security: refresh vulnerable release build dependencies before 0.5.0 #447

Summary

Refresh the hashed release-build dependency set before publishing base-cli 0.5.0.

Evidence

GitHub Dependabot currently reports six open vulnerabilities in requirements/release.txt:

• high: setuptools path traversal
• high: wheel path traversal/file-permission issue
• high: urllib3 proxy TLS handling
• high: urllib3 chunk-size buffering
• medium: setuptools macOS normalization collision
• medium: urllib3 chunked-deflate loop

The release workflow installs this file with pip install --require-hashes --no-deps, so these are in the release-build toolchain and cannot be ignored for the 0.5.0 publication.

Acceptance criteria

• Update requirements/release.in to patched build and publication tooling.
• Regenerate requirements/release.txt with hashes.
• Run release package and security validation.
• Confirm the Dependabot alerts are resolved or have an explicitly documented, reviewed exception.

Release impact

Blocks base-cli 0.5.0 publication.