fix(deps): clear wheel + vcrpy CVEs in the umbrella test-requirements image

[thomasrockhu-codecov]

Summary

Part of the Artifact Registry crit/high CVE remediation campaign for the codecov/umbrella images (codecov/api, codecov/worker, codecov/umbrella-reqs).

After the prior stacked pass (#1522/#1523/#1526/#1527), a fresh AR scan (2026-08-01) shows the production reqs/api/worker images are already down to the irreducible no-upstream-fix residual set (perl, expat, acl, attr). The only remaining fixable crit/high live in the CI-only test-requirements image (the most-recently-uploaded tag on codecov/umbrella-reqs):

• vcrpy GHSA-rpj2-4hq8-938g (HIGH, arbitrary code execution via unsafe YAML cassette load) — fixed in 8.2.1.
• wheel CVE-2026-24049 (HIGH) — the flagged wheel-0.45.1 is the seed wheel embedded inside virtualenv (site-packages/virtualenv/seed/wheels/embed/), pulled in transitively via pre-commit.

Both packages are in the dev group only, so this changes just the test-requirements image; the production reqs/api/worker images are untouched.

Changes

• vcrpy ==8.1.1 → >=8.2.1. The old hard pin was there because vcrpy 8.2.0 changed httpx interception to the transport level and now captures a bare-host request path (https://host with no path) as "" instead of "/" (upstream issue #1013, COV-45) — this regression is still present in 8.3.0, so the pin could not simply be lifted. The only affected cassette is the pipedream webhook interaction in test_simple_call_status_and_notifiers.yaml (the webhook notifier posts via httpx.Client). Per the upstream maintainer's recommended workaround, the trailing slash was dropped from that one recorded uri so the path matcher matches the "" that vcrpy 8.2+ now reports. Resolves to vcrpy 8.3.0.
• virtualenv >=20.31.0 floor added (dev group). From 20.31.0 virtualenv no longer bundles the wheel seed wheel on Python ≥3.9, so the embedded wheel-0.45.1 disappears entirely. Resolves to virtualenv 21.7.1.
• uv.lock recompiled: only dev-scoped packages move (vcrpy 8.1.1→8.3.0, virtualenv 20.30.0→21.7.1, filelock 3.18.0→3.32.2, +python-discovery 1.5.1). The --no-group dev export is byte-for-byte unchanged, confirming production images are unaffected.

Expected AR result (validated by CI + re-scan, async)

image	before (crit/high)	after
codecov/api	4 / 6 (residual only)	4 / 6 (unchanged, residual only)
codecov/worker	4 / 6 (residual only)	4 / 6 (unchanged, residual only)
codecov/umbrella-reqs (prod reqs- tag)	4 / 6 (residual only)	4 / 6 (unchanged)
codecov/umbrella-reqs (test- tag)	4 / 14 (2 fixable: wheel, vcrpy)	4 / 6 fixable→0, residual only

New content-addressed tags this branch produces:

• REQUIREMENTS_TAG=reqs-336a78eefa7da921d171c27077f1725471cc17bd-613b6fe42352709208ddf2976f0c09143aac63e4-57d98be0648c27f47a15df14b857fcdd62ebe2a7
• TEST_REQS_TAG=test-a61522cb369ad3771a10a8347dbda7aeb46566bc

Test plan

• CI builds + pushes the new reqs / test-reqs images.
• Worker integration suite (esp. TestNotifyTask::test_simple_call_status_and_notifiers) passes with vcrpy 8.3.0 against the edited cassette.
• Re-scan test-a61522cb... in AR and confirm wheel + vcrpy findings are gone (residual perl/expat/acl/attr/libssh2 remain).

Made with Cursor

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.83%. Comparing base (d8942db) to head (f03f72e).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1889   +/-   ##
=======================================
  Coverage   91.83%   91.83%           
=======================================
  Files        1332     1332           
  Lines       51830    51830           
  Branches     1647     1647           
=======================================
  Hits        47598    47598           
  Misses       3911     3911           
  Partials      321      321           

Flag	Coverage Δ
sharedintegration	36.76% <ø> (ø)
sharedunit	84.88% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[codecov-notifications]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[codspeed-hq]

Merging this PR will not alter performance

✅ 9 untouched benchmarks

---

_{Comparing th/reqs-cve-wheel-vcrpy (f03f72e) with main (f9c9cb2)¹}

Footnotes

1. No successful run was found on main (d8942db) during the generation of this report, so f9c9cb2 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩