From 17fac47936ea968d6d6794292d33beb069f92fbc Mon Sep 17 00:00:00 2001
From: akynte <104795207+akynte@users.noreply.github.com>
Date: Tue, 13 Oct 2026 15:27:16 -0400
Subject: [PATCH] docs(release): give the real reason alpha.6 keeps urllib3
 2.7.0 and Werkzeug 3.1.7

Serena v1.7.0 requires exactly these versions, so the lock cannot be
bumped on its own; moving them means overriding Serena's requirements.

Signed-off-by: akynte <104795207+akynte@users.noreply.github.com>
---
 docs/releases/v0.1.0-alpha.6.md | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/docs/releases/v0.1.0-alpha.6.md b/docs/releases/v0.1.0-alpha.6.md
index 4760846..80b2284 100644
--- a/docs/releases/v0.1.0-alpha.6.md
+++ b/docs/releases/v0.1.0-alpha.6.md
@@ -62,8 +62,11 @@ benchmarks were not re-run.
 1. **Serena's pinned Python environment** (`configs/serena/uv.lock`) pins
    urllib3 2.7.0 and Werkzeug 3.1.7, which have open advisories
    (GHSA-vxq7-64xx-v4gw, GHSA-8988-9cw3-xx77, GHSA-gh4c-6fx4-qh6g and
-   GHSA-g6x2-hccm-hh4m; fixed in urllib3 2.8.0 and Werkzeug 3.1.9). Upgrading
-   them needs the licence review the pin policy requires.
+   GHSA-g6x2-hccm-hh4m; fixed in urllib3 2.8.0 and Werkzeug 3.1.9). Serena
+   v1.7.0 itself requires exactly these versions (`urllib3==2.7.0`,
+   `werkzeug==3.1.7`), so the lock cannot move without overriding Serena's
+   own requirements. That needs the compatibility review the pin policy
+   requires for Serena (ADR-0008).
 2. **Earlier limitations.** The limitations of
    [v0.1.0-alpha.5](v0.1.0-alpha.5.md#known-limitations) still apply.