[rennf93]

Clears the three open filelock alerts while keeping Python 3.10 supported.

filelock 4.2.1 fixes GHSA-v4x8-3wr5-3wq8 (high), GHSA-567q-5qvw-pf92 and GHSA-9vhv-jxww-xfm5 (low). Two things blocked it: filelock 4.2.x requires Python >=3.11 (PyPI), and safety 3.8.1, the latest, requires filelock<4.0,>=3.16.1. filelock only reaches this project through dev tooling (safety, pip-audit's cachecontrol cache, pre-commit's virtualenv), never at runtime.

1. pip-audit, pre-commit and safety in the dev extra get ; python_version >= '3.11'.
2. [tool.uv] override-dependencies = ["filelock>=4.2.1"] lifts safety's cap. safety only calls FileLock(path) and FileLock(path, timeout=10) (safety/safety.py:114,191, config/auth.py:118,219,241, utils/tls_probe.py:190); those work on 4.2.1, see below.
3. The pre-commit job in ci.yml and scheduled-pre-commit in scheduled-lint.yml run on 3.11; .python-version is 3.11 so local uv run has the tools. The test matrix keeps 3.10 to 3.14, requires-python stays >=3.10,<3.15, mypy keeps targeting 3.10.
4. CLAUDE.md and AGENTS.md note the constraint.

The lock has one filelock entry, 4.2.1, marked python_full_version >= '3.11', so a 3.10 install carries no filelock. 4.2.1 is the first fixed release; 4.2.4 is newer but under 7 days old.

Verified locally, separate venvs per version:

• 3.10.22: 157 passed, mypy Success: no issues found in 8 source files, pre-commit, safety and filelock not installed.
• 3.11.17: 157 passed, mypy same result, ruff All checks passed!, 48 files already formatted, all 8 pre-commit hooks Passed; safety 3.8.1 imports its three filelock modules and acquires and releases both lock forms on filelock 4.2.1.
• 3.14.3: 157 passed, mypy same result.
• uv lock --check passes.

safety scan needs an account, so I didn't run it.