Bump Mako to 1.3.12 (Dependabot #51)

[mrconway]

Summary

• Bumps mako 1.3.11 → 1.3.12 in uv.lock to close Dependabot alert #51 (path traversal via backslash URI on Windows in TemplateLookup).
• Mako is a transitive dep (optuna → alembic → mako); we don't use TemplateLookup directly so practical exposure is nil, but bumping clears the advisory.

Test plan

• uv sync resolves cleanly
• pytest tests/ — 23 passed

[claude]

Claude finished @mrconway's task —— View job

---

PR Review Complete ✅

Todo List:

• Read and analyze the changed uv.lock file
• Review the security vulnerability being addressed
• Assess the appropriateness of the dependency bump approach
• Evaluate test coverage and completeness
• Provide comprehensive review feedback

---

Code Quality & Best Practices ✅

Excellent: This PR follows dependency management best practices:

• Clean, minimal change targeting only the specific vulnerability
• Proper lock file update with correct checksums and metadata
• Clear commit message following conventional commit style
• Appropriate branch targeting (develop → main)

Security Review ✅

Approved: The security fix is appropriate and complete:

• Vulnerability: Path traversal via backslash URI on Windows in Mako's TemplateLookup (Dependabot #51)
• Impact: Low practical risk since AlphaPy doesn't directly use TemplateLookup
• Dependency path: optuna → alembic → mako (confirmed in uv.lock:1474)
• Fix: Version bump 1.3.11 → 1.3.12 addresses the vulnerability completely
• Verification: No breaking changes expected for transitive dependency bump

Performance Considerations ✅

No concerns:

• Minor version bump with no breaking changes
• Size increase minimal (78,503 → 78,521 bytes for wheel)
• No performance regression expected for a templating library used only by Alembic

Potential Issues ✅

None identified:

• Change is isolated to lock file with proper checksums
• All dependency constraints maintained
• No API changes affecting downstream usage

Test Coverage ✅

Adequate for dependency bump:

• ✅ 23 tests passed (as stated in PR description)
• ✅ uv sync resolves cleanly
• For a transitive dependency security fix, current test coverage is sufficient
• No additional tests needed since functionality is unchanged

Recommendations

1. Merge when ready - This is a straightforward security fix with no downsides
2. Monitor - Keep an eye on future Dependabot alerts for proactive security maintenance
3. Consider - Setting up automated security scanning if not already in place

Summary

LGTM 🚀 - This is a textbook example of a proper security dependency update. The change is minimal, targeted, and addresses the vulnerability without introducing risk. The testing approach is appropriate for this type of change.

---