[aikido-autofix]

Upgrade regex and wrapt to fix memory-safety vulnerabilities including heap out-of-bounds access, use-after-free, and double-free issues that can cause DoS or process crashes.

⚠️ Breaking changes analysis not available for: regex

✅ No breaking changes for: wrapt

✅ 2 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-447516	MEDIUM	[regex] A memory-safety vulnerability in the pattern compiler and matching engine allows specially crafted regular expressions to trigger heap out-of-bounds writes and reads through conditional pattern compilation flaws and stale cache reuse. This can lead to remote code execution or denial of service.
AIKIDO-2026-418522	MEDIUM	[wrapt] A race condition in the C extension object proxy allows concurrent mutations on free-threaded Python builds to cause double-release and use-after-free vulnerabilities, leading to memory corruption and process crashes.

🔗 Related Tasks

• https://aikido.atlassian.net/browse/AIK-22191

🤖 Remediation details

Fix security vulnerabilities in regex and wrapt by narrowing requires-python

Short summary

This PR remediates vulnerabilities in two direct dependencies — regex and wrapt — declared in the root pyproject.toml. Both packages had Python-version-conditional specs that kept vulnerable older versions in poetry.lock for Python 3.8 and 3.9. The fix narrows requires-python from >=3.8,<3.16 to >=3.10,<3.16, eliminating the only reason those vulnerable forks existed, and collapses both dependencies to single unconditional patched-floor specs. The lockfile was refreshed via poetry update.

regex

regex was declared as a conditional array with ^2024.5.15 for Python <3.10 and ^2026.8.31 for Python >=3.10. The ^2024.5.15 fork resolved to versions within the vulnerable range (<=2026.7.19). Because the patched release 2026.8.31 itself requires Python >=3.10, the only correct fix was to narrow requires-python to >=3.10, making the vulnerable fork unreachable. The spec was then collapsed to a single flat "^2026.8.31", resolving to 2026.9.29 on Python 3.10 and 2026.11.7 on Python ≥3.11 — both above the patched floor.

wrapt

wrapt was declared as a conditional array with ^1.17.2 for Python <3.9 and ^2.4.0 for Python >=3.9. The ^1.17.2 fork resolved to 1.17.2, which falls within the vulnerable range (>=1.17.0,<=2.3.0). The patched release 2.4.0 requires Python >=3.9, so the Python 3.8 fork had no available fix without dropping Python 3.8 support. Narrowing requires-python to >=3.10 (already required by the regex fix) eliminated the vulnerable fork entirely, and the spec was collapsed to a single flat "^2.4.0", resolving to 2.5.2.

Version changes

Package	From	To	Why updated
regex	^2024.5.15 (py<3.10) / ^2026.8.31 (py≥3.10) — resolved 2024.9.11	^2026.8.31 (unconditional) — resolved 2026.9.29 / 2026.11.7	Direct CVE fix; vulnerable fork removed by narrowing requires-python
wrapt	^1.17.2 (py<3.9) / ^2.4.0 (py≥3.9) — resolved 1.17.2	^2.4.0 (unconditional) — resolved 2.5.2	Direct CVE fix; vulnerable fork removed by narrowing requires-python
asyncpg	^0.30.0 (py<3.9) / ^0.31.0 (py≥3.9)	^0.31.0 (unconditional)	py<3.9 fork became unreachable after requires-python raised to >=3.10; collapsed to avoid resolver error