[arekay-nv]

What does this PR do?

Fixes the audit job failure seen on #491. pip-audit now reports five
advisories against packages that main already locks, so every PR's audit
job fails until they are fixed. main's last audit run (2026-10-22) passed
with the same lock; the advisories were published afterwards.

Package	Previous	Updated	How it's pulled in	Advisories
filelock	3.25.2	4.2.4	Direct dev floor, plus torch, huggingface-hub, datasets, virtualenv	CVE-2026-112907, CVE-2026-112913, CVE-2026-112940 (fixed in 4.2.1)
setuptools	83.0.0	84.2.1	Transitive (pbr, torch)	GHSA-xmj3-9gf7-h52w (fixed in 84.1.0)
virtualenv	21.14.9	21.14.10	Direct dev pin, plus pre-commit	CVE-2026-113713

Original failure: https://github.com/mlcommons/endpoints/actions/runs/40120902824/job/120952010489

Changes

• pyproject.toml: raises the dev floor filelock>=4.2.1, the dev pin
  virtualenv==21.14.10, and the [tool.uv] constraint-dependencies floor
  setuptools>=84.1.0. The CVE comments list the new advisories.
• uv.lock: relocked with --upgrade-package for the three packages. Their
  versions are the only changes. Five other records change only to reference
  the new filelock version. No packages are added or removed. The bfcl fork
  keeps its own filelock==3.20.0, as before.

filelock 4 (major version)

This repo doesn't import filelock. Its dependents import FileLock,
SoftFileLock, BaseFileLock, UnixFileLock and Timeout; all are
unchanged in 4.x. The 4.0 breaking change is the on-disk protocol of
SoftReadWriteLock, which none of them use. virtualenv 21.14.10 accepts
filelock<5.

Type of change

• Bug fix

Testing

• Synced the same extras as the CI audit job, then ran
  uv run pip-audit --ignore-vuln PYSEC-2026-3740: no known
  vulnerabilities, one existing ignore (Remove pip-audit ignore for nltk PYSEC-2026-3740 once a fixed release ships #520).
• uv pip check: all 143 installed packages compatible.
• uv lock --check with local uv 0.12.10, CI-era uv 0.12.23 and the latest
  uv, 0.13.5.
• Ran CI's test selection (-m "not slow and not performance") on macOS:
  2599 passed, 55 failed. All 55 are macOS-only: CPU affinity requires
  Linux (pin_loadgen() requires Linux, no os.sched_getaffinity). The
  same 55 tests fail with main's filelock/setuptools/virtualenv
  installed, so the bump changes no results.
• uv run pre-commit run --all-files: all hooks pass except the three
  known macOS-only mypy errors for sched_setaffinity /
  sched_getaffinity in unchanged source.
• git diff --check.

Checklist

• Code follows project style
• Pre-commit hooks pass (macOS caveat above)

🤖 Generated with Claude Code

[github-actions]

MLCommons CLA bot All contributors have signed the MLCommons CLA ✍️ ✅

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@93ec321). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #546   +/-   ##
=======================================
  Coverage        ?   81.37%           
=======================================
  Files           ?      157           
  Lines           ?    22472           
  Branches        ?        0           
=======================================
  Hits            ?    18286           
  Misses          ?     4186           
  Partials        ?        0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.