fix(deps): bump urllib3 to 2.8.0 for three new advisories

docs/development.md

@@ -100,6 +100,15 @@ version is pinned so relocking always produces the same output:
   When bumping the pin, change both `UV_VERSION` in the `justfile` and the
   `required-version` floor in `pyproject.toml` together.
 
+### Fixing a CVE in a transitive dependency
+
+When the `Dependency Audit` job flags a package VIP does not declare directly,
+raise a floor in `[tool.uv] constraint-dependencies` (for example
+`"urllib3>=2.8.0"`) and run `just relock`. The `Lockfile Guard` job rejects a
+`uv.lock` change that is not paired with a `pyproject.toml` change, and the
+constraint is that paired change. It also stops a later relock from resolving
+back to a vulnerable version.
+
 ### Resolving a uv.lock merge conflict
 
 Never hand-edit conflict markers in `uv.lock`. Take either side wholesale, then

pyproject.toml

@@ -151,6 +151,9 @@ build-backend = "hatchling.build"
 # floor rejects those versions for every uv command; `just relock` pins an exact
 # version on top of it. See docs/development.md ("The lockfile").
 required-version = ">=0.11"
+# urllib3 is transitive. Floor it at the first release that fixes
+# CVE-2026-97687/97688/97689 so a relock cannot resolve back to a vulnerable 2.7.x.
+constraint-dependencies = ["urllib3>=2.8.0"]
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/vip", "src/vip_tests"]