Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>

* Detect non-main default branches in single-branch CI checkouts

actions/checkout fetches one branch and leaves no origin/HEAD. Since 2.6.6
dropped the git fetch --all that recreated origin/HEAD, default-branch
detection fell back to main/master, so scans on repos whose default branch
is dev never became the branch head.

When origin/HEAD is missing, read the default branch from the GitHub event
payload, then from git ls-remote --symref origin HEAD, before the
main/master fallback.

* Bound the remote default-branch lookup on every platform

GitPython's kill_after_timeout is rejected on Windows and relies on
ps --ppid, which macOS lacks. It also leaves git-remote-https holding the
output pipe after the parent dies, so a stalled remote blocked startup past
the timeout.

Run git ls-remote in its own process group and kill the whole group on
timeout, with taskkill /T on Windows.

* Read CI default-branch variables in the shared lookup

GitLab's CI_DEFAULT_BRANCH and Buildkite's BUILDKITE_PIPELINE_DEFAULT_BRANCH
only fed the final branch comparison. The commit-on-default check still
went to the remote, so single-branch checkouts on those CIs paid for a
git ls-remote call even when CI already knew the answer. Both variables
now come first in get_default_branch_name.

Also simplifies the remote lookup. start_new_session works on every
platform because Windows ignores it and taskkill walks the tree by PID.
The stalled-remote fixture is now a listener that never accepts, and the
test clears proxy variables so it really waits for the timeout.

* Avoid remote default-branch lookup for PR builds

---------

Co-authored-by: lelia <[email protected]>

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>

* chore(deps): bump the python-minor-patch group with 3 updates

Bumps the python-minor-patch group with 3 updates: [ruff](https://github.com/astral-sh/ruff), [uv](https://github.com/astral-sh/uv) and [hatchling](https://github.com/pypa/hatch).


Updates `ruff` from 0.16.8 to 0.16.9
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.8...0.16.9)

Updates `uv` from 0.12.15 to 0.12.18
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.12.15...0.12.18)

Updates `hatchling` from 1.32.3 to 1.32.4
- [Release notes](https://github.com/pypa/hatch/releases)
- [Commits](pypa/hatch@hatchling-v1.32.3...hatchling-v1.32.4)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.16.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: uv
  dependency-version: 0.12.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: hatchling
  dependency-version: 1.32.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <[email protected]>

* chore(deps): lock urllib3 2.8.0 and virtualenv 21.12.1 to clear dependency-audit

pip-audit flags the previously locked transitive versions:

- urllib3 2.7.0: PYSEC-2026-4175, -4176, -4177 (fixed in 2.8.0)
- virtualenv 21.4.2: PYSEC-2026-4011 to -4014 (fixed in 21.7.11 to 21.7.13)

urllib3 is pulled in by requests and twine; virtualenv by hatch and
pre-commit (dev only). virtualenv 21.12.1 is the newest release past the
7-day Dependabot cooldown. It requires python-discovery>=1.6, so that moves
1.4.0 -> 1.6.1.

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lelia <[email protected]>

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>
Co-authored-by: lelia <[email protected]>