From de438e695c3752c5f69e84f297abaf6569c38f99 Mon Sep 17 00:00:00 2001
From: Arun Sharma <arun@sharma-home.net>
Date: Fri, 9 Oct 2026 09:18:24 -0700
Subject: [PATCH] chore(deps): fix uv audit vulnerabilities

uv audit reported 56 known vulnerabilities across 9 packages.
Relax over-constrained pins so the resolver can pick fixed versions:

- black ==26.3.0 -> >=26.3.1 (GHSA-3936-cmfr-pm3m, fixed in 26.3.1;
  resolves to 26.10.0)
- setuptools ~=80.9 -> >=80.9 (GHSA-h35f-9h28-mq5c, fixed in 83.0.0;
  resolves to 84.0.0)

Transitive deps pick up fixes on re-resolve with no constraint
changes needed:
- aiohttp 3.13.5 -> 3.14.4, fsspec 2026.3.0 -> 2026.9.0,
  idna 3.11 -> 3.20, multidict 6.7.1 -> 6.9.1, torch 2.11.0 -> 2.14.1,
  urllib3 2.6.3 -> 2.8.0, virtualenv 21.6.0 -> 21.14.5

Also bump the explicit black==26.3.0 pins in .github/workflows/ci.yml
to black==26.10.0 to match the audited version.

Verified: uv audit reports no known vulnerabilities; black --check
passes on src_py and test. Full test suite left to CI.
---
 .github/workflows/ci.yml | 4 ++--
 pyproject.toml           | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5eb9c4a..d70b6b8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -113,7 +113,7 @@ jobs:
       - name: Check formatting (black)
         working-directory: ladybug/tools/python_api
         run: |
-          uv pip install black==26.3.0
+          uv pip install black==26.10.0
           .venv/bin/black --check src_py test
 
       - name: Run ruff check
@@ -184,7 +184,7 @@ jobs:
       - name: Check formatting (black)
         working-directory: ladybug/tools/python_api
         run: |
-          uv pip install black==26.3.0
+          uv pip install black==26.10.0
           .venv/bin/black --check src_py test
 
       - name: Run ruff check
diff --git a/pyproject.toml b/pyproject.toml
index 7450fe7..a2d21a0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -24,8 +24,8 @@ dev = [
     "pytest",
     "pytest-asyncio~=1.0",
     "pytest-xdist~=3.0",
-    "setuptools~=80.9",
-    "black==26.3.0",
+    "setuptools>=80.9",
+    "black>=26.3.1",
     "ruff==0.15.19",
     "mypy==1.16.0",
     "torch>=2.5.0",