[Aikido] Fix 2 security issues in wrapt, regex

[aikido-autofix]

Upgrade wrapt and regex to fix use-after-free and memory corruption vulnerabilities in free-threaded Python and heap out-of-bounds access in pattern compilation.

⚠️ Breaking changes analysis not available for: wrapt, regex

✅ 2 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-418522	MEDIUM	[wrapt] A race condition in the C extension object proxy allows concurrent mutations on free-threaded Python builds to cause double-release and use-after-free vulnerabilities, leading to memory corruption and process crashes.
AIKIDO-2026-447516	MEDIUM	[regex] A memory-safety vulnerability in the pattern compiler and matching engine allows specially crafted regular expressions to trigger heap out-of-bounds writes and reads through conditional pattern mishandling, stale cache reuse, and boundary violations. This can lead to remote code execution or denial of service.

🔗 Related Tasks

• https://aikido.atlassian.net/browse/AIK-19648

🤖 Remediation details

Fix security vulnerabilities in wrapt and regex direct dependencies

Short summary

This PR remediates vulnerabilities in two direct dependencies — wrapt and regex — declared in the root pyproject.toml. Both packages had Python-version-conditional specs that resolved to vulnerable versions for older Python runtimes. The pyproject.toml constraints and poetry.lock have been updated to ensure patched versions are resolved wherever the Python ecosystem permits.

wrapt

wrapt was declared as ^1.17.2 for Python <3.13 and ^2.4.0 for Python >=3.13, causing wrapt 1.17.2 to be resolved for the majority of supported Python versions — squarely within the vulnerable range (>=1.17.0, <=2.3.0). The fix replaces the conditional spec with ^2.4.0 for Python >=3.9 (resolving to the patched 2.4.0) and >=1.16.0,<1.17.0 for Python <3.9, since wrapt 2.4.0 requires Python >=3.9 and 1.16.0 is the highest release below the vulnerable range that supports Python 3.8.

regex

regex was declared as ^2024.5.15 for Python <3.13 and ^2026.8.31 for Python >=3.13, causing regex 2024.9.11 to be resolved for most supported Python versions — within the vulnerable range (>=2015.10.01, <=2026.7.19). The fix updates the conditional split to ^2026.8.31 for Python >=3.10 (resolving to the patched 2026.9.3) and ^2024.9.11 for Python <3.10; no patched release of regex exists that supports Python 3.8 or 3.9, as the regex package dropped support for those versions before the vulnerability was addressed upstream.

Version changes

Package	From	To	Why updated
wrapt	^1.17.2 (Python <3.13) / ^2.4.0 (Python >=3.13)	>=1.16.0,<1.17.0 (Python <3.9) / ^2.4.0 (Python >=3.9)	Direct CVE fix; lockfile resolves 1.16.0 (Python 3.8) and 2.4.0 (Python ≥3.9)
regex	^2024.5.15 (Python <3.13) / ^2026.8.31 (Python >=3.13)	^2024.9.11 (Python <3.10) / ^2026.8.31 (Python >=3.10)	Direct CVE fix; lockfile resolves 2024.11.6 (Python <3.10) and 2026.9.3 (Python ≥3.10)