fix: update vulnerable dependencies to resolve security advisories

[marcusburghardt]

Summary

Updates 8 vulnerable dependencies to resolve 14 open Dependabot security advisories across critical, high, medium, and low severity levels.

Each dependency is updated in a separate commit for traceability. The black major version bump (25 → 26) required reformatting the codebase and adjusting the Makefile lint/format targets to resolve a conflict between black 26 and the previous isort --lines-after-imports=2 setting.

Several updated packages now require Python >= 3.10. Poetry resolves this by maintaining dual entries in the lock file: Python >= 3.10 gets the patched versions, while Python < 3.10 retains the previous versions due to upstream constraints.

Dependency Updates

Package	From	To	Severity	Alerts
nltk	3.9.2	3.9.4	critical/high/medium	#52, #71, #63, #62, #61, #60
orjson	3.11.5	3.11.8	high	#55
PyJWT	2.10.1	2.12.1	high	#56
black	25.11.0	26.3.1	high	#54
filelock	3.19.1	3.29.0	medium	#43, #49
PyNaCl	1.5.0	1.6.2	medium	#45
pytest	8.4.2	9.0.3	medium	#69
Pygments	2.19.2	2.20.0	low	#67

Remaining Unresolved

Package	Alerts	Reason
cryptography (46.0.3)	#51, #66, #68	Pinned by compliance-trestle 3.11.0 to exact version 46.0.3. Requires upstream release.
marshmallow (4.0.0)	#44	Latest Python 3.9-compatible version (4.0.1) remains in the vulnerable range. Deferred to avoid triggering the OSV-Scanner PR diff check with a still-vulnerable intermediate version.
requests (2.32.4)	#65	Latest Python 3.9-compatible version (2.32.5) remains in the vulnerable range. Deferred for the same reason.

Related Issues

• Resolves Dependabot alerts: refactor: update to repository api from trestle #43, PSCE-222 - feat: updates skip_items to accept glob patterns #45, PSCE-226 - build(deps): bump compliance-trestle to latest commit for leveraged auth #49, PSCE-239: feat: adds validation for YAML trestle rules #52, PSCE-251: refactor(cli): removes reusable CLI code to cli_base to enable multip… #54, PSCE-249 - Add entrypoint for trestle YAML rule transformation #55, test: adds tests for failed tasks to test_bot.py and normalizes test … #56, docs: adds grammar fixes and clarity to README.md files and contribut… #60, test: adds integration test bewtween rules transform, assemble, and r… #61, PSCE-258 - feat: adds filtering by profile to AuthoredComponentDefinition create… #62, feat: configure logger for module and control from actions files #63, PSCE-256: Add create-cd entrypoint for component definition bootstrapping #67, test: add e2e scenarios for create-cd #69, fix(entrypoint): fixes top level ModelFilter logic #71

Review Hints

• Each dependency update is in its own commit. Reviewing commit-by-commit is recommended, especially for the black upgrade and its formatting commit.

• The black 26 upgrade (commit fix: update black to 26.3.1) changes pyproject.toml and poetry.lock. The follow-up style: reformat codebase with black 26.3.1 commit applies the new formatting rules and updates the Makefile to run black before isort (removing the --lines-after-imports=2 flag that conflicts with black 26).

• make lint passes cleanly. All 168 tests pass. There is 1 pre-existing test failure in test_config_write_to_file (a skip_validation type mismatch: 'false' vs False) that is also present on main and is unrelated to this PR.

• The Trivy Source Scan failure is pre-existing on main (Dockerfile/workflow misconfigurations) and is not introduced by this PR.

• Advisories resolved: GHSA-7p94-766c-hgjp, GHSA-h8wq-7xc4-p3qx, GHSA-469j-vmhf-r6v7, GHSA-jm6w-m3j8-898g, GHSA-gfwx-w7gr-fvh7, GHSA-rf74-v2fm-23pw, GHSA-hx9q-6w63-j58v, GHSA-752w-5fwx-jx9f, GHSA-3936-cmfr-pm3m, GHSA-w853-jp5j-5j7f, GHSA-qmgc-5h2g-mvrw, GHSA-mrfv-m5wm-5w6w, GHSA-6w46-j5rx-g56g, GHSA-5239-wwwm-4pmq

[marcusburghardt]

e2e failure should be fixed by #822

[sonupreetam]

@marcusburghardt This has some merge conflicts, I can review it after its fixed :).

[marcusburghardt]

@marcusburghardt This has some merge conflicts, I can review it after its fixed :).

Working on it. : )

[marcusburghardt]

@marcusburghardt This has some merge conflicts, I can review it after its fixed :).

Working on it. : )

Done @sonupreetam . Thanks for reviewing.

[sonupreetam]

LGTM