Repository navigation
[docs] - Record the 2026-10-13 dependency currency and install-surface sweep - #1640
Conversation
…e sweep /verify-deps against origin/main 6519135: dep-guard D1-D11 clean, no requirements<->constraints drift, env drift E1-E7 clean, lock contract passed, all 25 hashed lock files agree with constraints.txt, hashed Linux runtime/test locks and the hatchling wheel build dry-run clean. The three surfaces that need the PyTorch CPU index are recorded as unverified because this sandbox's proxy denies download.pytorch.org. Currency: 47 packages, 25 behind latest, grouped into six review-ready bump candidates; 8 documented exceptions left alone. PyPI advisories on the pins are limited to the chromadb set and nltk CVE-2026-81726, both already in SECURITY.md. No pin changed in this commit. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bV9ZkenamEuQAMbhuTRGz
|
PR is a complete fill of |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 14b6331d35
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
- The runtime-lock dry-run is recorded as conditional, not PASS: the lock omits torch by design and the sandbox venv already carried a torch 2.13.0 build, so the resolve proves the pins and hashes, not a from-empty install. - huggingface-hub 2.x is a compatibility-blocked exception, not a bump candidate: sentence-transformers==6.1.0 requires huggingface-hub<2.0.0. Counts: 17 runtime candidates, 9 exceptions. - The bump recipe now names which manifests and lock group own each package (base runtime vs extras-only vs constraints-only transitives vs test tools) instead of a blanket four-file edit that would trip E4. - The pydantic pair plan includes check_deps.py _PYDANTIC_LOCKSTEP and the CLAUDE.md dependency contract, which D1 pins. - uv is used by the lock-refresh scripts; the no-uv claim is limited to installation surfaces. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bV9ZkenamEuQAMbhuTRGz
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b0b2a8077f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Two more Codex findings on the sweep report, both verified: tzdata is a test-only dependency (pyproject test extra, requirements-test.txt, python-tzdata in environment.yml), not base runtime; and check_lock_contract.py hashes constraints.txt and pyproject.toml into every lock group's inputs, so any manifest change needs both refresh scripts, not the one whose resolved pins moved. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bV9ZkenamEuQAMbhuTRGz
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 212e4edfc4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
… plan Two more Codex findings, both verified: no tests/test_schemas* exists, so the pydantic plan now points at the files that import schemas/api.py (test_gate, test_ops_runner, test_memory_routes, test_telegram_runner); and check_otel.py pins nemoguardrails in LAST_VERIFIED_VENDOR_PINS, so that bump needs the same telemetry re-verification the ONNX item already required. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bV9ZkenamEuQAMbhuTRGz
…s skill Nine correct Codex findings on PR #1640 all landed in the sweep report's "how to bump" prose and none in its measured results. The new Gotchas entry maps each wrong claim to the checker or file that disproves it and states the rule: derive a bump recipe from extract_pins.py columns, grep the hard-coded contracts, read dependents' requires_dist before a major bump, run both lock-refresh scripts, and treat a dry-run in a pre-populated venv as conditional. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bV9ZkenamEuQAMbhuTRGz
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2a6a45377b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…torch pin sites Codex round four on PR #1640, five findings, each verified against the repo before the edit: - tzdata is a test-only candidate: the pin-table row and the summary totals now agree (16 runtime | 1 test-only | 2 dev-tool). - The base-runtime `langchain*` wildcard is replaced by `langchain-core`; `langchain` itself joins the extras-only list (agentic-deepagents). - The LangChain stack item requires the otel-hardening re-verification: LAST_VERIFIED_VENDOR_PINS records langchain, langchain-core, langgraph, and langsmith, so --strict exits 2 until they move. - The nemoguardrails item names the three other hard-coded 0.24.0 sites: guardrails/verify_install.py, dep-guard D11, and ci.yml's wheel assert. - requirements-torch.txt is named as the torch-lock input that extract_pins.py has no column for, in the report and the skill gotcha. Checked: verify-deps/verify.sh OK, doc_sync.py 0 drift, table-row counts per class match the summary line. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bV9ZkenamEuQAMbhuTRGz
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dfdc529ee4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…PI's new otel dep Codex round five on PR #1640, three findings, each verified before the edit: - fastapi 0.143.0's PyPI metadata adds opentelemetry-api as an unconditional dependency (0.141.1 declares none; the SDK and OTLP exporter stay behind extras). Item 2 now requires the otel-hardening classification pass and an exact constraints.txt pin before the bump. - The NeMo item no longer hand-lists the 0.24.0 sites; it names the grep that produces the inventory and records what it returned today, including tests/nemo_runtime's exact-version assert (run by nemo-guardrails.yml), dep-guard's verify.sh fixture, and five docs. - Torch cache keys (torch-cpu-2.13.0-) in three workflows are named as the form a `torch==` grep misses and dep-guard D8 exists to catch. The skill gotcha is reframed the same way: the inventory of hard-coded contracts is a bare-version-string grep plus dep-guard and check_otel.py --strict, never a list written from memory, and a bumped package's requires_dist is read for new transitives. Checked: verify-deps/verify.sh OK, doc_sync.py 0 drift, 16 runtime rows. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bV9ZkenamEuQAMbhuTRGz
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 94e135bf45
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…nership in the sweep Codex round six on PR #1640, three findings, each verified before the edit: - pydantic 2.14.1 hard-pins pydantic-core==2.50.1 on PyPI, so the pair is a lock-step runtime candidate (one decision, two rows), not an exception; totals move from 16/9 to 18/7 and the table rows agree. constraints.txt's header comment claiming no newer pydantic pairs with the newer core is noted as stale and moving with the pin. - pydantic-core is constraints-only (extract_pins shows one column; pyproject.toml says why), so the base-runtime bullet no longer lists the pair; item 4 splits the ownership. - pendulum, pgvector, and wcmatch versions appear in check_otel.py's prose inventory, which --strict never reads, so item 5 requires the source re-check and inventory-row update per bump. The skill gotcha records the two generalisations: a lock-step pair whose new parent exists is a candidate, and the strict otel run covers only the pin dict, so the bare-version grep is what finds inventory prose. Checked: verify-deps/verify.sh OK, doc_sync.py 0 drift, rows 18/1/2/19/7. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bV9ZkenamEuQAMbhuTRGz
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3c53564ff4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex round seven on PR #1640, five findings, each verified before the edit: - torch lives in pyproject.toml, constraints.txt, and environment.yml only; requirements.txt excludes it on purpose and the Dockerfile installs the Linux lock, so the "four manifests plus a Docker torch line" wording is gone. - lint.yml names ruff==0.16.8 only in a comment beside its hashed-lock install, and E1 compares workflow pins with each other, not with the manifests, so the comment is updated by hand, not caught by E1. - constraints.txt pins direct deps plus selected critical transitives and leaves the rest to the hashed locks; opentelemetry-api earns a pin on telemetry grounds, not under a universal "no transitive floats" rule. - The pin-site inventory uses `git grep -nF ... -- ':!locks'` over tracked files; a bare `grep -rn` walks ignored logs/, data/, and venvs and prints whatever matched. - The otel cloud-adapter INVENTORY row carries deepagents/langchain-* versions in prose the strict run never compares; the LangChain item rewrites it with the bump. Checked: verify-deps/verify.sh OK, doc_sync.py 0 drift, rows 18/1/2/19/7. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bV9ZkenamEuQAMbhuTRGz
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c660bd4863
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex round eight on PR #1640, four findings, each verified before the edit: - hatchling==1.32.0 lives in [build-system].requires, which extract_pins.py never reads; added as a 48th row (latest 1.32.4, no advisories) with its own build-tool class and a dev-tools item entry. - opentelemetry-api/-sdk/the gRPC exporter are already in every runtime lock via chromadb and already under OTEL_SDK_DISABLED, so FastAPI 0.143.0 adds a dependency edge, not a new package; item 2 now asks for a review of FastAPI's use of the installed stack and no new constraint. - The bare-version search is discovery, not the edit set: 0.24.0 also matches trl<=0.24.0 in the LoRA kit and every dated audit; filter by package context and leave historical audits alone. - doc_sync.py has no dependency-version check; the five NeMo docs are fixed by hand and re-verified by re-running the search. Checked: verify-deps/verify.sh OK, doc_sync.py 0 drift, rows 18/1/2/1/19/7 = 48. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bV9ZkenamEuQAMbhuTRGz
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: befd6af07e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…'s otel and doc inventory Codex round nine on PR #1640, five findings, each verified before the edit: - The advisory section now says every package was queried at the pinned-version PyPI endpoint (the original loop did; the report never said so) and records a re-run over all 48 pins with the same two results. The project endpoint's vulnerabilities array covers only the latest release, which the skill gotcha now states as a rule. - The langgraph-cli analytics row in check_otel.py carries "langgraph==1.2.11 family" in prose; item 1 adds it to the rows rewritten with the LangChain bump. - The web-stack item names the two versioned documents that move with it: the README FastAPI badge and the TestClient deprecation tech note, whose shim claim is re-verified against starlette 1.7.0, not reworded. - The hatchling item requires a full `python -m build` (wheel and sdist, as python-publish.yml runs it; ci.yml builds only the wheel) and an update to check_otel.py's core-libs prose row that names its version. Checked: verify-deps/verify.sh OK, doc_sync.py 0 drift, rows 18/1/2/1/19/7 = 48, advisory re-run 48 queried / 46 clean. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bV9ZkenamEuQAMbhuTRGz
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 58261f9e2d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…o more pin sites Codex round ten on PR #1640, three findings, each verified before the edit: - check_lock_contract.py digests pyproject.toml by its [project] dependency tables only, so the "both refresh scripts after any manifest change" rule is now precise: both when constraints.txt or those tables move, one group's script when only its own input file moves, none for [build-system] or environment.yml edits. - scripts/ci-lock-inputs/extra-postgres.txt is the one extra lock input with exact pins (psycopg, psycopg-binary); a psycopg bump edits it or refresh-ci-locks.sh fails on the stale pin. - otel-hardening/verify.sh carries three live 1.30.0 literals (an exact assertion and two mutation targets) that an onnxruntime bump must edit. Checked: verify-deps/verify.sh OK, doc_sync.py 0 drift, rows 18/1/2/1/19/7 = 48. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bV9ZkenamEuQAMbhuTRGz
2 participants
Proposed changes
/dep-sync— a/verify-depssweep of every install surface againstorigin/main@6519135, recorded as a dated audit underdocs/audits/(the repo convention for reports). No pin is changed. The sweep found the
dependency files consistent with each other on every axis the checkers cover:
dep-guardD1–D11: 0 failures, 0 warnings (pydantic lock-step, numpy <2, torch +cpu, uvicorn no-extra, exact pins, pyproject↔constraints↔environment.yml, coverage flags, NeMo base dep).extract_pins.py:requirements.txt+requirements-test.txt↔constraints.txt— no drift.check_env_drift.pyE1–E7: 0/0 — no undeclared import, workflow tool pins consistent, Python 3.12 everywhere, Docker surface coherent, every runtime pin still imported.scripts/check_lock_contract.py: passed; all 25locks/*.txtagree withconstraints.txton every shared pin.docker compose configrenders. The hashed runtime lock is recorded as conditional: it resolved only because the sandbox venv already carried a torch 2.13.0 build (the lock omits torch by design), so it proves the pins and hashes, not a from-empty install.What it could not prove here: the three surfaces that resolve
torch==2.13.0+cpufromdownload.pytorch.org(local dev, legacy/CI,Dockerfile step 1) — the sandbox proxy denies that host, which is the
skill's documented "unverified, not failed" class. Conda was not dry-run.
Currency: 48 packages (47 from the install surfaces plus the
hatchlingbuild backend, which
extract_pins.pydoes not read), 26 behind latest.19 current, 7 documented or compatibility-blocked exceptions (chromadb,
numpy, websockets, torch, setuptools, nltk, and
huggingface-hub2.x —blocked by
sentence-transformers==6.1.0'shuggingface-hub<2.0.0), 18runtime (the
pydantic/pydantic-corelock-step pair counts as two rows,one decision), 1 test-only (
tzdata), 2 dev-tool, and 1 build-tool bumpcandidates, grouped in the report into six review-ready decisions. The bump
recipe names which manifests and lock group own each package (base runtime /
extras-only / constraints-only transitives / test-only / dev tools — of the
LangChain family only
langchain-coreandlanggraphare base;pydantic-coreis constraints-only even though it moves with base-runtimepydantic; torch is in three manifests and neverrequirements.txt; the twooff-table inputs are
requirements-torch.txtand the exact-pinnedscripts/ci-lock-inputs/extra-postgres.txt), states which lock-refreshscripts a bump needs from what
check_lock_contract.pyactually hashes(
constraints.txtand the[project]tables → both; one group's own input →that group;
[build-system]/environment.yml→ none), and for thehard-coded contracts that move with a pin it names the command that
discovers them (
git grep -nF '<version>' -- ':!locks'over tracked files,filtered by package context with historical audits left alone, then
dep-guardandcheck_otel.py --strict) plus what that search returnedtoday:
_PYDANTIC_LOCKSTEP,LAST_VERIFIED_VENDOR_PINSfor the NeMo, ONNX,and LangChain-family pins, the
check_otel.pyprose inventory rows that--strictnever version-checks (pendulum/pgvector/wcmatch, thecloud-adapter
deepagents/langchain-*row, thelanggraph-cli analyticsrow, and the core-libs row naming
hatchling), the three live1.30.0literals in
otel-hardening/verify.sh, the NeMo0.24.0sites inguardrails/verify_install.py, dep-guard D11 and its fixture,ci.yml,tests/nemo_runtime/, and five docs thatdoc_sync.pydoes not check, thetorch-cpu-2.13.0-cache keys in three workflows, theruff==0.16.8commentin
lint.ymlthat E1 does not check against the manifests, and theversioned web-stack docs (
README.mdbadge, the TestClient deprecation technote). It also records that
fastapi0.143.0 starts importingopentelemetry-apiitself — a new dependency edge onto a stack every runtimelock already carries via
chromadbunderOTEL_SDK_DISABLED, so theweb-stack bump gets an otel-hardening review of FastAPI's use of it and no
new constraint; that
constraints.txt's pydantic header comment is stale nowthat 2.14.1 pairs with core 2.50.1; that a
hatchlingbump is exercised by afull
python -m build(wheel and sdist, as the release workflow runs it);and names the real test files that exercise
schemas/api.py. Advisorieswere queried at the per-release PyPI endpoint for all 48 pins (the project
endpoint describes only the latest release) and are only the chromadb CVE
set and nltk CVE-2026-81726 — both already documented in
SECURITY.md.Why a report and not bumps: CLAUDE.md §7 and
dep-guardclass a runtimebump as ask-first, and every bump requires regenerating the hashed
locks/on arm64 macOS (
scripts/refresh-runtime-lock.sh+refresh-ci-locks.sh,which use
uv pip compile), which this Linux sandbox cannot do withoutfailing
check_lock_contract.py. The owner picks the groups; the reportgives the exact file set and re-check per group.
Agent-instruction file changed (hook reminder):
.claude/skills/verify-deps/SKILL.mdgains one Gotchas entry (2a6a4537,extended in
dfdc529e,94e135bf,3c53564f,c660bd48,befd6af0,58261f9e, and2224edb4), at the owner's request, recording the lessonfrom this PR's review: derive a bump recipe from
extract_pins.pycolumnsand the repo's checkers, derive the hard-coded-contract inventory from a
tracked-file search plus the checkers (as discovery, filtered by context),
query advisories per-release and say so, read what the lock contract hashes
before prescribing a refresh, and never work from memory of the install
surfaces. Hand-written from this session's verified findings; nothing copied
from an external source.
verify-deps/verify.shstays green.Review history: Codex posted thirty-seven P2 findings across ten passes, all
verified against the repo or PyPI and fixed in
b0b2a807,212e4edf,641d9abd,dfdc529e,94e135bf,3c53564f,c660bd48,befd6af0,58261f9e, and2224edb4(threads answered and resolved). Two carriedprecision notes: only
opentelemetry-apiis unconditional infastapi0.143.0, and the advisory loop had in fact queried the per-release endpoint
but the report never said so (re-run over all 48 pins, same result). All
were in the "how to act on this" guidance, the classification of rows the
guidance already treated as decisions, coverage the pin extractor never had
(the build backend), or unstated method — not the measured results for the
47 install-surface packages — which is the lesson the skill entry records.
Invariant / Governance Impact: none — one audit Markdown file added, one
skill Markdown file extended.
Types of changes
Scope note: Docs + audits (a dependency audit, not a dependency change — no manifest, lock, workflow, or checker script is touched).
Benefits / why
Risks to monitor
info.versionwas read on 2026-10-13. Treat the table as a snapshot; re-runextract_pins.py+ the PyPI loop before acting.main.api.osv.devwas unreachable; advisory coverage is PyPI's feed only. It mirrors the PyPA advisory DB (GHSA/PYSEC ids), so coverage is equivalent for PyPI packages, but the report says so explicitly.Checklist
docs/THREAT_MODEL.md,INVARIANTS.mdandSECURITY.md(and any relevant Phase docs)GROK_API_KEY=dummy pytest tests/ -q --tb=short, andbash .claude/skills/CyClaw-Sandbox/verify.shfor core RAG/agentic paths) and passes with no regressionsFurther comments
Run directly in this session:
check_deps.py,extract_pins.py,check_env_drift.py,scripts/check_lock_contract.py, a lock↔constraintspin diff over all 25 lock files, pip
--dry-runfor each surface in aPython 3.12 venv,
pip wheel --no-deps,docker compose config --quiet,a PyPI
info.versionloop plus a per-releasevulnerabilitiesloop overall 48 pins (run twice: at the sweep and again after review),
.claude/skills/verify-deps/verify.shafter each skill edit, andcheck_invariants.pyafter themainmerge. Codex's findings were eachre-verified against the repo (
extract_pins.pyownership columns,pyproject.tomldependency tables,[build-system], and[tool.hatch.build.targets.sdist],constraints.txt:9-12,requirements.txt:17-20,locks/requirements-lock-linux.txt(OpenTelemetryrows),
check_lock_contract.pycatalog()/contract()/digest(),scripts/ci-lock-inputs/*.txt,check_deps.py:54,:118,:297, and:485,check_env_drift.py:72-95,check_otel.py:127-196and itsinventory prose at
:273-278/410-413/448/494/615-625,otel-hardening/verify.sh:48/338/344,doc_sync.py(no version rule),utils/telemetry_kill.py(OTEL_SDK_DISABLED),guardrails/verify_install.py:21,tests/nemo_runtime/test_nemo_runtime.py:31,tools/lora_finetune/requirements.txt:14,ci.yml:341/366/863/1682,lint.yml:84/91,pip-audit.yml:109,nemo-guardrails.yml:90/117,python-publish.yml:49-55,refresh-runtime-lock.sh:95,refresh-ci-locks.sh:138,Dockerfile:64,README.md:4,docs/analysis/TESTCLIENT_HTTPX_DEPRECATION.md:5,.gitignore,ls tests/,the session's own
vuln.sh, and a tracked-file search for0.24.0) orPyPI metadata (
fastapi0.141.1 vs 0.143.0,pydantic2.14.1,hatchling, and the per-release advisory re-run) before the doc changed;after each round the pin table's per-class row counts were re-counted
against the summary line. Not run: pytest (nothing under test changes),
conda, a
uvinstall dry-run (no supported install path uses it; lockgeneration does).
doc_sync.pystays at 0 drift.Suggested merge order of open PRs
Trial merges verified (
git merge --no-commit --no-ff+ abort) against main @ 6519135 on 2026-10-13; the branch has since mergedmain@ 663a8bb and again @ e61481d (after #1638 landed) cleanly —b0b212c8.#1636 · merged ✅
Impact: removed the inert
app.debugkey.Action: done.
#1639 · merged ✅
Impact: doc-sync pass over 29 READMEs/reference docs.
Action: done; this branch already contains it.
#1638 · merged ✅
Impact: the ponytail audit (
docs/audits/2026-10-13-ponytail-audit.md); no file overlap with this PR.Action: done; merged into this branch at
b0b212c8.This PR · Safe ✅
Impact: one new file under
docs/audits/and one Gotchas entry in.claude/skills/verify-deps/SKILL.md; only open PR.Action: auto-merge is enabled; merges when checks pass.
ELI5
Think of the dependency files as five copies of the same shopping list
(
pyproject.toml,constraints.txt,requirements*.txt,environment.yml,and the hashed lock files). This PR adds a dated report saying: all five
copies agree with each other today, and here are the 26 items where the store
now sells a newer version — sorted into groups so you can decide which to
upgrade, which files each one lives in, which locked lists need regenerating
(worked out from what the lock checker actually hashes), and what to re-test.
It changes no version itself, because upgrading means regenerating the hashed
lists on the Mac and that is your call. One "newer version" (huggingface-hub
2.x) is flagged as not actually installable alongside the current
sentence-transformers, another (fastapi 0.143) starts using a telemetry
library the app already carries and already silences so it gets a look at
how it uses it, and the pydantic pair is a real upgrade now that a matching
pair exists upstream. The tool that builds the wheel (hatchling) was missing
from the count and is now in it. The only security notices on today's exact
versions (chromadb and nltk) are ones already written down and accepted in
SECURITY.md, checked version-by-version rather than against the newestrelease. Three install checks could not run here because this sandbox cannot
reach PyTorch's download server, and one more only passed because torch was
already installed — both are labelled honestly. Codex caught thirty-seven
places where the "how to upgrade" instructions, the row labels, the coverage,
or the stated method were wrong or missing; all thirty-seven are fixed, and
the lesson — find the places a version is written down with a search over
tracked files, filter what it finds, say which endpoint you asked, read what
the checkers actually check, and hold the instructions to the same standard
as the numbers — is now written into the skill that produces these reports.
🤖 Generated with Claude Code
https://claude.ai/code/session_019bV9ZkenamEuQAMbhuTRGz
Generated by Claude Code
Last updated: 2026-10-13 03:35 ET