chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Bumped mako to >=1.3.12 via a constraint-dependencies entry in the root pyproject.toml to resolve CVE-2026-44307 (high severity, path traversal via backslash URI on Windows in TemplateLookup)
• Regenerated uv.lock with mako 1.3.11 -> 1.3.12

Fixes Dependabot alert #30.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.20%. Comparing base (4ef1019) to head (c5b9b4a).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #389      +/-   ##
==========================================
+ Coverage   90.16%   96.20%   +6.04%     
==========================================
  Files           1       47      +46     
  Lines         122     1741    +1619     
==========================================
+ Hits          110     1675    +1565     
- Misses         12       66      +54     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gemini-code-assist]

Code Review

This pull request updates the mako dependency to version 1.3.12 in pyproject.toml and uv.lock to address a security vulnerability. Feedback indicates that several unrelated version bumps for openfeature packages were included in the lockfile, which violates the project's policy against manual version updates and introduces unnecessary risk to a security-focused change.

[gemini-code-assist]

This version bump for openfeature-flagd-api (0.1.0 -> 1.0.0) appears unrelated to the mako security fix. Including major version changes in a security chore PR is risky and out of scope. Please ensure the lockfile only contains the intended mako update and any strictly necessary transitive updates.

version = "0.1.0"

References

1. Do not manually update the version in pyproject.toml or the changelog, as this is handled automatically.

[gemini-code-assist]

This version bump for openfeature-flagd-core (0.1.0 -> 1.0.0) appears unrelated to the mako security fix. Including major version changes in a security chore PR is risky and out of scope.

version = "0.1.0"

References

1. Do not manually update the version in pyproject.toml or the changelog, as this is handled automatically.

[gemini-code-assist]

This version bump for openfeature-provider-flagd (0.4.0 -> 0.4.1) appears unrelated to the mako security fix.

version = "0.4.0"

References

1. Do not manually update the version in pyproject.toml or the changelog, as this is handled automatically.

[gemini-code-assist]

This version bump for openfeature-provider-ofrep (0.2.0 -> 0.3.0) appears unrelated to the mako security fix.

version = "0.2.0"

References

1. Do not manually update the version in pyproject.toml or the changelog, as this is handled automatically.

[gruebel]

I think this is not needed, a normal uv sync update should be enough. There is also a specialized command to only update a single package

[jonathannorris]

yea, good call — we shouldn't be adding constraint-dependencies here. will update to use uv lock --upgrade-package mako instead and drop that pyproject.toml change.