Repository navigation
Bump python from 3.12-slim-bookworm to 3.15-slim-bookworm - #1728
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps python from 3.12-slim-bookworm to 3.15-slim-bookworm. --- updated-dependencies: - dependency-name: python dependency-version: 3.15-slim-bookworm dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
dependencies
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/docker/python-3.15-slim-bookworm
branch
October 20, 2026 14:28
cgfixit
added a commit
that referenced
this pull request
Oct 20, 2026
…c removal and extras drop (#1731) ## Proposed changes Documentation and dependency resync against `main` @ `b0683515` (after #1726 and #1727 merged). The five deterministic checkers (doc-sync D1-D13, dep-guard D1-D11, env drift E1-E7, `check_lock_contract.py`, invariant-guard) were already green, so every change here is prose plus one dated audit. **No pin, lock, manifest, or code line changes.** - `README.md`: the removed agentic coding loop no longer appears in the ship-off list, the security-model "Optional surfaces" row, or "Current development"; the docs map stops crediting `setup-guide.md` with Docker/conda and gains a `locks/README.md` row. - `setup-guide.md`: the editable self-install is `pip install -e . -c constraints.txt` on Linux/Windows and `pip install -e . --no-deps` on macOS. The old text pointed at `/tmp/constraints-macos.txt` (exists nowhere in the repo) and said the install went through `requirements.txt` (it goes through the hashed locks). Lock count 25 -> 19 (six locks left with #1700). "step 4b" -> step 4 (no 4b exists). The lock-freshness section was stranded after the footer and now sits above it. Reconciled date 2026-10-20. Option C step 5 notes `GH_TOKEN` is optional and unread by the runtime. - `locks/README.md`: records that `constraints.txt`, `requirements*.txt` and `scripts/ci-lock-inputs/` are hashed byte-for-byte into the lock records (a comment edit alone fails the contract), and a Dependabot section matching #1726. - `docs/DOCKER.md`, `macos/README.md`, `powershell/README.md`: "agentic registry" / "agentic writes" / "Agentic / registry" wording replaced with what exists (model caches, fsconnect writes, connectors). - `AGENTS.md`: `verify-dep` -> `verify-deps`. `CLAUDE.md` §8: one trailing comment on the macOS editable install. Both files steer agent sessions; the diff is those two lines, nothing copied from any external source. - `docs/audits/2026-10-20-dependency-currency-sweep.md` (new) and a `docs/changelog.txt` row: PyPI currency + per-release advisory sweep over all 42 pins. 0 new advisories (chromadb and nltk remain the two accepted in `SECURITY.md`). Bump candidates are grouped for the owner; the stale `constraints.txt` pydantic comment is flagged but left alone because fixing it would re-hash the file. **Invariant / Governance Impact:** none. No core file, graph edge, config value, sanitizer pattern, auth path, or manifest changed. `check_invariants.py`: 46 passed, 0 failed on the pushed head. --- ## Types of changes - [ ] Bugfix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] Security (auth, privacy, injection, egress, redaction, or secrets) - [ ] Invariant / Governance refinement (use this for changes that strengthen or evolve the 6 invariants, I6 isolation, or harness phases) - [ ] Dependencies (added, removed, or bumped) - [ ] CI / infrastructure (workflows, hooks, templates, or checkers) - [ ] Refactor or tests (behavior-preserving, no new capability) - [x] Documentation update - [ ] Other (none of the boxes above fit) Scope note: Docs + audits. --- ## Benefits / why - An operator following `setup-guide.md` on macOS was told to pass a constraints file that does not exist; the new line (`--no-deps`) was run and resolves. - README, Docker and installer docs stop describing a subsystem removed two days ago (#1699/#1700), so a reader cannot go looking for the agentic loop, registry, or `/ops/agentic`. - `locks/README.md` now states the one rule that bites a would-be contributor: the manifests are hashed, so a pin or comment edit needs the Mac re-lock. Dependabot's role (#1726) is documented where the locks live. - The currency sweep gives the owner a reviewed bump list without landing a red lock contract. --- ## Risks to monitor - Prose only; the only executable claim is the macOS `pip install -e . --no-deps` line. Signal if wrong: `cyclaw-*` shims missing after that command on a Mac. Verified on Linux 3.12 only (dry-run, "Would install cyclaw-1.9.0"); not run on macOS. - `doc_sync.py` D9/D10 would catch a broken link or anchor from the moved section; it reports 0 drift on the head. - The sweep is a point-in-time PyPI read (2026-10-20); it is not a pin change and goes stale like every dated audit. --- ## Checklist - [x] I have read `docs/THREAT_MODEL.md`, `INVARIANTS.md` and `SECURITY.md` (and any relevant Phase docs) - [x] This change preserves all 6 security invariants and I6 module isolation (explicit evidence or invariant matrix included for core changes) - [ ] Full sandbox validation has been run (docs-only; per CLAUDE.md §5 the suites are CI's to run) - [x] No new external network dependencies or mandatory online LLM assumptions were introduced without explicit justification + offline fallback path - [ ] For any agentic/fsconnect change: n/a - [x] Relevant architecture docs or threat model notes have been updated if core behavior or topology changed - [x] Commit messages follow the title prefix convention above - [ ] For large or complex changes: n/a --- ## Further comments Checks run directly on the pushed head: `doc_sync.py` (0 drift), `check_deps.py` (0/0), `check_env_drift.py` (0/0), `check_lock_contract.py` (passed), `check_invariants.py` (46/0), a lock-vs-constraints agreement pass over 148 shared entries, and `pip install --dry-run --no-deps -e .` in a Python 3.12 venv. CI only: ruff, the four test legs, coverage, pr-template-check. --- ## Suggested merge order of open PRs _Trial merges verified against main @ b068351 on 2026-10-20: this branch is rebased directly onto that SHA (fast-forward, nothing to merge)._ **#1728** · Blocked Impact: Dependabot Docker base 3.12 -> 3.15; `requires-python <3.13`, so this cannot merge as proposed. Action: Close or re-pin; independent of this PR. **#1729** · Blocked Impact: Dependabot pip minor+patch, 16 packages; red on the lock contract until the Mac re-lock (see `locks/README.md` Dependabot section in this PR). Action: Owner re-locks on arm64 macOS, then merge; does not touch this PR's files. **this PR** · Safe Impact: Docs and one audit only; no shared file with #1728/#1729. Action: Merge any time; squash. ## ELI5 The code moved on (the agentic coding loop and its extras were deleted last week, the lock set shrank, Dependabot got new rules) and the instruction manuals did not. This PR is the manual catching up; it changes no behavior. - **What was broken or missing:** like a museum map still showing a wing that was demolished. `README.md`, `docs/DOCKER.md` and the macOS/PowerShell READMEs still named the agentic loop, its registry and its writes. `setup-guide.md` told Mac users to pass `-c /tmp/constraints-macos.txt` (a file nothing creates), said the install went through `requirements.txt` (it goes through `locks/`), counted 25 locks (there are 19), referenced a "step 4b" that does not exist, and had its lock-freshness section sitting after the signature line. - **What changed:** those sentences now say what the tree does. The macOS self-install is `pip install -e . --no-deps`, because `constraints.txt` pins `torch==2.13.0+cpu` and no such wheel exists for macOS. `locks/README.md` gains two facts: the manifests are hashed into the lock records byte-for-byte, and a Dependabot pip PR is a shopping list until someone re-locks on the Mac. A new dated audit lists every pin against PyPI today with advisories checked per pinned release; two advisories exist (chromadb, nltk) and both were already accepted in `SECURITY.md`. Deliberately not done: no pin bumped, no `constraints.txt` comment fixed, because either one turns `check_lock_contract.py` red until the arm64 re-lock. - **What could still go wrong:** the only runnable claim is the macOS `--no-deps` line. It was dry-run on Linux 3.12 and resolved; it was not run on a Mac. If it is wrong, `cyclaw-user` and friends stay "command not found" after it. Everything else is words; `doc_sync.py` D9/D10 guard the links and anchors and report 0 drift. Last updated: 2026-10-20 10:12 ET --- _Generated by [Claude Code](https://claude.ai/code/session_0196C68GFwq9cXGmpqDMDGJe)_
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps python from 3.12-slim-bookworm to 3.15-slim-bookworm.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)