chore(deps): Update by williaby · Pull Request #38 · ByronWilliamsCPA/Unify

williaby · 2026-06-15T05:17:13Z

Summary

Why

Scheduled patch update, bug fixes and security patches with no API changes.

Changes

This PR contains the following updates:

Change	Update
All locks refreshed	lockFileMaintenance

Impact

✅ Patch update: bug fixes and security patches only
✅ No breaking changes

Acceptance Criteria

All CI checks pass

Testing

CI gates pass (tests, lint, type checking, security scan)

Notes

🔧 This Pull Request updates lock files to use the latest dependency versions.

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- "before 5am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

Copilot

Copilot wasn't able to review any files in this pull request.

coderabbitai · 2026-06-15T05:17:22Z

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

uv.lock is excluded by !**/*.lock, !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 15e3a274-2571-4794-af7f-771fa317dcea

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch renovate/lock-file-maintenance

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-06-15T05:17:48Z

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 84 package(s) with unknown licenses.

See the Details below.

License Issues

uv.lock

Package	Version	License	Issue Type
alembic	1.18.5	Null	Unknown License
anyio	4.14.1	Null	Unknown License
basedpyright	1.39.9	Null	Unknown License
beautifulsoup4	4.15.0	Null	Unknown License
click	8.4.2	Null	Unknown License
cryptography	49.0.0	Null	Unknown License
cuda-bindings	13.3.1	Null	Unknown License
cuda-pathfinder	1.5.5	Null	Unknown License
cyclonedx-python-lib	11.11.0	Null	Unknown License
debugpy	1.8.21	Null	Unknown License
fastapi	0.138.2	Null	Unknown License
filelock	3.29.4	Null	Unknown License
fsspec	2026.6.0	Null	Unknown License
google-api-core	2.31.0	Null	Unknown License
googleapis-common-protos	1.75.0	Null	Unknown License
greenlet	3.5.3	Null	Unknown License
griffelib	2.1.0	Null	Unknown License
grpcio	1.81.1	Null	Unknown License
httptools	0.8.0	Null	Unknown License
hypothesis	6.155.7	Null	Unknown License
idna	3.18	Null	Unknown License
ipykernel	7.3.0	Null	Unknown License
ipython	9.15.0	Null	Unknown License
jaraco-functools	4.5.0	Null	Unknown License
joserfc	1.7.2	Null	Unknown License
json5	0.15.0	Null	Unknown License
jupyter-builder	1.0.2	Null	Unknown License
jupyter-client	8.9.1	Null	Unknown License
jupyter-server	2.20.0	Null	Unknown License
jupyterlab	4.6.1	Null	Unknown License
matplotlib-inline	0.2.2	Null	Unknown License
mdit-py-plugins	0.6.1	Null	Unknown License
mistune	3.3.2	Null	Unknown License
mkdocs-git-revision-date-localized-plugin	1.5.3	Null	Unknown License
mkdocstrings-python	2.0.5	Null	Unknown License
msgpack	1.2.1	Null	Unknown License
mutmut	3.6.0	Null	Unknown License
narwhals	2.22.1	Null	Unknown License
nbclient	0.11.0	Null	Unknown License
nodejs-wheel-binaries	24.16.0	Null	Unknown License
notebook	7.6.0	Null	Unknown License
nox-uv	0.8.0	Null	Unknown License
numpy	2.5.0	Null	Unknown License
nvidia-cublas	13.1.1.3	Null	Unknown License
nvidia-cudnn-cu13	9.20.0.48	Null	Unknown License
nvidia-cusparselt-cu13	0.8.1	Null	Unknown License
nvidia-nccl-cu13	2.29.7	Null	Unknown License
pip-audit	2.10.1	Null	Unknown License
platformdirs	4.10.0	Null	Unknown License
prettytable	3.18.0	Null	Unknown License
proto-plus	1.28.0	Null	Unknown License
pydantic-settings	2.14.2	Null	Unknown License
pydoclint	0.9.0	Null	Unknown License
pymdown-extensions	11.0	Null	Unknown License
pytest	9.1.1	Null	Unknown License
pytest-asyncio	1.4.0	Null	Unknown License
python-discovery	1.4.2	Null	Unknown License
python-frontmatter	1.3.0	Null	Unknown License
python-multipart	0.0.32	Null	Unknown License
pywinpty	3.0.5	Null	Unknown License
regex	2026.6.28	Null	Unknown License
rpds-py	2026.5.1	Null	Unknown License
ruff	0.15.20	Null	Unknown License
safety	3.8.1	Null	Unknown License
scikit-learn	1.9.0	Null	Unknown License
scipy	1.18.0	Null	Unknown License
soupsieve	2.8.4	Null	Unknown License
sqlalchemy	2.0.51	Null	Unknown License
starlette	1.3.1	Null	Unknown License
stevedore	5.8.0	Null	Unknown License
structlog	26.1.0	Null	Unknown License
textual	8.2.7	Null	Unknown License
tomlkit	0.15.0	Null	Unknown License
torch	2.12.1	Null	Unknown License
tornado	6.5.7	Null	Unknown License
tqdm	4.68.3	Null	Unknown License
traitlets	5.15.1	Null	Unknown License
uvicorn	0.49.0	Null	Unknown License
virtualenv	21.5.1	Null	Unknown License
wcwidth	0.8.2	Null	Unknown License
zipp	4.1.0	Null	Unknown License
bleach	6.4.0	Null	Unknown License
certifi	2026.6.17	Null	Unknown License
distlib	0.4.3	Null	Unknown License

Denied Licenses:
GPL-2.0, GPL-3.0

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

pip/alembic

1.18.5

Unknown

pip/anyio

4.14.1

Unknown

pip/authlib

1.7.2

Unknown

pip/basedpyright

1.39.9

Unknown

pip/beautifulsoup4

4.15.0

Unknown

pip/bleach

6.4.0

🟢 4.9

Details

Check	Score	Reason
Maintained	⚠️ 0	project is archived
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Code-Review	⚠️ 0	Found 0/17 approved changesets -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	🟢 10	project is fuzzed
License	🟢 9	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

pip/certifi

2026.6.17

🟢 5.9

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 0/2 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Maintained	🟢 8	10 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 8
Pinned-Dependencies	🟢 5	dependency not pinned by hash detected -- score normalized to 5
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
License	🟢 9	license file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

pip/click

8.4.2

Unknown

pip/coverage

7.14.3

Unknown

pip/cryptography

49.0.0

Unknown

pip/cuda-bindings

13.3.1

Unknown

pip/cuda-pathfinder

1.5.5

Unknown

pip/cyclonedx-python-lib

11.11.0

Unknown

pip/debugpy

1.8.21

Unknown

pip/decorator

5.3.1

Unknown

pip/distlib

0.4.3

Unknown

pip/fastapi

0.138.2

Unknown

pip/filelock

3.29.4

Unknown

pip/fsspec

2026.6.0

Unknown

pip/google-api-core

2.31.0

Unknown

pip/google-auth

2.55.1

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 10	all changesets reviewed
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0

pip/googleapis-common-protos

1.75.0

Unknown

pip/greenlet

3.5.3

Unknown

pip/griffelib

2.1.0

Unknown

pip/grpcio

1.81.1

Unknown

pip/httptools

0.8.0

Unknown

pip/hypothesis

6.155.7

Unknown

pip/idna

3.18

Unknown

pip/ipykernel

7.3.0

Unknown

pip/ipython

9.15.0

Unknown

pip/jaraco-functools

4.5.0

Unknown

pip/joserfc

1.7.2

Unknown

pip/json5

0.15.0

Unknown

pip/jupyter-builder

1.0.2

Unknown

pip/jupyter-client

8.9.1

Unknown

pip/jupyter-server

2.20.0

Unknown

pip/jupyterlab

4.6.1

Unknown

pip/lxml

6.1.1

Unknown

pip/markdown-it-py

4.2.0

Unknown

pip/matplotlib-inline

0.2.2

Unknown

pip/mdit-py-plugins

0.6.1

Unknown

pip/mistune

3.3.2

Unknown

pip/mkdocs-git-revision-date-localized-plugin

1.5.3

Unknown

pip/mkdocstrings-python

2.0.5

Unknown

pip/more-itertools

11.1.0

Unknown

pip/msgpack

1.2.1

Unknown

pip/mutmut

3.6.0

Unknown

pip/narwhals

2.22.1

Unknown

pip/nbclient

0.11.0

Unknown

pip/nest-asyncio2

1.7.2

Unknown

pip/nodejs-wheel-binaries

24.16.0

Unknown

pip/notebook

7.6.0

Unknown

pip/nox-uv

0.8.0

Unknown

pip/numpy

2.4.6

Unknown

pip/numpy

2.5.0

Unknown

pip/nvidia-cublas

13.1.1.3

Unknown

pip/nvidia-cudnn-cu13

9.20.0.48

Unknown

pip/nvidia-cusparselt-cu13

0.8.1

Unknown

pip/nvidia-nccl-cu13

2.29.7

Unknown

pip/pip-audit

2.10.1

Unknown

pip/platformdirs

4.10.0

Unknown

pip/prettytable

3.18.0

Unknown

pip/proto-plus

1.28.0

Unknown

pip/protobuf

7.35.1

Unknown

pip/pydantic

2.13.4

Unknown

pip/pydantic-core

2.46.4

🟢 7.4

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
License	🟢 10	license file detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 4	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

pip/pydantic-settings

2.14.2

Unknown

pip/pydoclint

0.9.0

Unknown

pip/pymdown-extensions

11.0

Unknown

pip/pytest

9.1.1

Unknown

pip/pytest-asyncio

1.4.0

Unknown

pip/python-discovery

1.4.2

Unknown

pip/python-frontmatter

1.3.0

Unknown

pip/python-multipart

0.0.32

Unknown

pip/pywinpty

3.0.5

Unknown

pip/regex

2026.6.28

Unknown

pip/requests

2.34.2

Unknown

pip/rpds-py

2026.5.1

Unknown

pip/ruff

0.15.20

Unknown

pip/safety

3.8.1

Unknown

pip/scikit-learn

1.9.0

Unknown

pip/scipy

1.18.0

Unknown

pip/soupsieve

2.8.4

Unknown

pip/sqlalchemy

2.0.51

Unknown

pip/starlette

1.3.1

Unknown

pip/stevedore

5.8.0

Unknown

pip/structlog

26.1.0

Unknown

pip/textual

8.2.7

Unknown

pip/tinycss2

1.5.1

Unknown

pip/tomlkit

0.15.0

Unknown

pip/torch

2.12.1

Unknown

pip/torchvision

0.27.1

🟢 4.5

Details

Check	Score	Reason
Maintained	🟢 10	27 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	🟢 5	Found 17/30 approved changesets -- score normalized to 5
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 2	branch protection is not maximal on development and all release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

pip/tornado

6.5.7

Unknown

pip/tqdm

4.68.3

Unknown

pip/traitlets

5.15.1

Unknown

pip/triton

3.7.1

Unknown

pip/truststore

0.10.4

Unknown

pip/uvicorn

0.49.0

Unknown

pip/virtualenv

21.5.1

Unknown

pip/watchfiles

1.2.0

🟢 4

Details

Check	Score	Reason
Maintained	🟢 5	7 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
Code-Review	🟢 3	Found 9/26 approved changesets -- score normalized to 3
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

pip/wcwidth

0.8.2

Unknown

pip/zipp

4.1.0

Unknown

Scanned Files

uv.lock

socket-security · 2026-06-15T05:18:02Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability
hypothesis@6.152.4 ⏵ 6.155.7	⁺¹
safety@3.7.0 ⏵ 3.8.1	⁺²
torch@2.11.0 ⏵ 2.12.1		⁺¹
numpy@2.4.4 ⏵ 2.4.6	⁺¹
numpy@2.4.4 ⏵ 2.5.0
scikit-learn@1.8.0 ⏵ 1.9.0	⁺¹
torchvision@0.26.0 ⏵ 0.27.1	^-3
pytest@9.0.3 ⏵ 9.1.1	⁺¹
google-auth@2.50.0 ⏵ 2.55.1	⁺¹
sqlalchemy@2.0.49 ⏵ 2.0.51	⁺¹⁰
ipykernel@7.2.0 ⏵ 7.3.0
pip-audit@2.10.0 ⏵ 2.10.1	⁺¹
uvicorn@0.46.0 ⏵ 0.49.0	⁺¹
mutmut@3.5.0 ⏵ 3.6.0	⁺¹
alembic@1.18.4 ⏵ 1.18.5	⁺¹
python-frontmatter@1.1.0 ⏵ 1.3.0	^-1
basedpyright@1.39.3 ⏵ 1.39.9	⁺¹
google-api-core@2.30.3 ⏵ 2.31.0
pydantic@2.13.3 ⏵ 2.13.4	⁺¹
starlette@1.2.0 ⏵ 1.3.1	⁺¹	⁺¹⁷
python-multipart@0.0.27 ⏵ 0.0.32		⁺¹⁹
ruff@0.15.12 ⏵ 0.15.20	⁺¹
mkdocs-git-revision-date-localized-plugin@1.5.1 ⏵ 1.5.3
fastapi@0.136.1 ⏵ 0.138.2	⁺¹
pytest-asyncio@1.3.0 ⏵ 1.4.0	⁺¹
pydantic-settings@2.14.0 ⏵ 2.14.2	⁺¹	⁺²
pydoclint@0.8.4 ⏵ 0.9.0	⁺¹
structlog@25.5.0 ⏵ 26.1.0	⁺¹
nox-uv@0.7.1 ⏵ 0.8.0

View full report

socket-security · 2026-06-15T05:18:04Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: pypi `nodejs-wheel-binaries` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: uv.lock → `pypi/basedpyright@1.39.9` → `pypi/nodejs-wheel-binaries@24.16.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/nodejs-wheel-binaries@24.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi `nodejs-wheel-binaries` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: uv.lock → `pypi/basedpyright@1.39.9` → `pypi/nodejs-wheel-binaries@24.16.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/nodejs-wheel-binaries@24.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi `nodejs-wheel-binaries` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: uv.lock → `pypi/basedpyright@1.39.9` → `pypi/nodejs-wheel-binaries@24.16.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/nodejs-wheel-binaries@24.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi `nodejs-wheel-binaries` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: uv.lock → `pypi/basedpyright@1.39.9` → `pypi/nodejs-wheel-binaries@24.16.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/nodejs-wheel-binaries@24.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi `nodejs-wheel-binaries` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: uv.lock → `pypi/basedpyright@1.39.9` → `pypi/nodejs-wheel-binaries@24.16.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/nodejs-wheel-binaries@24.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi `nodejs-wheel-binaries` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: uv.lock → `pypi/basedpyright@1.39.9` → `pypi/nodejs-wheel-binaries@24.16.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/nodejs-wheel-binaries@24.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi `nodejs-wheel-binaries` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: uv.lock → `pypi/basedpyright@1.39.9` → `pypi/nodejs-wheel-binaries@24.16.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/nodejs-wheel-binaries@24.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi `nodejs-wheel-binaries` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: uv.lock → `pypi/basedpyright@1.39.9` → `pypi/nodejs-wheel-binaries@24.16.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/nodejs-wheel-binaries@24.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi `nodejs-wheel-binaries` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: uv.lock → `pypi/basedpyright@1.39.9` → `pypi/nodejs-wheel-binaries@24.16.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/nodejs-wheel-binaries@24.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi `nodejs-wheel-binaries` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: uv.lock → `pypi/basedpyright@1.39.9` → `pypi/nodejs-wheel-binaries@24.16.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/nodejs-wheel-binaries@24.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi `nodejs-wheel-binaries` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: uv.lock → `pypi/basedpyright@1.39.9` → `pypi/nodejs-wheel-binaries@24.16.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/nodejs-wheel-binaries@24.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi `nodejs-wheel-binaries` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: uv.lock → `pypi/basedpyright@1.39.9` → `pypi/nodejs-wheel-binaries@24.16.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/nodejs-wheel-binaries@24.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi `nodejs-wheel-binaries` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: uv.lock → `pypi/basedpyright@1.39.9` → `pypi/nodejs-wheel-binaries@24.16.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/nodejs-wheel-binaries@24.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi `nodejs-wheel-binaries` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: uv.lock → `pypi/basedpyright@1.39.9` → `pypi/nodejs-wheel-binaries@24.16.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/nodejs-wheel-binaries@24.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi `nodejs-wheel-binaries` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: uv.lock → `pypi/basedpyright@1.39.9` → `pypi/nodejs-wheel-binaries@24.16.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/nodejs-wheel-binaries@24.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi `nodejs-wheel-binaries` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: uv.lock → `pypi/basedpyright@1.39.9` → `pypi/nodejs-wheel-binaries@24.16.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/nodejs-wheel-binaries@24.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi `numpy` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pyproject.toml → `pypi/numpy@2.4.6` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/numpy@2.4.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi `numpy` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pyproject.toml → `pypi/numpy@2.5.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/numpy@2.5.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Copilot AI review requested due to automatic review settings June 15, 2026 05:17

williaby added dependencies lock-file-maintenance labels Jun 15, 2026

williaby self-assigned this Jun 15, 2026

Copilot AI reviewed Jun 15, 2026

View reviewed changes

chore(deps): Update

e3a1388

williaby force-pushed the renovate/lock-file-maintenance branch from afd566b to e3a1388 Compare June 29, 2026 18:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): Update#38

chore(deps): Update#38
williaby wants to merge 1 commit into
mainfrom
renovate/lock-file-maintenance

williaby commented Jun 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

coderabbitai Bot commented Jun 15, 2026 •

edited

Loading

Review skipped

Uh oh!

github-actions Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

williaby commented Jun 15, 2026

Summary

Why

Changes

Impact

Acceptance Criteria

Testing

Notes

Configuration

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

License Issues

uv.lock

OpenSSF Scorecard

Scanned Files

Uh oh!

socket-security Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Jun 15, 2026 •

edited

Loading

github-actions Bot commented Jun 15, 2026 •

edited

Loading

socket-security Bot commented Jun 15, 2026 •

edited

Loading

socket-security Bot commented Jun 15, 2026 •

edited

Loading