chore(deps): raise the pip floor past CVE-2026-8643

[jrosskopf]

Closes #141.

pip < 26.1.2 treats console_scripts / gui_scripts entry points as paths rather than file names, without checking that the resolved absolute path stays inside the installation directory, so a crafted wheel can write its entry-point wrappers anywhere the installing user can write. CVSS v4.0 4.1 (MEDIUM); 8.0 (HIGH) under Red Hat's v3.1 assessment. The CVE checks out against the MITRE record — see the closing note on the issue.

What changed

pyproject.toml pip>=25.0.1 → pip>=26.1.2, and uv lock, which resolves to 26.2.1.

uv 0.12.9 also rewrites the lockfile header revision = 1 → 3. That is the current on-disk format, not part of the bump.

Why a bump and not a deletion

My first read was that the root pyproject.toml was dead scaffolding from 4b7f593 ("initialize UV") — nothing in the Makefile, CMake or CI touches it, and its only declared dependency is pip itself. That was wrong. rfc/test/parallel/README.md documents uv run pytest rfc/test/parallel from the repo root, so this project is the harness's environment, and the root .venv had pip 25.0.1 actually installed. The vulnerable version was live, not merely recorded.

I upgraded that local .venv in place rather than via uv sync — see the follow-up below for why.

Rest of the org is clean

Checked whether anything else pins a vulnerable pip: 25 uv.lock, 2 requirements.txt and 1 poetry.lock across DataZooDE; 48 Python manifests grepped across the locally-cloned repos plus API fetches for the four that are not cloned. This is the only pin of pip anywhere in the org. The ~30 repos that run pip in CI use the ambient setup-python pip, and several already python -m pip install --upgrade pip, which lands on a fixed version by itself.

Follow-up, not in this PR

The root .venv carries pytest, duckdb and adbc_driver_duckdb, none of which are declared in pyproject.toml — they were installed ad hoc. A plain uv sync (or uv run, which syncs) would prune them and break the parallel harness. Worth declaring them so the documented command actually works from a clean checkout, but that changes what the harness resolves and belongs in its own change.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}