fix(deps): pip-audit fails Quality Gate on certifi PYSEC-2026-4320 and virtualenv CVE-2026-113725/113726 #231

Short version: the required Quality Gate check now fails on every PR at the Security - Dependency vulnerabilities (pip-audit) step. Three advisories were published against two packages pinned in uv.lock. No code change caused it; main was last green on 2026-10-19, before the advisories existed.

What fails

Found 3 known vulnerabilities, ignored 2 in 2 packages
certifi    2026.2.25 PYSEC-2026-4320 2026.10.19
virtualenv 21.14.2   CVE-2026-113726 21.14.4
virtualenv 21.14.2   CVE-2026-113725 21.14.7

• certifi: bundle ships the emSign ECC Root CA - G3 root, which chains to revoked intermediates with compromised keys (TLS interception risk).
• virtualenv: the activate script lets a crafted environment name run shell commands in zsh (PROMPT_SUBST) and bash.

First seen on PR #230, run https://github.com/UiPath/coder_eval/actions/runs/39671772814 (attempt 1 and re-run attempt 4, same result).

Fix

Bump both in uv.lock, for example:

uv lock --upgrade-package certifi --upgrade-package virtualenv

Fix versions on PyPI today: certifi 2026.10.19 (uploaded 2026-10-20 02:24 UTC) and virtualenv 21.14.12 (uploaded 2026-10-21 01:58 UTC). Both are past CI's 12-hour safe-chain minimum package age.

Why make verify did not catch it

make verify has the pip-audit line commented out (Makefile line 74, # uv run pip-audit --desc --skip-editable). So a local make verify passes while CI fails whenever a new advisory lands. Consider re-enabling it, or documenting that pip-audit is CI-only.