[pre-commit.ci] pre-commit autoupdate

.pre-commit-config.yaml

@@ -25,7 +25,7 @@ repos:
       - id: uv-lock
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.16.3
+    rev: v0.16.4
     hooks:
     - id: ruff-check
       args: [--fix, --exit-non-zero-on-fix]

pyproject.toml

@@ -10,7 +10,7 @@ dependencies = [
     "aieng-eval-agents>=0.1.0",
     "aiohttp>=3.14.3", # CVE-2026-34513/34514/34515/34516/34517/34518/34519/34520/34525, CVE-2026-22815: multiple DoS/security fixes in 3.13.4; CVE-2026-54273/54274/54275/54276/54277/54278/54279/54280: multiple DoS/security fixes in 3.14.1; CVE-2026-69244: heap read OOB in C response parser fixed in 3.14.3
     "beautifulsoup4>=4.13.4",
-    "datasets>=3.6.0",
+    "datasets>=5.0.1", # PYSEC-2026-3716: path traversal vulnerability in folder-based dataset builders fixed in 5.0.1
     "e2b-code-interpreter>=2.4.1",
     "langfuse>=3.10.3,<4.0.0",
     "lxml>=6.0.0",
@@ -53,7 +53,7 @@ dev = [
     "jupyter>=1.1.1",
     "jupyterlab>=4.6.2", # CVE-2026-42266/42557: extension allow-list bypass and command linker XSS fixed in 4.5.7; GHSA-vmhf-c436-hxj4: javascript: URL XSS in Extension Manager fixed in 4.5.9; GHSA-h5v5-8746-g7mm/GHSA-whvh-wf3x-g77j/GHSA-gx64-gj6p-pc4c/GHSA-pppj-hq3g-57pj/GHSA-89vp-jrxv-24w8: plugin manager bypass/XSS/settings code injection fixed in 4.6.2
     "nbqa>=1.9.1",
-    "pip>=26.1.2", # Pinning version to address vulnerability GHSA-6vgw-5pg2-w6jp, CVE-2026-3219; PYSEC-2026-196: entry point path traversal fixed in 26.1.2
+    "pip>=26.2", # Pinning version to address vulnerability GHSA-6vgw-5pg2-w6jp, CVE-2026-3219; PYSEC-2026-196: entry point path traversal fixed in 26.1.2; PYSEC-2026-3721: doubly-encoded package URL path traversal fixed in 26.2
     "pip-audit>=2.9.0",
     "pre-commit>=4.2.0",
     "pytest>=9.0.3", # CVE-2025-71176: tmp dir privilege escalation fixed in 9.0.3