Vuln fixes

[deveshgupta30]

Summary

Fixes every known vulnerability in the dependency tree and bumps the release to 1.2.2. The branch raises the floors of the four direct dependencies that had advisories (cryptography, setuptools, poetry, pytest) and fully regenerates poetry.lock so transitive packages (urllib3, dulwich, virtualenv, anyio, and others) also land on patched releases. There are no source changes.

Scanned with Trivy 0.76.0 and Grype against the repo (poetry.lock + pyproject.toml):

Scanner	main	this branch
Trivy	34 (1 critical, 18 high, 12 medium, 3 low)	0
Grype	36 (1 critical, 19 high, 13 medium, 3 low)	0

Changes

pyproject.toml

• version: 1.2.0 -> 1.2.2
• cryptography: >=40.0.4 -> >=50.0.0
• setuptools: >=70.0.0 -> >=83.0.0
• poetry: >=2.0.0 -> >=2.3.4
• pytest (dev): ^8.0.0 -> ^9.0.3

Python support is unchanged (>=3.10, <3.14). Every patched version below still supports 3.10.

poetry.lock regenerated with poetry lock --regenerate. Packages that carried advisories:

Package	main	this branch
anyio	4.9.0	4.15.1
cryptography	45.0.4	50.0.2
dulwich	0.22.8	1.2.17
filelock	3.18.0	4.1.0
idna	3.10	3.20
jaraco-context	6.0.1	6.1.2
msgpack	1.1.1	1.2.3
poetry	2.1.3	2.5.1
pygments	2.19.2	2.21.0
pytest	8.4.1	9.1.1
requests	2.32.4	2.34.2
setuptools	80.9.0	84.0.0
urllib3	2.5.0	2.8.0
virtualenv	20.31.2	21.14.8

Other notable moves from the regeneration: cython 3.1.2 -> 3.3.0, typer 0.16.0 -> 0.27.3, rich 14.0.0 -> 15.0.0, poetry-core 2.1.3 -> 2.5.0, pyinstaller 6.14.2 -> 6.22.3. Typer no longer depends on click, so click, sniffio and zstandard drop out of the lock; annotated-doc, backports-zstd and python-discovery are new transitive entries.

Compatibility notes

• cryptography is only used through AESGCM, whose API is unchanged across 45 -> 50.
• poetry is invoked over subprocess (poetry build, poetry run), not imported, so the major bump has no code impact.
• Tests use plain unittest.TestCase classes, so pytest 9 needs no test changes.
• poetry check passes. It still prints deprecation warnings about the [tool.poetry] metadata table; those predate this branch and are left alone.

Verification

• Trivy and Grype both report 0 findings on the final lock.
• ruff check . passes.
• Full suite run on Linux in a python:3.12 Docker container with the new lock: 3 of 4 tests pass, including test_obfuscate, which exercises the upgraded Cython, setuptools, poetry build, cryptography and typer end to end.
• The remaining test, test_obfuscate_with_expiration, fails identically on main in the same container (3 of 3 attempts on each lock). Its 5 second expiry window elapses during the Cython build, so it is a pre-existing timing issue, not a regression from this branch.
• The e2e tests cannot run on Windows at all because the bundler globs for *.so while MSVC emits .pyd. This is pre-existing and unrelated.

Test plan

• codeenigma obfuscate tests/example_module/example_module -o /tmp/out builds the runtime wheel and the obfuscated module runs

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.