fix(deps): bump filelock to >=3.20.1 (VULN-88793)

[shuningc]

Summary

• Address VULN-88793 by requiring filelock >= 3.20.1 (minimum fixed version).
• Root poetry.lock resolves to 3.32.0 (Poetry resolution; satisfies the floor).
• Previously the lockfile pinned 3.18.0 transitively (crewai / huggingface-hub / virtualenv paths).

Changes

• Add direct filelock = ">=3.20.1" in pyproject.toml so all installs meet the prodsec floor.
• Refresh poetry.lock (filelock 3.18.0 → 3.32.0).
• Align example pins:
  • examples/rag/elastic-chatbot-rag-app/requirements.txt → filelock==3.20.1
  • examples/agent/langgraph-fsi-agent/before/poetry.lock → 3.32.0

Verification

• poetry check
• poetry lock (no diff vs committed lock; Poetry 2.4.1)
• PyPI wheel/sdist hashes for filelock 3.32.0 match poetry.lock

Test plan

• CI green on this PR
• (Optional) poetry install --dry-run / inv test locally if needed

Jira

• VULN-88793

[etserend]

Code Review — AI-Assisted Feedback

Reviewed by Claude Code (Claude Opus), automated review to assist human reviewers.

Verdict: Approve with comments

Minimal, well-scoped vulnerability fix. One scope discrepancy worth confirming below.

---

P3 — langgraph-fsi-agent example lock mentioned in description but absent from diff (Claude Code)

File/Section: examples/agent/langgraph-fsi-agent/before/poetry.lock
Issue: PR description lists this file under "Align example pins" to filelock 3.32.0, but it does not appear in the diff. Either it was already at a satisfying version or the update was missed.
Evidence: gh pr diff 121 shows only 3 files changed: pyproject.toml, poetry.lock, examples/rag/elastic-chatbot-rag-app/requirements.txt.
Recommended fix: Confirm the langgraph-fsi-agent lockfile already satisfies >=3.20.1, or add it to the diff for consistency.

---

Reviewer	Model	Key Contribution
Claude Code	Claude Opus	Identified mismatch between PR description scope and actual diff