chore(deps): aggregate envs dependabot updates - #1015
Conversation
burtenshaw
added
codex
codex-automation
Dependencies
python:uv
Bumps [pillow](https://github.com/python-pillow/Pillow) from 12.2.0 to 12.3.0. - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.2.0...12.3.0) --- updated-dependencies: - dependency-name: pillow dependency-version: 12.3.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
fa7071b to
162a368
Compare
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Aggregate dependabot env roll-up (codex/dependabot-envs-2026-07-27). Two bumps, both security-positive. Hashes verified against live PyPI and uv lock --check passes for both envs. Merges cleanly into main (no conflicts).
Automated Checks
- Lint: PASS (N/A for this PR) — the Python-only hook flags ~20 pre-existing
envs/**files, but this PR touches only.toml/.lock(not linted).repl_env/runner.py+repl_env/server/repl_environment.pyare in that pre-existing list but are not touched here. - Debug code: CLEAN — all
check-debug.shhits are pre-existingsrc/openenv/cli/**; zero inrepl_env/websearch_env.
What changed (verified)
- repl_env
pypdf 6.13.3 → 6.14.2(direct dep; pyproject floor + lock). Born-clean lock (rev 3, allpypi.org/simple). Clears 4 DoS CVEs in 6.13.3 (CVE-2026-59935/6/7/8); CVE-2026-59935 is fixed in 6.14.2 only, so the exact floor is required.pypdfparses user-uploaded PDFs server-side (server/gradio_ui.py:146), so these are directly relevant. - websearch_env
pillow 12.2.0 → 12.3.0(transitive viagradio; lock-only) — the net-new change here. Clears 25 advisories on 12.2.0 (allfixed_in: 12.3.0), incl. CVE-2026-55798 (command injection). 122 packages otherwise unchanged (0 add/remove).
Open RFCs Context
000/001/002/003/005 In Review, 004 (rubrics, no Status header), 010 Draft. None govern dependency management / PyPI index / packaging → no RFC conflicts.
Tier 1: Fixes Required
- None.
Tier 2: Alignment Discussion
Principle Conflicts
ALIGNMENT FLAG: websearch_env lock index source flipped HF mirror → public PyPI
- Principle at stake: Reproducibility / declared provenance (PRINCIPLES.md "Container isolation…", L15)
- The concern: all 129
source = { registry = "https://pypi.registries.huggingface.tech/" }refs are rewritten tohttps://pypi.org/simple. Artifact URLs (files.pythonhosted.org) and hashes are unchanged, so resolution is byte-identical/benign — but the declared provenance changes. Consistent with the ongoing fleet migration; flagging so the team confirms public PyPI is intended for this env. - Suggested reviewer: @Darktex, @burtenshaw
ALIGNMENT FLAG: websearch_env lock revision = 2 → 3
- Principle at stake: Reproducibility (deploy)
- The concern: the deploy path uses
uv sync --frozen, so the base image'suvmust understand lock rev 3. Low risk —websearch_env/server/Dockerfileinstalls currentuvon the fly (line 36) before syncing. Heads-up only. - Suggested reviewer: @Darktex, @burtenshaw
RFC Conflicts
- None identified.
Notes
- This is the intended aggregate path (
codex/dependabot-envs-*), so theexclude-paths: [envs/**]bypass that affects nativedependabot/uv/...PRs does not apply here. Working as designed.
Summary
- 0 mechanical issues to fix
- 2 alignment points for human review (index-flip + revision bump — both benign/low-risk, websearch_env only)
- 0 RFC conflicts
Both bumps are correct and security-positive. No blocking issues.
Sent by Cursor Automation: Pre-review
| { url = "https://files.pythonhosted.org/packages/c3/28/ec0fc38107fc32536908034e990c47914c57cd7c5a3ece4d8d8f7ffd7e27/pillow-12.2.0-pp311-pypy311_pp73-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4a6c9fa44005fa37a91ebfc95d081e8079757d2e904b27103f4f5fa6f0bf78c0", size = 5355404, upload-time = "2026-04-01T14:46:06.33Z" }, | ||
| { url = "https://files.pythonhosted.org/packages/5e/8b/51b0eddcfa2180d60e41f06bd6d0a62202b20b59c68f5a132e615b75aecf/pillow-12.2.0-pp311-pypy311_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:25373b66e0dd5905ed63fa3cae13c82fbddf3079f2c8bf15c6fb6a35586324c1", size = 6002215, upload-time = "2026-04-01T14:46:08.83Z" }, | ||
| { url = "https://files.pythonhosted.org/packages/bc/60/5382c03e1970de634027cee8e1b7d39776b778b81812aaf45b694dfe9e28/pillow-12.2.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:bfa9c230d2fe991bed5318a5f119bd6780cda2915cca595393649fc118ab895e", size = 7080946, upload-time = "2026-04-01T14:46:11.734Z" }, | ||
| version = "12.3.0" |
There was a problem hiding this comment.
pillow 12.2.0 → 12.3.0 (transitive via gradio) — the net-new change in this PR. Verified vs live PyPI: sdist 3b8182a7…, size 47025035, yanked: false, 0 vulns; the wheel hashes match too. 12.2.0 carries 25 advisories, all fixed_in: 12.3.0 (incl. CVE-2026-55798 command injection). Security-positive; 122 other packages unchanged.
| @@ -17,7 +17,7 @@ resolution-markers = [ | |||
| [[package]] | |||
| name = "aiofile" | |||
| version = "3.9.0" | |||
| source = { registry = "https://pypi.registries.huggingface.tech/" } | |||
| source = { registry = "https://pypi.org/simple" } | |||
There was a problem hiding this comment.
Index source flip (Tier 2, reproducibility): all 129 registries.huggingface.tech (HF mirror) refs are rewritten to pypi.org/simple (public PyPI). Artifact URLs (files.pythonhosted.org) + hashes are unchanged → resolution is byte-identical/benign, but the declared provenance changes. Confirm public PyPI is intended for this env. cc @Darktex @burtenshaw
| @@ -1,5 +1,5 @@ | |||
| version = 1 | |||
| revision = 2 | |||
| revision = 3 | |||
There was a problem hiding this comment.
Lock revision 2 → 3 (Tier 2, deploy): a side effect of the re-lock. The deploy Dockerfile uses uv sync --frozen, so the base image's uv must support rev 3 — low risk here since websearch_env/server/Dockerfile installs current uv on the fly (line 36) before syncing. Heads-up only. cc @Darktex @burtenshaw
1 participant
Aggregates env-only Dependabot updates for maintainers.
Included source PRs:
Not included because it was merged directly to main during this automation run:
Validation:
No non-env/core Dependabot PRs were open in this run.