fix(deps): upgrade click to 8.4.2 to resolve PYSEC-2026-2132

[joeysbase]

Summary

• click 8.3.1 has a command injection vulnerability in click.edit() (PYSEC-2026-2132, fixed in 8.3.3)
• The CVE appeared in the vulnerability database today, breaking the pip-audit step in the Quality Gate for all open PRs
• Pins click>=8.3.3 as an explicit dependency so uv resolves to 8.4.2

Notes

click is a transitive dep via typer — this adds a direct lower-bound to force the upgrade. Unblocks PR #19 and any other PRs open against main.

🤖 Generated with Claude Code

[github-actions]

Claude finished @joeysbase's task in 1m 27s —— View job

---

Code Review for PR #20: fix(deps): upgrade click to 8.4.2

Todo List:

• Read .github/code_review.md for review guidelines
• Read CLAUDE.md for project conventions
• Examine the full diff (git diff origin/main...HEAD)
• Read complete files for context (pyproject.toml and uv.lock)
• Perform cross-file consistency checks
• Conduct "what's missing" analysis
• Provide comprehensive review following the specified format