From 82df885e830895624d00c8601523c826313538cd Mon Sep 17 00:00:00 2001
From: acuanico-tr-galt <arnel.cuanico@sembi.com>
Date: Fri, 24 Jul 2026 16:46:26 +0800
Subject: [PATCH] TR-20956: Updated click library constraint and added
 pip-audit security scanning in tox script

---
 setup.py                   |  5 ++++-
 tests/requirements-tox.txt |  2 +-
 tox.ini                    | 20 ++++++++++++++++----
 3 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/setup.py b/setup.py
index 487ce7f8..edb7710b 100644
--- a/setup.py
+++ b/setup.py
@@ -5,6 +5,9 @@
     name="trcli",
     long_description="The TR CLI (trcli) is a command line tool for interacting with TestRail and uploading test automation results.",
     version=__version__,
+    setup_requires=[
+        "setuptools>=83.0.0",  # Updated to address PYSEC-2026-3447 (Unicode normalization bypass on macOS)
+    ],
     packages=[
         "trcli",
         "trcli.commands",
@@ -16,7 +19,7 @@
     ],
     include_package_data=True,
     install_requires=[
-        "click>=8.1.0,<8.2.2",  # Note: click version 8.2.2 is yanked as of Aug 2, 2025!
+        "click>=8.3.3,<9.0.0",
         "pyyaml>=6.0.0,<7.0.0",
         "junitparser>=3.1.0,<4.0.0",
         "pyserde==0.12.*",
diff --git a/tests/requirements-tox.txt b/tests/requirements-tox.txt
index eed4f64d..15032d62 100644
--- a/tests/requirements-tox.txt
+++ b/tests/requirements-tox.txt
@@ -1,4 +1,4 @@
-pytest==8.0.*
+pytest>=9.0.3
 pytest-md-report
 coverage
 allure-pytest
diff --git a/tox.ini b/tox.ini
index 95aac4ad..b5d71010 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,19 +1,31 @@
 [tox]
-env_list = 
-     unit-test, #click-pyyaml{60,latest}-junitparser{31,latest}-pyserde{12,latest}-requests{231,232,latest}-tqdm{465,latest}-humanfriendly{100,latest}-openapi{50,latest}-beartype{17,latest}-prance
+env_list =
+     unit-test, security-audit, #click-pyyaml{60,latest}-junitparser{31,latest}-pyserde{12,latest}-requests{231,232,latest}-tqdm{465,latest}-humanfriendly{100,latest}-openapi{50,latest}-beartype{17,latest}-prance
 
 [testenv:unit-test]
 description = run basic unit test based on latest version of dependencies
-commands = 
+commands =
     pip install -r tests/requirements-tox.txt
     pip install -r tests/requirements-variable-deps.txt
     pip list
     coverage run -m pytest -c tests/pytest.ini -W ignore::pytest.PytestCollectionWarning tests
     coverage report -m
 
-allowlist_externals = 
+allowlist_externals =
     cd
 
+[testenv:security-audit]
+description = run pip-audit to check for known security vulnerabilities in dependencies
+deps =
+    pip>=26.1.2
+    setuptools>=83.0.0
+    pip-audit
+skip_install = false
+commands =
+    pip install --upgrade pip>=26.1.2 setuptools>=83.0.0
+    pip install -e .
+    pip-audit --desc
+
 [testenv]
 description = Run dependencies matrix  + full unit test (NOTE: May take time as different versions of each dependencies are tested against each other!)
 deps =