test(security): cover validate_url usage in arxiv tool and PyPI polling

Add behavior tests that assert URL validation runs before network
requests and that unsafe URLs never reach requests.get. Also fix
indentation in _wait_for_pypi after the requests migration.

Co-authored-by: Rip&Tear <theCyberTech@users.noreply.github.com>

lib/devtools/src/crewai_devtools/cli.py

@@ -1557,10 +1557,10 @@ def _wait_for_pypi(package: str, version: str) -> None:
         try:
             response = requests.get(url, timeout=30)
             if response.status_code == 200:
-                    console.print(
-                        f"[green]✓[/green] {package}=={version} is available on PyPI"
-                    )
-                    return
+                console.print(
+                    f"[green]✓[/green] {package}=={version} is available on PyPI"
+                )
+                return
         except Exception:  # noqa: S110
             pass
         time.sleep(_PYPI_POLL_INTERVAL)

lib/devtools/tests/test_wait_for_pypi.py

@@ -0,0 +1,37 @@
+"""Tests for PyPI polling URL validation in the release CLI."""
+
+from unittest.mock import MagicMock, patch
+
+from crewai_devtools.cli import _wait_for_pypi
+import pytest
+
+
+@patch("crewai_devtools.cli.requests.get")
+@patch(
+    "crewai_devtools.cli.validate_url",
+    return_value="https://pypi.org/pypi/crewai/1.0.0/json",
+)
+def test_wait_for_pypi_validates_url_before_request(mock_validate_url, mock_get):
+    mock_response = MagicMock()
+    mock_response.status_code = 200
+    mock_get.return_value = mock_response
+
+    _wait_for_pypi("crewai", "1.0.0")
+
+    mock_validate_url.assert_called_once_with("https://pypi.org/pypi/crewai/1.0.0/json")
+    mock_get.assert_called_once_with(
+        "https://pypi.org/pypi/crewai/1.0.0/json", timeout=30
+    )
+
+
+@patch("crewai_devtools.cli.requests.get")
+@patch(
+    "crewai_devtools.cli.validate_url",
+    side_effect=ValueError("URL resolves to private/reserved IP"),
+)
+def test_wait_for_pypi_rejects_unsafe_url(mock_validate_url, mock_get):
+    with pytest.raises(ValueError, match="private/reserved IP"):
+        _wait_for_pypi("crewai", "1.0.0")
+
+    mock_validate_url.assert_called_once()
+    mock_get.assert_not_called()