[alex-omophub]

Summary by cubic

Bumps dependency security floors, adds dependency auditing to CI, and switches the autocomplete endpoint in preparation for the 1.10.0 release.

• Autocomplete now calls the canonical /search/autocomplete endpoint; the legacy bare-list and suggestions-key response shapes remain supported.
• Suggestion now models type and count from the compact search entries; domain_ids and the deprecated domains alias are unchanged.
• Pins security floors for anyio, certifi, aiohttp, multidict, and urllib3 to exclude compromised CA bundles and known vulnerable versions.
• pip-audit runs on every locked dependency across Python 3.10–3.13 in CI, and Dependabot groups minor/patch and security updates weekly.

^{Written for commit b7afbff. Summary will update on new commits.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[cubic-dev-ai]

3 issues found across 8 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/ci.yml">

<violation number="1" location=".github/workflows/ci.yml:22">
P2: The audit job installs `uv` and `pip-audit` from floating PyPI releases, so its security result and runner code change on every run. Pin tested tool versions and preferably their hashes in a checked-in requirements file.</violation>
</file>

<file name="CHANGELOG.md">

<violation number="1" location="CHANGELOG.md:12">
P2: This release adds `anyio` and `certifi` as required runtime dependencies and raises the `fhirpy` extra's floors, but the 1.10.0 entry does not mention any of it. Add a dependency note, as the 1.7.1 entry does, since installers and downstream pinning are affected.</violation>

<violation number="2" location="CHANGELOG.md:13">
P3: The 1.10.0 entry doesn't say that `Suggestion` now includes `type` and `count`, or that the 1.9.1 'seven-field' model was reworked into a compact one with optional fields. Name the added fields and the shape change so users know what to expect.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: The audit job installs uv and pip-audit from floating PyPI releases, so its security result and runner code change on every run. Pin tested tool versions and preferably their hashes in a checked-in requirements file.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/ci.yml, line 22:

<comment>The audit job installs `uv` and `pip-audit` from floating PyPI releases, so its security result and runner code change on every run. Pin tested tool versions and preferably their hashes in a checked-in requirements file.</comment>

<file context>
@@ -8,6 +8,27 @@ on:
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install audit tools
+        run: python -m pip install uv pip-audit
+      - name: Export locked dependencies including all extras
+        run: >-
</file context>

[cubic-dev-ai]

P2: This release adds anyio and certifi as required runtime dependencies and raises the fhirpy extra's floors, but the 1.10.0 entry does not mention any of it. Add a dependency note, as the 1.7.1 entry does, since installers and downstream pinning are affected.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At CHANGELOG.md, line 12:

<comment>This release adds `anyio` and `certifi` as required runtime dependencies and raises the `fhirpy` extra's floors, but the 1.10.0 entry does not mention any of it. Add a dependency note, as the 1.7.1 entry does, since installers and downstream pinning are affected.</comment>

<file context>
@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
+
+### Changed
+
+- Autocomplete now calls the canonical `/search/autocomplete` endpoint and
+  models its compact suggestion entries. `domain_ids` and the deprecated
+  `domains` alias remain supported.
</file context>

[cubic-dev-ai]

P3: The 1.10.0 entry doesn't say that Suggestion now includes type and count, or that the 1.9.1 'seven-field' model was reworked into a compact one with optional fields. Name the added fields and the shape change so users know what to expect.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At CHANGELOG.md, line 13:

<comment>The 1.10.0 entry doesn't say that `Suggestion` now includes `type` and `count`, or that the 1.9.1 'seven-field' model was reworked into a compact one with optional fields. Name the added fields and the shape change so users know what to expect.</comment>

<file context>
@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
+### Changed
+
+- Autocomplete now calls the canonical `/search/autocomplete` endpoint and
+  models its compact suggestion entries. `domain_ids` and the deprecated
+  `domains` alias remain supported.
+
</file context>