fix: update vulnerable packages

[cristipufu]

Description

These are only development dependencies, but we still need to pass security scanner checks.

virtualenv

• release 20.36.0 by @​gaborbernat in pypa/virtualenv#3011
• fix: resolve TOCTOU vulnerabilities in app_data and lock directory creation by @​gaborbernat in pypa/virtualenv#3013

filelock

• Fix TOCTOU symlink vulnerability in SoftFileLock by @​gaborbernat in tox-dev/filelock#465

[Copilot]

Pull request overview

This PR updates vulnerable development dependencies to address TOCTOU (Time-of-check to time-of-use) security vulnerabilities in filelock and virtualenv packages.

Changes:

• Updated filelock from 3.18.0 to 3.20.3
• Updated virtualenv from 20.31.2 to 20.36.1
• Updated pre-commit from 4.2.0 to 4.5.1
• Added filelock and virtualenv as explicit dev dependencies to ensure secure versions

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
pyproject.toml	Updated version constraints for pre-commit, and added explicit minimum versions for filelock and virtualenv as dev dependencies
uv.lock	Updated lock file with new package versions, hashes, URLs, and metadata for filelock, virtualenv, and pre-commit

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.