fix: address all 10 Dependabot security vulnerabilities

[CurroRodriguez]

Summary

Resolves all 10 Dependabot security alerts on the master branch.

The root cause was requires-python = ">=3.8" in pyproject.toml, which forced uv to resolve a Python 3.8 dependency branch where all patched versions of the affected packages were unavailable — they had each dropped Python 3.8 support before issuing their security fixes. Dropping Python 3.8 support eliminates that branch entirely and unblocks the upgrades.

Changes:

• pyproject.toml — raised requires-python from >=3.8 to >=3.9 and removed the Python 3.8 classifier.
• uv.lock — upgraded all affected packages to their patched versions:
  • markdown 3.7 → 3.9 / 3.10.2 (Uncaught Exception)
  • pymdown-extensions 10.15 → 10.21 (ReDOS in Figure Capture extension)
  • requests 2.32.3 → 2.32.5 (.netrc credentials leak via malicious URLs)
  • setuptools 75.3.x → 82.0.1 (path traversal / arbitrary file write)
  • urllib3 2.2.3 / 2.3.0 → 2.6.3 (decompression bomb, unbounded redirect chain, redirect control — alerts Default task is executed if no specific task is specified #3 Completed Main Workflow of Bolt Application #4 Task to delete files from tree #5 Specific task to delete .pyc files #6 Task to copy files from one directory to another #8)
  • wheel 0.45.1 → removed (path traversal; was a transitive dep of astunparse which is only required for Python <3.9)

All 160 unit tests pass.

References

• Dependabot alerts
• Alert Main bolt execution script #1 — setuptools path traversal (CVE)
• Alert Implemented bolt main script #2 — requests .netrc credentials leak
• Alert Default task is executed if no specific task is specified #3 Completed Main Workflow of Bolt Application #4 — urllib3 redirect issues
• Alert Task to delete files from tree #5 Specific task to delete .pyc files #6 Task to copy files from one directory to another #8 — urllib3 decompression vulnerabilities
• Alert Tutorial explaining the use of the bolt file. #7 — pymdown-extensions ReDOS
• Alert Task to execute all unit tests #9 — wheel path traversal
• Alert Implement task to monitor file system and execute other tasks #10 — Markdown Uncaught Exception

[Copilot]

Pull request overview

Updates the project’s minimum supported Python version to unblock Dependabot security upgrades that are unavailable on the Python 3.8 dependency branch, and refreshes the uv lockfile to pull in patched dependency versions.

Changes:

• Raise minimum supported Python from >=3.8 to >=3.9 and remove the Python 3.8 classifier.
• Regenerate uv.lock to upgrade vulnerable dependencies to patched versions (e.g., requests, setuptools, urllib3, markdown, pymdown-extensions) and drop wheel/Python<3.9-only transitive deps.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
pyproject.toml	Drops Python 3.8 support via requires-python and classifiers to enable security upgrades.
uv.lock	Re-locks dependencies under Python >=3.9, upgrading vulnerable packages to patched versions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Package	Line Rate	Health
src.bolt	89%	✔
src.bolt.tasks	86%	✔
src.bolt.utils	81%	➖
Summary	87% (647 / 742)	✔

Minimum allowed line rate is 75%

[github-actions]

Package	Line Rate	Health
src.bolt	89%	✔
src.bolt.tasks	86%	✔
src.bolt.utils	81%	➖
Summary	87% (647 / 742)	✔

Minimum allowed line rate is 75%