From dece15bb1d40403c8a6053aefe89579ca9bb36fc Mon Sep 17 00:00:00 2001 From: itswl Date: Fri, 23 Oct 2026 14:10:55 +0800 Subject: [PATCH] =?UTF-8?q?deps:=20fastapi=200.161.1,=20ruff=200.17.1=20?= =?UTF-8?q?=E2=80=94=20Dependabot=20#15=20#16=20#17=20as=20one=20relocked?= =?UTF-8?q?=20change,=20with=20certifi=202026.10.19=20and=20opentelemetry-?= =?UTF-8?q?api=201.45.1=20for=20two=20advisories=20published=20since=20the?= =?UTF-8?q?=20last=20lock?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The bot's three requirements.txt edits as proposed: fastapi>=0.149.0 for the pipe and the judge, ruff==0.17.1 for all three. The investigator's fastapi floor is lower and the bot left it alone; it stays locked at 0.141.1. A bot PR cannot regenerate requirements.lock from the venv the gate ran against, so merged as authored it fails the lock check; the locks here come from scripts/relock.sh after a green gate. fastapi is locked at 0.161.1, above the bot's floor, as the last two rounds took the newest: FastAPI published sixteen releases between the locked 0.146.0 (10-18) and 0.161.1 (10-22 22:22 UTC), each a tagged release on its own repository published by its release workflow and matching the PyPI upload one to one. PyPI's provenance endpoint answers 404 for every fastapi wheel, including the one locked before, so it carried no signal. The first gate run went red at pip-audit on two advisories that every service carried and main carries too: PYSEC-2026-4320 (certifi before 2026.10.18 still trusts a root whose intermediates had their private keys compromised; via httpx and requests) and CVE-2026-114603 (opentelemetry-api's tracestate parser costs quadratic CPU on a crafted header; via fastapi in the pipe and the judge, via mcp in the investigator). Both fixes are the newest releases and are lock-only: neither package is named in a requirements.txt. The second gate run is STACK GATE GREEN, images included. --- hookjudge/requirements.lock | 8 ++++---- hookjudge/requirements.txt | 4 ++-- hookprobe/requirements.lock | 6 +++--- hookprobe/requirements.txt | 2 +- hookrelay/requirements.lock | 8 ++++---- hookrelay/requirements.txt | 4 ++-- 6 files changed, 16 insertions(+), 16 deletions(-) diff --git a/hookjudge/requirements.lock b/hookjudge/requirements.lock index 83f32709..4a3f935d 100644 --- a/hookjudge/requirements.lock +++ b/hookjudge/requirements.lock @@ -6,13 +6,13 @@ ast_serialize==0.12.1 bandit==1.9.4 boolean.py==5.0 CacheControl==0.14.4 -certifi==2026.7.22 +certifi==2026.10.19 charset-normalizer==3.5.1 click==8.4.2 coverage==7.16.2 cyclonedx-python-lib==11.12.0 defusedxml==0.7.1 -fastapi==0.146.0 +fastapi==0.161.1 filelock==3.32.3 h11==0.16.0 httpcore==1.0.9 @@ -27,7 +27,7 @@ mdurl==0.1.2 msgpack==1.2.1 mypy==2.4.0 mypy_extensions==1.1.0 -opentelemetry-api==1.45.0 +opentelemetry-api==1.45.1 packageurl-python==0.17.6 packaging==26.3 pathspec==1.1.1 @@ -48,7 +48,7 @@ python-dotenv==1.2.3 PyYAML==6.0.3 requests==2.34.2 rich==15.0.0 -ruff==0.17.0 +ruff==0.17.1 sortedcontainers==2.4.0 starlette==1.6.0 stevedore==5.9.0 diff --git a/hookjudge/requirements.txt b/hookjudge/requirements.txt index e063a803..648f44af 100644 --- a/hookjudge/requirements.txt +++ b/hookjudge/requirements.txt @@ -1,5 +1,5 @@ # Four runtime dependencies, chosen to stay four. -fastapi>=0.143.0 +fastapi>=0.149.0 uvicorn[standard]>=0.54.0 aiosqlite>=0.22.1 httpx>=0.28.1 @@ -8,7 +8,7 @@ httpx>=0.28.1 pytest>=9.1.1 pytest-asyncio>=1.4.0 pytest-cov>=7.1.0 -ruff==0.17.0 +ruff==0.17.1 bandit>=1.9.4 pip-audit>=2.10.1 mypy>=2.4.0 diff --git a/hookprobe/requirements.lock b/hookprobe/requirements.lock index 255598ae..64f44e4b 100644 --- a/hookprobe/requirements.lock +++ b/hookprobe/requirements.lock @@ -6,7 +6,7 @@ attrs==26.1.0 bandit==1.9.4 boolean.py==5.0 CacheControl==0.14.4 -certifi==2026.7.22 +certifi==2026.10.19 cffi==2.1.1 charset-normalizer==3.5.1 claude-agent-sdk==0.2.140 @@ -36,7 +36,7 @@ mdurl==0.1.2 msgpack==1.2.1 mypy==2.4.0 mypy_extensions==1.1.0 -opentelemetry-api==1.44.0 +opentelemetry-api==1.45.1 packageurl-python==0.17.6 packaging==26.3 pathspec==1.1.1 @@ -61,7 +61,7 @@ referencing==0.37.0 requests==2.34.2 rich==15.0.0 rpds-py==2026.6.3 -ruff==0.17.0 +ruff==0.17.1 sniffio==1.3.1 sortedcontainers==2.4.0 sse-starlette==3.4.8 diff --git a/hookprobe/requirements.txt b/hookprobe/requirements.txt index 1682dd48..5697c311 100644 --- a/hookprobe/requirements.txt +++ b/hookprobe/requirements.txt @@ -9,7 +9,7 @@ claude-agent-sdk>=0.1.0 pytest>=9.1.1 httpx>=0.28.1 pytest-cov>=7.1.0 -ruff==0.17.0 +ruff==0.17.1 bandit>=1.9.4 pip-audit>=2.10.1 mypy>=2.4.0 diff --git a/hookrelay/requirements.lock b/hookrelay/requirements.lock index cca7e0a3..dc6ac900 100644 --- a/hookrelay/requirements.lock +++ b/hookrelay/requirements.lock @@ -6,13 +6,13 @@ ast_serialize==0.12.1 bandit==1.9.4 boolean.py==5.0 CacheControl==0.14.4 -certifi==2026.7.22 +certifi==2026.10.19 charset-normalizer==3.5.1 click==8.4.2 coverage==7.16.2 cyclonedx-python-lib==11.12.0 defusedxml==0.7.1 -fastapi==0.146.0 +fastapi==0.161.1 filelock==3.32.3 h11==0.16.0 httpcore==1.0.9 @@ -27,7 +27,7 @@ mdurl==0.1.2 msgpack==1.2.1 mypy==2.4.0 mypy_extensions==1.1.0 -opentelemetry-api==1.45.0 +opentelemetry-api==1.45.1 packageurl-python==0.17.6 packaging==26.3 pathspec==1.1.1 @@ -48,7 +48,7 @@ python-dotenv==1.2.3 PyYAML==6.0.3 requests==2.34.2 rich==15.0.0 -ruff==0.17.0 +ruff==0.17.1 sortedcontainers==2.4.0 starlette==1.6.0 stevedore==5.9.0 diff --git a/hookrelay/requirements.txt b/hookrelay/requirements.txt index 0f7f4dea..8d17d661 100644 --- a/hookrelay/requirements.txt +++ b/hookrelay/requirements.txt @@ -1,5 +1,5 @@ # Runtime — five dependencies, chosen to stay five. -fastapi>=0.143.0 +fastapi>=0.149.0 uvicorn[standard]>=0.54.0 aiosqlite>=0.22.1 httpx>=0.28.1 @@ -9,7 +9,7 @@ pyyaml>=6.0.3 pytest>=9.1.1 pytest-asyncio>=1.4.0 pytest-cov>=7.1.0 -ruff==0.17.0 +ruff==0.17.1 bandit>=1.9.4 pip-audit>=2.10.1 mypy>=2.4.0