fix(deps): python-dotenv 1.2.2 (PYSEC-2026-2270, set_key symlink overwrite)

Now a direct dependency, pip-audit sees it; it used to come in through uvicorn. The .env parser is unchanged: rust/collector/testdata/gen_envfile_cases.py regenerates the 614-case fixture byte-identical under 1.2.2, so envfile.rs still matches.

pyproject.toml

@@ -36,8 +36,9 @@ dependencies = [
     "scikit-learn==1.9.0",
     "sqlalchemy==2.0.23",
     "psycopg2-binary==2.9.9",
-    # .env loading; rust/collector/src/envfile.rs ports exactly this version
+    # .env loading; rust/collector/src/envfile.rs ports its parser (the 614-case
-    "python-dotenv==1.1.1",
+    # fixture is identical for 1.1.1 and 1.2.2; regenerate it when bumping)
+    "python-dotenv==1.2.2",
 ]
 
 [project.urls]

requirements.txt

@@ -6,4 +6,4 @@ numpy>=1.24,<2  # pandas 2.0.3 wheels are ABI-incompatible with numpy 2.x
 scikit-learn==1.9.0
 sqlalchemy==2.0.23
 psycopg2-binary==2.9.9
-python-dotenv==1.1.1
+python-dotenv==1.2.2

rust/collector/src/envfile.rs

@@ -1,4 +1,5 @@
-//! `.env` loading with python-dotenv 1.1.1 semantics (`load_dotenv()`:
+//! `.env` loading with python-dotenv semantics (1.1.1 and 1.2.2 parse the
+//! fixture identically; `load_dotenv()`:
 //! interpolate `${VAR}` / `${VAR:-default}`, never override variables that
 //! are already set).
 //!

uv.lock

@@ -1013,7 +1013,7 @@ requires-dist = [
     { name = "numpy", specifier = ">=1.24,<2" },
     { name = "pandas", specifier = "==2.0.3" },
     { name = "psycopg2-binary", specifier = "==2.9.9" },
-    { name = "python-dotenv", specifier = "==1.1.1" },
+    { name = "python-dotenv", specifier = "==1.2.2" },
     { name = "requests", specifier = "==2.34.2" },
     { name = "scikit-learn", specifier = "==1.9.0" },
     { name = "sqlalchemy", specifier = "==2.0.23" },
@@ -1338,11 +1338,11 @@ wheels = [
 
 [[package]]
 name = "python-dotenv"
-version = "1.1.1"
+version = "1.2.2"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/f6/b0/4bc07ccd3572a2f9df7e6782f52b0c6c90dcbb803ac4a167702d7d0dfe1e/python_dotenv-1.1.1.tar.gz", hash = "sha256:a8a6399716257f45be6a007360200409fce5cda2661e3dec71d23dc15f6189ab", size = 41978, upload-time = "2025-06-24T04:21:07.341Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/82/ed/0301aeeac3e5353ef3d94b6ec08bbcabd04a72018415dcb29e588514bba8/python_dotenv-1.2.2.tar.gz", hash = "sha256:2c371a91fbd7ba082c2c1dc1f8bf89ca22564a087c2c287cd9b662adde799cf3", size = 50135, upload-time = "2026-03-01T16:00:26.196Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/5f/ed/539768cf28c661b5b068d66d96a2f155c4971a5d55684a514c1a0e0dec2f/python_dotenv-1.1.1-py3-none-any.whl", hash = "sha256:31f23644fe2602f88ff55e1f5c79ba497e01224ee7737937930c448e4d0e24dc", size = 20556, upload-time = "2025-06-24T04:21:06.073Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/d7/1959b9648791274998a9c3526f6d0ec8fd2233e4d4acce81bbae76b44b2a/python_dotenv-1.2.2-py3-none-any.whl", hash = "sha256:1d8214789a24de455a8b8bd8ae6fe3c6b69a5e3d64aa8a8e5d68e694bbcb285a", size = 22101, upload-time = "2026-03-01T16:00:25.09Z" },
 ]
 
 [[package]]