[stefan-jansen]

Closes #38.

The complete locked development audit fails on certifi 2026.7.22 (PYSEC-2026-4320) and filelock 3.32.2 (CVE-2026-112940, CVE-2026-112913, CVE-2026-112907). Regenerate only those lock entries with uv, selecting certifi 2026.10.19 and filelock 4.2.1, the fixed versions identified by the actual audit and upstream advisories.

No public compatibility impact. Runtime dependencies, calendar contracts, source, version and documentation are unchanged. No package release is warranted.

Verification on base e14315d and fix 693d5a5:

• Export with uv export --locked --all-groups --no-emit-project --no-hashes, then uv run --locked pip-audit --requirement <export>: base exits 1 with four vulnerabilities in two packages; fixed exits 0 with no known vulnerabilities. The separate core runtime audit also passes.
• uv lock --check and uv sync --locked --dev: pass. Only the two package records change, with generated artifact URLs/hashes.
• Full pytest suite: 424 passed, 100% statement and branch coverage.
• Ruff check/format and ty: pass. Strict MkDocs build: pass.
• Package build and twine checks: pass. Python 3.15 isolated built-wheel import resolves from site-packages; package metadata retains PyYAML as its only core requirement.
• Isolated installed-wheel runtime suite: 410 passed, 100% branch coverage. The initial full wheel collection correctly exposed that repository release-pipeline tests require the uninstalled scripts module; those tests are covered by the full source suite, and the isolated run explicitly excludes only that repository-tooling file.
• Normal commit hooks pass. Required hosted CI and ecosystem matrices must pass on this exact head before merge.

AI assistance: Codex reviewed upstream advisories and dependency paths, regenerated and reviewed the lock diff, ran the checks, and drafted this submission. Independent human review is not claimed.

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[stefan-jansen]

Substantive maintainer review: the complete generated diff changes only certifi and filelock version/artifact records. Upstream advisories match the actual failing audit and patched versions. Requests brings certifi into development tooling; cachecontrol brings filelock through pip-audit. Core runtime requirements and all calendar contracts are unchanged. Base audit failed on all four reported advisories; corrected core and complete audits pass. Source contracts pass 424 tests and isolated installed-wheel contracts pass 410 tests, both at 100% branch coverage. No source regression test is appropriate for a lock-only advisory repair. Ordinary merge remains contingent on every applicable exact-head hosted check passing. Review performed with Codex assistance; no independent human approval claimed.