fix(deps): upgrade vulnerable dependencies for security alerts

- urllib3: 2.5.0 -> 2.6.3 (CVE-2025-66418, CVE-2025-66471, CVE-2026-21441)
- aiohttp: 3.13.2 -> 3.13.3 (8 CVEs including CVE-2025-69223, CVE-2025-69227)
- fonttools: 4.60.1 -> 4.61.1 (CVE-2025-66034)
- filelock: 3.19.1 -> 3.20.3 (CVE-2025-68146, CVE-2026-22701)
- virtualenv: 20.34.0 -> 20.36.1 (CVE-2026-22702)

pyproject.toml

@@ -31,7 +31,8 @@ dependencies = [
     "click>=8.1.8,<9",
     "construct>=2.8.8,<3",
     "crccheck>=1.3.0,<2",
-    "fonttools>=4.0.0,<5",
+    "filelock>=3.20.3,<4",
+    "fonttools>=4.60.2,<5",
     "jsonpickle>=3.0.4,<5",
     "langcodes>=3.4.0,<4",
     "lxml>=5.2.1,<7",
@@ -52,13 +53,14 @@ dependencies = [
     "sortedcontainers>=2.4.0,<3",
     "subtitle-filter>=1.4.9,<2",
     "Unidecode>=1.3.8,<2",
-    "urllib3>=2.2.1,<3",
+    "urllib3>=2.6.3,<3",
     "chardet>=5.2.0,<6",
     "curl-cffi>=0.7.0b4,<0.14",
     "pyplayready>=0.6.3,<0.7",
     "httpx>=0.28.1,<0.29",
     "cryptography>=45.0.0,<47",
     "subby",
+    "aiohttp>=3.13.3,<4",
     "aiohttp-swagger3>=0.9.0,<1",
     "pysubs2>=1.7.0,<2",
     "PyExecJS>=1.5.1,<2",
@@ -77,6 +79,7 @@ unshackle = "unshackle.core.__main__:main"
 [dependency-groups]
 dev = [
     "pre-commit>=3.7.0,<5",
+    "virtualenv>=20.36.1,<22",
     "mypy>=1.9.0,<2",
     "mypy-protobuf>=3.6.0,<4",
     "types-protobuf>=4.24.0.20240408,<7",