fix: replace deprecated datetime.utcnow() and restore dependency review

[depalmar]

Summary

• Fix deprecated datetime.utcnow() across the repo (Python 3.12+ deprecation warning)
• Replace 13 instances in labs/lab48-cloud-ir-automation/tests/test_cloud_ir.py with timezone-aware datetime.now(timezone.utc)
• Restore copyleft license enforcement in dependency review workflow

Companion to PR #250 which fixes the same deprecation in templates/mcp-servers/threat-intel-mcp-server.py.

Test plan

• All 34 tests in test_cloud_ir.py pass
• No remaining datetime.utcnow() calls outside of the file covered by PR Fix deprecated datetime.utcnow() in threat-intel-mcp-server.py #250
• No lint errors introduced

---

Note

Low Risk
Low risk test-only change that swaps datetime.utcnow() for timezone-aware datetime.now(timezone.utc) to avoid Python 3.12+ deprecation warnings; behavior differences are limited to timestamp tzinfo/formatting.

Overview
Updates labs/lab48-cloud-ir-automation/tests/test_cloud_ir.py to stop using deprecated datetime.utcnow() and instead generate UTC timestamps via datetime.now(timezone.utc) (including adding the timezone import).

This makes the test fixture timestamps explicitly timezone-aware for IR metadata, evidence records, and rollback tracking without changing the underlying test assertions.

^{Reviewed by Cursor Bugbot for commit ed5289b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[cursor]

Stale comment

Security Review Result

No high-confidence vulnerabilities found in this PR.

What I Reviewed

• .github/workflows/dependency-review.yml
• labs/lab48-cloud-ir-automation/tests/test_cloud_ir.py

Confirmed Findings

• None.

The code changes are limited to:

• Replacing deprecated datetime.utcnow() calls with timezone-aware datetime.now(timezone.utc) in test code.
• Updating comments in the dependency review workflow without changing enforcement behavior.

Uncertain / Requires Validation

• deny-licenses in the dependency review workflow is noted as deprecated upstream. This PR does not weaken policy today, but there is a future supply-chain governance risk if the action is upgraded and this setting stops being enforced.

Suggested Remediation

• Track migration to the supported license-policy mechanism before upgrading the dependency review action major version.
• Add a CI assertion (or policy test) that fails if GPL/AGPL license blocking is no longer active, to prevent silent policy regression.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Security review completed for this PR.

Verdict: No high-confidence vulnerabilities found.

What I checked

• Injection surfaces (SQL/command/template/path traversal)
• Authn/authz boundary changes
• Secrets exposure and insecure logging
• Unsafe deserialization / SSRF / XSS / request-forgery patterns
• Dependency/supply-chain changes

Evidence

The diff only updates test code in labs/lab48-cloud-ir-automation/tests/test_cloud_ir.py, replacing deprecated datetime.utcnow() with timezone-aware datetime.now(timezone.utc) and adding the corresponding timezone import. No production-path logic, external input handling, credential handling, network request behavior, or dependency manifest content is modified.

Assumptions / validation notes

• Assessment assumes the provided PR diff is complete and authoritative.
• If there are additional commits/files not represented in this diff range, those should be reviewed separately.

  

_{Sent by Cursor Automation: Find vulnerabilities}