Fix 15 Dependabot security vulnerabilities (#108)

* Fix 15 Dependabot security vulnerabilities by updating dependencies

Bumps black (25.1.0→26.5.1), requests (2.32.4→2.34.2), urllib3
(2.5.0→2.7.0), idna (3.10→3.17), pillow (11.3.0→12.2.0), fonttools
(4.59.0→4.63.0), and pygments (2.19.2→2.20.0) to versions that resolve
all open Dependabot alerts (#3–#18).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Test installation with pip, poetry, and uv via matrix

Adds a matrix strategy to the CI job so that the full deployment test
runs against all three supported install methods. The poetry path uses
poetry.lock (verifying pinned safe versions); pip and uv paths resolve
from pyproject.toml constraints (verifying the new lower bounds added
for black and requests).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix poetry lock

Signed-off-by: Émilio Gonzalez <little.moon6016@fastmail.com>

* Use uv sync instead of uv pip install for uv matrix job

uv pip install in a bare shell doesn't reliably pick up the manually
created .venv, causing extras like pybadges/matplotlib to be missed.
uv sync --extra workflow always installs into .venv and is the
idiomatic way to install a project with extras using uv.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Fix uv matrix job: use uv pip install --system instead of uv sync

uv sync installs into an isolated .venv using uv's managed Python,
so the ctf script's shebang can point to a different Python than the
one with pybadges in its sys.path. Using --system installs into the
same Python environment as pip does, making ctf and all its extras
available without any PATH or venv management.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Fix uv matrix: create venv with python3 -m venv, then install with uv

--system fails on ubuntu-24.04 due to PEP 668 (externally managed
Python). pip install works because it targets GitHub Actions' managed
Python environment, not the system Python. Creating the venv with
python3 -m venv uses that same Python; uv auto-detects .venv and
installs into it, so ctf and pybadges share the same interpreter.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Fix uv venv: use --copies so uv writes the correct shebang

python3 -m venv creates symlinks by default: .venv/bin/python3 points
to /usr/bin/python3. When uv generates the ctf console script it
resolves that symlink and writes #!/usr/bin/python3 as the shebang.
Python then starts outside the venv directory, never finds pyvenv.cfg,
skips venv activation, and sys.path excludes .venv site-packages —
so pybadges is installed but invisible.

--copies puts a real binary at .venv/bin/python3.12. uv writes that
path as the shebang; Python finds pyvenv.cfg next to it and activates
the venv correctly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix?

Signed-off-by: Émilio Gonzalez <little.moon6016@fastmail.com>

* Pin setuptools<81 so pybadges can import pkg_resources

Root cause of the uv CI failure: pybadges imports pkg_resources, which
setuptools >= 81 no longer ships. This was never a uv venv/shebang
issue — the earlier --copies/--system/uv sync attempts were red
herrings.

Why only uv failed:
- poetry.lock pinned setuptools 80.9.0 (< 81) -> poetry passed
- pip used the runner's preinstalled old setuptools -> passed by luck
- uv.lock pinned setuptools 82.0.1 (>= 81) -> pybadges import failed
  with "No module named 'pkg_resources'", surfaced as
  "Module pybadges was not found" in ctf stats --generate-badges

Pin setuptools<81 in the workflow extra (where pybadges lives, so the
constraint is self-documenting) and regenerate both lockfiles. Verified
end-to-end: uv run --locked + bare `ctf stats --generate-badges` now
generates badges successfully.

Also switch the poetry CI step to `poetry sync` for a clean environment.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Signed-off-by: Émilio Gonzalez <little.moon6016@fastmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Res260

.github/workflows/tests.yml

@@ -14,11 +14,13 @@ concurrency:
 
 jobs:
   deploy:
-    name: Full deployment test
+    name: Full deployment test (${{ matrix.install-method }})
     if: github.repository == 'nsec/ctf-script'
     timeout-minutes: 45
     strategy:
       fail-fast: false
+      matrix:
+        install-method: [pip, poetry, uv]
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
@@ -36,9 +38,26 @@ jobs:
           echo "Pulled files:"
           { git lfs ls-files | grep -E '[a-f0-9]{10}\s\*'; } || true
 
+      - name: Set up uv
+        if: matrix.install-method == 'uv'
+        uses: astral-sh/setup-uv@v5
+
       - name: Install python dependencies
         run: |
-          pip install -e .[workflow]
+          case "${{ matrix.install-method }}" in
+            pip)
+              pip install -e .[workflow]
+              ;;
+            poetry)
+              pipx install poetry
+              poetry sync --no-interaction --extras workflow
+              echo "$(poetry env info --path)/bin" >> $GITHUB_PATH
+              ;;
+            uv)
+              uv run --locked --extra workflow ctf --help
+              echo "$PWD/.venv/bin" >> $GITHUB_PATH
+              ;;
+          esac
 
       - name: ruff
         run: |