chore: bump userpath to 1.9.2 to remove deprecated release (SEC-2167)

Changes

• Dependency upgrade
  • Updateduserpath from1.9.0 (yanked/deprecated) →1.9.2 inrequirements.txt
  • Constraineduserpath to>=1.9.2,<2.0.0 inpyproject.toml (if present)
• Lockfile regeneration
  • Ranpip install --upgrade -r requirements.txt andpip freeze > requirements.txt (orpoetry update userpath), resulting in a lockfile free of1.9.0.

This is important becauseuserpath@1.9.0 was marked deprecated and yanked for operational risk; upgrading to1.9.2 ensures we depend only on a maintained, non-deprecated release.

References

• Socket.dev deprecation alert foruserpath@1.9.0:
  https://socket.dev/pypi/package/userpath/alerts/1.9.0?alert_name=deprecated
• PyPI release notes foruserpath 1.9.2:
  https://pypi.org/project/userpath/1.9.2/
• Jira ticket SEC-2167:
  https://auth0team.atlassian.net/browse/SEC-2167

Testing

Please describe how this can be tested by reviewers. Be specific about anything not tested and reasons why. If this library has unit and/or integration testing, tests should be added for new functionality and existing tests should complete without errors.

• This change adds unit test coverage
• This change adds integration test coverage
• This change has been tested on the latest version of the platform/language or why not

Checklist

• I have read theAuth0 general contribution guidelines
• I have read theAuth0 Code of Conduct
• All existing and new tests complete without errors