[Aikido] Fix 2 security issues in regex, wrapt

[aikido-autofix]

Upgrade regex and wrapt to fix memory-safety vulnerabilities including heap out-of-bounds access, use-after-free, and double-free issues that can cause DoS or process crashes.

⚠️ Breaking changes analysis not available for: regex, wrapt

✅ 2 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-447516	MEDIUM	[regex] A memory-safety vulnerability in the pattern compiler and matching engine allows specially crafted regular expressions to trigger heap out-of-bounds writes and reads through conditional pattern mishandling, stale cache reuse, and boundary violations. This can lead to remote code execution or denial of service.
AIKIDO-2026-418522	MEDIUM	[wrapt] A race condition in the C extension object proxy allows concurrent mutations on free-threaded Python builds to cause double-release and use-after-free vulnerabilities, leading to memory corruption and process crashes.

🔗 Related Tasks

• https://aikido.atlassian.net/browse/AIK-19579

🤖 Remediation details

Fix security vulnerabilities in regex and wrapt direct dependencies

Short summary

This PR remediates vulnerabilities in two direct dependencies — regex and wrapt — by tightening their Python-version-conditional version constraints in pyproject.toml and refreshing poetry.lock. Both packages previously used lower version floors for Python <3.13 that fell within vulnerable ranges; the constraints have been restructured to enforce patched versions on all Python versions where those patched releases are installable.

regex

The regex dependency was declared as ^2024.5.15 for Python <3.13, resolving to 2024.9.11 in the lockfile — within the vulnerable range (>=2015.10.01, <=2026.7.19). Because regex 2026.8.31+ requires Python >=3.10, the constraint was split into two ranges: ^2024.5.15 retained only for Python >=3.8,<3.10 (where no patched release exists), and ^2026.8.31 applied for Python >=3.10 (covering 3.10 through 3.14). The lockfile now resolves regex 2026.9.3 for Python >=3.10 and regex 2024.11.6 for Python <3.10.

wrapt

The wrapt dependency was declared as ^1.17.2 for Python <3.13, resolving to 1.17.2 in the lockfile — within the vulnerable range (>=1.17.0, <=2.3.0). Because wrapt 2.4.0 requires Python >=3.9, the constraint was restructured to ^1.17.2 only for Python >=3.8,<3.9 (where no patched release exists) and ^2.4.0 for Python >=3.9 (covering 3.9 through 3.14). The lockfile now resolves wrapt 2.4.0 for Python >=3.9 and wrapt 1.17.3 for Python ==3.8.

Version changes

Package	From	To	Why updated
regex	^2024.5.15 (py <3.13) / ^2026.8.31 (py >=3.13)	^2024.5.15 (py >=3.8,<3.10) / ^2026.8.31 (py >=3.10)	Direct CVE fix; enforces patched floor on Python 3.10–3.12
regex (resolved, py <3.10)	2024.9.11	2024.11.6	Lockfile refresh after constraint restructure
regex (resolved, py >=3.10)	2024.9.11	2026.9.3	Direct CVE fix; patched version now resolved for Python 3.10+
wrapt	^1.17.2 (py <3.13) / ^2.4.0 (py >=3.13)	^1.17.2 (py >=3.8,<3.9) / ^2.4.0 (py >=3.9)	Direct CVE fix; enforces patched floor on Python 3.9–3.12
wrapt (resolved, py ==3.8)	1.17.2	1.17.3	Lockfile refresh after constraint restructure
wrapt (resolved, py >=3.9)	1.17.2	2.4.0	Direct CVE fix; patched version now resolved for Python 3.9+

[aikido-autofix]

Aikido's automated cron job opened a newer AutoFix. It fixes the same vulnerabilities and more: [Aikido] Fix 2 security issues in wrapt, regex