[HIGH] fix: CVE-2026-24049 — bump wheel

[Pattern Security Automation (pattern-security-automation)]

Supply Chain Vulnerability — Auto-Remediation PR

This PR was automatically generated by Pattern Security Automation.
Please review the dependency change and ensure CI passes before merging.

---

CVE Details

Field	Value
CVE	CVE-2026-24049
Severity	HIGH
Repository	patterninc/soda-core
Vulnerable package	wheel
Fixed version	0.46.2
Dependency type	Transitive (added as pinned)
Previous version	N/A (transitive)
Language	python

What Changed

wheel: N/A (transitive) → 0.46.2

• requirements.txt

Lock File Status

No lock file needed

CI Validation

This PR relies on the repository's existing CI pipeline to validate that the
dependency update does not break tests. Please ensure all checks pass before merging.

False positive?

If you've reviewed this and the CVE is not actually exploitable here, add the
wiz-false-positive label to this PR before closing it. The auto-remediation
pipeline will record the false positive, stop re-flagging this CVE, and (if enabled)
mark it rejected in Wiz.

AI Triage Analysis

Verdict: Needs Review

Reasoning: The wheel package is explicitly listed as a direct dependency in soda/scientific/setup.py (install_requires), meaning it is installed as part of the soda-core-scientific package. However, wheel is typically used as a build tool rather than a runtime library — the CVE details (CVE-2026-24049) are not yet fully published, so the specific vulnerable function/code path is unclear. No source files in the repository appear to import or directly call wheel APIs at runtime; the dependency appears to be listed for build/packaging purposes (common when building packages like prophet that require wheel during installation). Given the uncertainty about the CVE's specific vulnerable code path and whether it affects runtime vs. build-time usage, this warrants further review.

References

• View in Wiz

---

Auto-generated by Pattern Security Automation

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.