security: pin lxml >=6.1.0 to fix CVE-2026-41066

[MikaKerman]

Summary

• Pin lxml >= 6.1.0 to resolve the last remaining high-severity Dependabot alert (CVE-2026-41066 — XXE via default iterparse() / ETCompatXMLParser() config)
• Follow-up to security: fix 7 high/critical Dependabot alerts #2216 which cleared 6 of 7 alerts by removing dbt-fabricspark/dbt-vertica; this one needed an explicit pin since Dependabot still resolved lxml to a vulnerable version

Test plan

• Verify Dependabot alert Bigquery support #15 clears after merge

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Added lxml as a project dependency.

[github-actions]

👋 @MikaKerman
Thank you for raising your pull request.
Please make sure to add tests and document all user-facing changes.
You can do this by editing the docs files in this pull request.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 38b694e3-a915-4b62-b7f4-d4438ba3d004

📥 Commits

Reviewing files that changed from the base of the PR and between 9d9b61e and 442e053.

📒 Files selected for processing (1)

• pyproject.toml

---

📝 Walkthrough

Walkthrough

The pull request adds lxml as a project dependency with a minimum version constraint of >=6.1.0 in the pyproject.toml file, expanding the Poetry dependency configuration.

Changes

Cohort / File(s)	Summary
Dependency Addition pyproject.toml	Added lxml >=6.1.0 to the Poetry dependencies in [tool.poetry.dependencies].

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 Whiskers twitch with glee so bright,
A dependency now added just right!
LXML joins our merry crew,
Version six-point-one will do!
Our project grows with every hop! 🌱

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: pinning lxml to version >=6.1.0 to address a specific security vulnerability (CVE-2026-41066).
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pin-lxml-minimum-version

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}