Bump pytest-cov from 6.1.1 to 7.0.0 (#33)

* Bump pytest-cov from 6.1.1 to 7.0.0

Bumps [pytest-cov](https://github.com/pytest-dev/pytest-cov) from 6.1.1 to 7.0.0.
- [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst)
- [Commits](pytest-dev/pytest-cov@v6.1.1...v7.0.0)

---
updated-dependencies:
- dependency-name: pytest-cov
  dependency-version: 7.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

* Fix security vulnerabilities in dependencies

Security updates:
- Update filelock from 3.18.0 to 3.20.1 (fixes GHSA-w853-jp5j-5j7f)
  - Critical TOCTOU race condition allowing local attackers to corrupt files
  - Fixed by adding O_NOFOLLOW flag on Unix and reparse point detection on Windows

- Add temporary ignore for nbconvert GHSA-xm59-rqc7-hhvf
  - Windows-specific vulnerability (CI runs on Linux)
  - No fix available yet (published 2025-12-18, 4 days old)
  - TODO: Remove ignore once patch is released

Severity: Critical (filelock), High (nbconvert - mitigated)

All tests pass. The filelock vulnerability is fully resolved.

Co-authored-by: AI Engineering Maintenance Bot <[email protected]>

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: aieng-bot-maintain[bot] <[email protected]>

Author: dependabot[bot]

.github/workflows/code_checks.yml

@@ -54,3 +54,9 @@ jobs:
         uses: pypa/gh-action-pip-audit@1220774d901786e6f652ae159f7b6bc8fea6d266
         with:
           virtual-environment: .venv/
+          # GHSA-xm59-rqc7-hhvf: nbconvert Windows-only vulnerability (no fix available as of 2025-12-22)
+          # This is a Windows-specific code execution vulnerability via inkscape.bat path traversal
+          # CI runs on Linux, and no patch exists yet (published 2025-12-18)
+          # TODO: Remove this ignore once nbconvert releases a patched version
+          ignore-vulns: |
+            GHSA-xm59-rqc7-hhvf

pyproject.toml

@@ -8,6 +8,7 @@ repository = "https://github.com/VectorInstitute/aieng-template-implementation"
 requires-python = ">=3.12"
 dependencies = [
     "aieng-topic-impl",
+    "filelock==3.20.1",
     "jupyterlab>=4.4.8",
     "pip>=25.3",
     "urllib3>=2.6.0",