Fix vulnerable pip dev dependency

[Copilot]

Addresses code scanning alert #35 for PYSEC-2026-3721 / CVE-2026-13346, which affects vulnerable pip versions below 26.2.

• Dependency constraint

  • Added an explicit dev dependency floor for pip:

    "pip>=26.2"

• Lockfile

  • Refreshed uv.lock to resolve pip from 26.1.2 to 26.2.1.

[github-actions]

🐍 Python 3.14 Results

Metric	Status	Value
Ruff	✅	0 issue(s)
Unit Tests	✅	success
Code Coverage	📊	100%

Full Workflow Logs

[github-actions]

🐍 Python 3.12 Results

Metric	Status	Value
Ruff	✅	0 issue(s)
Unit Tests	✅	success
Code Coverage	📊	100%

Full Workflow Logs

[github-actions]

Python 3.14 Detailed Test Results

2 083 tests  ±0   2 083 ✅ ±0   18s ⏱️ ±0s
    1 suites ±0       0 💤 ±0 
    1 files   ±0       0 ❌ ±0 

Results for commit c694c50. ± Comparison against base commit b306074.

[github-actions]

🐍 Python 3.13 Results

Metric	Status	Value
Ruff	✅	0 issue(s)
Unit Tests	✅	success
Code Coverage	📊	100%

Full Workflow Logs

[github-actions]

Python 3.12 Detailed Test Results

2 083 tests  ±0   2 083 ✅ ±0   25s ⏱️ +7s
    1 suites ±0       0 💤 ±0 
    1 files   ±0       0 ❌ ±0 

Results for commit c694c50. ± Comparison against base commit b306074.

[github-actions]

Python 3.13 Detailed Test Results

2 083 tests  ±0   2 083 ✅ ±0   15s ⏱️ -3s
    1 suites ±0       0 💤 ±0 
    1 files   ±0       0 ❌ ±0 

Results for commit c694c50. ± Comparison against base commit b306074.

[Copilot]

Pull request overview

Updates the development environment to use a patched pip release.

Changes:

• Adds pip>=26.2 to development dependencies.
• Locks pip to version 26.2.1.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
pyproject.toml	Adds the secure pip version constraint.
uv.lock	Records pip 26.2.1 and its artifacts.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.