build(deps): bump idna from 3.13 to 3.15 - #92
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
dependabot
Bot
added
dependencies
Bumps [idna](https://github.com/kjd/idna) from 3.13 to 3.15. - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md) - [Commits](kjd/idna@v3.13...v3.15) --- updated-dependencies: - dependency-name: idna dependency-version: '3.15' dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/uv/idna-3.15
branch
from
May 20, 2026 14:16
ad0e0c0 to
ca5de3e
Compare
flg77
added a commit
that referenced
this pull request
May 20, 2026
Bumps that resolve the open Dependabot alerts on the repo: - uv.lock: urllib3 2.6.3 -> 2.7.0 (#10 decompression-bomb High, #11 cross-origin sensitive headers High) - uv.lock: idna 3.13 -> 3.15 (#13 idna.encode bypass — supersedes Dependabot PR #92) - uv.lock: pytest 8.4.2 -> 9.0.3 (#9 tmpdir-handling CVE; the patched line is pytest 9.x, so pytest-asyncio bumps to 1.3.0 and pytest-cov to 7.1.0) - pyproject.toml: pytest>=9.0,<10 + pytest-asyncio>=1.0,<2.0 widened to let the resolver onto the patched line. - webgui/package.json: vite ^5.4.0 -> ^5.4.21 (#12 .map path traversal). #8 (transformers Trainer-class arbitrary-code execution) cannot be bumped today — the patched line is transformers 5.x but no sentence-transformers release supports transformers 5 yet. We do NOT use Trainer (only the SentenceTransformer encode() API for embeddings), so the vulnerable code is not in our execution path. The sentence- transformers range is widened to `<5.0` so the bump becomes a one-line uv-lock change once ST releases support. Documented in pyproject.toml; GitHub alert #8 to be dismissed with "vulnerable code not in execution path". 42 webgui tests still pass. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
Author
|
Looks like idna is up-to-date now, so this is no longer needed. |
flg77
pushed a commit
that referenced
this pull request
Jun 15, 2026
New how-to for collective.e2e-demo: build a Keycloak-secured stock-quotes web app (React + FastAPI, Yahoo Finance) reviewed before an RHOAI deploy, on external MaaS models. Covers: - the collective topology + collective_id=sol-01 rationale + MaaS/API-key handling (api_key_env + .env, never committed); - the end-to-end methodology (build -> redeploy -> install/infuse -> apply -> run), incl. why the acc-packages volume mount is required (#91); - package install / role INFUSION in depth — AutoMode assistant ([PROPOSE_INFUSE] -> always Compliance-gated even under AUTO -> spawn) vs Manual (pkg add / infuse --from-pkg / TUI Get-pack), plus the lighthouse reality (#85 host-can't-write, signed install-from-file with cosign, catalog #92); - prompt techniques + reasoning: the reviewer verdict contract, that depends_on sequences but does NOT thread step outputs (use the inline critic loop or KNOWLEDGE_SHARE, not {step:X}), model-to-job matching, and writing specific task_descriptions so mid-size models don't ramble; - a field troubleshooting table (dormant cells, 401, no-catalog, etc.). Linked from DEMOS.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
flg77
pushed a commit
that referenced
this pull request
Jun 15, 2026
The published acc-canonical index carries a bundle_url (cosign sigstore
bundle) on every package entry, but CatalogIndexEntry had extra='forbid'
and no such field — so the entire index failed to parse ('no catalog
advertises @acc/...'), breaking catalog-based install/resolution and
apply's required_packages resolution for everyone.
Add bundle_url (https) + bundle_path (file-mode parity); carried but not
yet used for verification (detached signature path unchanged). Strictness
preserved — genuinely unknown fields still rejected.
Fixes #92.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
flg77
added a commit
that referenced
this pull request
Jun 15, 2026
fix(catalog): accept sigstore bundle_url in CatalogIndexEntry (#92)
flg77
added a commit
that referenced
this pull request
Jun 18, 2026
Brings the WS-E/F/G TUI surfaces, operator-mode (dev/prod), the dev+AUTO autonomy enablers, and the lighthouse e2e autonomy fixes (skills/mcps/git baked into the agent image, synthesize acc-packages + rw-roles, e2e NATS subscribe) onto main. Conflict resolutions: - acc/collective.py: acc-packages mount reconciled with main #91 (identical code, kept the clearer comment); the branch's rw-roles mount retained. - operator CSV: main's migrated registry (quay.io/flg77/acc_images: acc-operator-) + the branch's 0.2.12 version + replaces v0.2.11. - webgui: kept the branch's operator reconciler (webgui.go ConsoleLinks + route RBAC, which main lacked) AND main's Python observers.py (resilient reconnect-loop with backoff + its tests). Post-merge test reconciliation (suite green except 2 pre-existing reviewer_loop cwd tests, unchanged here): - catalog: tests assert main #92 forward-compat (extra='ignore' + bundle_url is a real field). - repaired pre-existing latent fixtures surfaced by the full run (coding_agent dual-source roster, redis-wiring role resolution, perception grounding text). Verified: operator `go build`+`go vet` clean (bb3 ubi10/go-toolset); full non-container Python suite 3305 passed (2 pre-existing reviewer_loop failures only). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps idna from 3.13 to 3.15.
Changelog
Sourced from idna's changelog.
Commits
af30a09Release 3.1530314d4Pre-release 3.15rc005d4b21Merge pull request #237 from kjd/convert-docs-to-markdown2987fdbConvert README and HISTORY from reStructuredText to Markdown59fa800Merge pull request #236 from kjd/dependabot/github_actions/actions-f3e34333eadef6983Merge branch 'master' into dependabot/github_actions/actions-f3e34333eabbd8004Merge pull request #234 from StanFromIreland/patch-1edd07c0Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group5557db0Merge branch 'master' into patch-1f11746cMerge pull request #235 from StanFromIreland/patch-2