[thxCode]

Bump the gpustack-runner floor to >=0.1.32.post1 and regenerate uv.lock to resolve all 15 open Dependabot security alerts across transitive dev dependencies:

• gpustack-runner: 0.1.31 -> 0.1.32.post1
• virtualenv: 21.14.7 -> 21.15.0 (GHSA-c978-59m8-c77v, GHSA-43mp-35q3-x3fq, GHSA-cw65-gx24-rc82, GHSA-558c-9hv2-4prj, GHSA-hhxq-47xx-j5xx, GHSA-qmx5-4p3x-wvqf, GHSA-6w3r-xr62-4xcp, GHSA-fc2g-4w5p-6whm, GHSA-394h-qwmc-48pf, GHSA-494p-63j8-28p3, GHSA-cx28-75q4-x26q)
• setuptools: 84.0.0 -> 84.2.1 (GHSA-xmj3-9gf7-h52w)
• filelock: 3.32.5 -> 3.20.3 (python_full_version < '3.11') and 4.2.4 (python_full_version >= '3.11') (GHSA-v4x8-3wr5-3wq8, GHSA-567q-5qvw-pf92, GHSA-9vhv-jxww-xfm5)

Root Cause & filelock Override

filelock >= 4.1.1 dropped Python 3.10 support (requires-python = ">=3.11"), while pyproject.toml supports >=3.10 and virtualenv >= 21.14.9 declares filelock<5,>=3.24.2; python_version >= "3.10". Without an override, uv lock splits filelock into 4.1.0 for python_full_version < '3.11' and 4.2.4 for python_full_version >= '3.11', leaving 4.1.0 inside the vulnerable >= 3.20.4, <= 4.2.0 and >= 4.1.0, <= 4.2.0 advisory ranges.

Neither virtualenv nor python-discovery uses ReadWriteLock (both import only FileLock and Timeout). Adding [tool.uv] override-dependencies pins filelock==3.20.3 on Python < 3.11 (the release outside both < 3.20.3 and >= 3.20.4, <= 4.2.0) and filelock>=4.2.1 (4.2.4) on Python >= 3.11.

Validation

• Verified all locked versions in uv.lock are clear of vulnerable ranges.
• Verified uv sync --python 3.10 --all-packages --dry-run resolves cleanly.
• make lint clean; make test — 715 passed, 20 skipped.

[gemini-code-assist]

Code Review

This pull request updates the gpustack-runner dependency to >=0.1.32.post1 and configures uv dependency overrides for filelock to target version 3.20.3 on Python versions below 3.11 and >=4.2.1 on Python 3.11 and above. The uv.lock file has been updated accordingly, which also includes minor version bumps for setuptools and virtualenv. No review comments were provided, and I have no feedback to offer on these changes.

[Copilot]

🔵 Needs a closer look

The Python 3.10 override selects filelock below virtualenv’s declared minimum, so runtime compatibility needs confirmation beyond the reported resolution dry run.

No open issues 🎉

What changed in this PR

Updates GPUStack Runtime’s runner dependency and refreshes development dependencies to address the reported Dependabot alerts while retaining Python 3.10 support.

Changes:

• Raises the gpustack-runner minimum to 0.1.32.post1.
• Updates locked virtualenv and setuptools versions.
• Adds Python-version-specific filelock overrides and corresponding lockfile entries.

File	Description
uv.lock	Records updated dependencies and Python-specific filelock resolutions.
pyproject.toml	Raises the runner minimum and adds filelock overrides.

_{Review effort: Balanced}