lock changes: 1 insertion + 1 deletion.
• CI and all remote ETL Python jobs install this lockfile. requests 2.34.2 accepts urllib3 >=1.26,<3; urllib3 2.8.0 supports Python >=3.10.
• Failed baseline audit: https://github.com/Sam-24-dev/Technology-trend-analysis-platform/actions/runs/37353824363.
• Official advisories:
  • GHSA-8988-9cw3-xx77
  • GHSA-gh4c-6fx4-qh6g
  • GHSA-vxq7-64xx-v4gw

Observed local validation

All runtime checks used the explicitly authorized isolated .venv311 Python 3.11.9, not an unrelated existing project environment.

• Installed only the candidate lock: python.exe -B -m pip install --disable-pip-version-check --no-cache-dir --no-deps --only-binary=:all: -r backend/requirements.lock. All 29 project pins match the environment; no source builds, extra tool installs, or global package changes.
• Verified isolated executable/prefix, disabled user/system site packages, urllib3.version == 2.8.0, and its module path inside .venv311.
• python.exe -B -m pip check: No broken requirements found.
• Existing pip-audit 2.9.0: -r backend/requirements.lock --no-deps --disable-pip --strict --progress-spinner off (external temporary HTTP cache): No known vulnerabilities found, exit 0. No advisory exceptions. CI uses its existing pinned pip-audit 2.10.1.
• Safeguarded pytest.main, with candidate Python and external temporary fixtures:
  • tests/test_github_etl.py tests/test_reddit_etl.py tests/test_stackoverflow_etl.py -q -ra -p no:cacheprovider --tb=short: 42 passed, no skips.
  • tests/ with the same flags: 427 passed, no skips.
  • The harness blocks network and .env access, redirects output paths outside the repository, disables bytecode/plugin autoload/cacheprovider, and copies existing tracked CSV blob bytes only into temporary test fixtures.
  • An initial complete-suite attempt returned 426 passed / 1 failed because the redirected header fixture lacked its input CSV; after supplying the unchanged Git blob fixture bytes, the full 427-test suite passed. No source/test changes were made to resolve this harness issue.
• compileall for backend, scripts and tests: exit 0; pycache prefix outside the worktree.
• Bandit 1.8.6: -r backend scripts -x '/pycache/' -ll: exit 0, no findings.
• detect-secrets baseline hook on the staged lock and git diff --cached --check: exit 0.
• Whole-tree Ruff 0.11.13 diagnostic: exit 1 for two pre-existing F401 findings in backend/base_etl.py:18 and scripts/check_frontend_assets.py:7. Both were independently reproduced against identical base Git blobs. No Python source changed; these unrelated lint findings are not hidden or fixed here.
• Candidate tracked status clean after commit; .venv311 ignored. No data, secrets, AGENTS.md, logs, screenshots, agent/MCP files or temporary artifacts are committed.

Limits and rollback boundary

• Revert only this lockfile pin change if a separate reviewed rollback becomes necessary; do not perform one automatically.
• No live HTTP extraction, runner, Scheduler, ETL, dispatch, recovery or deployment was executed.
• No dirty IDE/active automation checkout or production environment was changed.
• This PR does not activate the patched dependencies in the local automation clone or make the Sunday/Monday routine fully autonomous.
• PRs chore(deps): bump the github-actions group across 1 directory with 3 updates #103 and chore(deps): bump the python-dependencies group across 1 directory with 4 updates #108 remain separate and untouched.
• Separate future work: safe producer preparation -> complete automated package admission -> hard-timeout fallback.

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.