TR-20956: Updated click library constraint and integrated enhanced CVE scanning using pip-audit

setup.py

@@ -5,6 +5,9 @@
     name="trcli",
     long_description="The TR CLI (trcli) is a command line tool for interacting with TestRail and uploading test automation results.",
     version=__version__,
+    setup_requires=[
+        "setuptools>=83.0.0",  # Updated to address PYSEC-2026-3447 (Unicode normalization bypass on macOS)
+    ],
     packages=[
         "trcli",
         "trcli.commands",
@@ -16,7 +19,7 @@
     ],
     include_package_data=True,
     install_requires=[
-        "click>=8.1.0,<8.2.2",  # Note: click version 8.2.2 is yanked as of Aug 2, 2025!
+        "click>=8.3.3,<9.0.0",
         "pyyaml>=6.0.0,<7.0.0",
         "junitparser>=3.1.0,<4.0.0",
         "pyserde==0.12.*",

tests/requirements-tox.txt

@@ -1,4 +1,4 @@
-pytest==8.0.*
+pytest>=9.0.3
 pytest-md-report
 coverage
 allure-pytest

tox.ini

@@ -1,19 +1,31 @@
 [tox]
-env_list = 
-     unit-test, #click-pyyaml{60,latest}-junitparser{31,latest}-pyserde{12,latest}-requests{231,232,latest}-tqdm{465,latest}-humanfriendly{100,latest}-openapi{50,latest}-beartype{17,latest}-prance
+env_list =
+     unit-test, security-audit, #click-pyyaml{60,latest}-junitparser{31,latest}-pyserde{12,latest}-requests{231,232,latest}-tqdm{465,latest}-humanfriendly{100,latest}-openapi{50,latest}-beartype{17,latest}-prance
 
 [testenv:unit-test]
 description = run basic unit test based on latest version of dependencies
-commands = 
+commands =
     pip install -r tests/requirements-tox.txt
     pip install -r tests/requirements-variable-deps.txt
     pip list
     coverage run -m pytest -c tests/pytest.ini -W ignore::pytest.PytestCollectionWarning tests
     coverage report -m
 
-allowlist_externals = 
+allowlist_externals =
     cd
 
+[testenv:security-audit]
+description = run pip-audit to check for known security vulnerabilities in dependencies
+deps =
+    pip>=26.1.2
+    setuptools>=83.0.0
+    pip-audit
+skip_install = false
+commands =
+    pip install --upgrade pip>=26.1.2 setuptools>=83.0.0
+    pip install -e .
+    pip-audit --desc
+
 [testenv]
 description = Run dependencies matrix  + full unit test (NOTE: May take time as different versions of each dependencies are tested against each other!)
 deps =