Repository navigation
security: require patched aiohttp and update its locked dependency graph - #429
Merged
Merged
Conversation
This was referenced Oct 19, 2026
ViperJuice
changed the title
This was referenced Oct 19, 2026
ViperJuice
marked this pull request as ready for review
October 20, 2026 14:33
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requires aiohttp>=3.14.4 in project metadata and the same-commit lock. Updates locked aiohttp to 3.14.4 and its required yarl minimum to 1.25.1, consolidates the changelog entry, and corrects a stale comment. Runtime behavior is unchanged; no advisory suppression is added.
The owner approved the bound four-vendor T3 source reviews and independent Frontier president ruling as the panel route for #425–433 on 2026-10-20. All four round-2 reports agree on this head; the president accepts the source with no scoped blocker. This explicit owner ruling satisfies the alternative recorded for F012. Native/runtime certification flags remain false. Fresh review is required for any changed head or base, and exact-head CI and substantive/rehearsal gates remain required.
Reviewed binding: head
446afb18a67efcedb46c71136c9d966c2441d772, base1e0b0b0dc98c5a94b869058d85ba9c1db9c3c94c. The unchanged binary source diff SHA-256 is5f368fa92280bc8b0003666c6d1b5c9b616a8f056ae026ff1357c6d358e37806. Four report hashes and the president ruling were rechecked against the landing dossier. The dossier's false president_patch_digest_matches field means the optional diff_sha256 field was absent from this ruling; it is not a detected digest mismatch. The ruling explicitly binds and independently verifies these commits.Validation: all 12 exact-head hosted checks passed, including locked audit and the full test job (12985 passed, 60 skipped, 1 xfailed; 92.17% coverage). The president independently reproduced the wheel from this source and verified that reverting the dependency floor invalidates the lock. Existing fresh and exact-floor installed-wheel rehearsals retain their recorded source bindings. CI and remote head/base are reread immediately before guarded merge.
The permanent aiohttp-floor CI/doc follow-up is tracked in #442. Settings S remains a later staged milestone; this PR does not activate protection or publication changes. AC-01/AC-06; audit prerequisite for #425. Evidence: /home/viperjuice/workspace/tmp/pmcp-ci-optimization-implementation-sol-20261019/landing-dossiers-20261020/429/dossier.json and /home/viperjuice/workspace/tmp/pmcp-ci-landing-20261020/owner-t3-review-route-approval.json.