Skip to content

docs(release): give the real reason alpha.6 keeps urllib3 2.7.0 and Werkzeug 3.1.7 #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
akynte merged 1 commit into from
Oct 14, 2026
Merged

docs(release): give the real reason alpha.6 keeps urllib3 2.7.0 and Werkzeug 3.1.7 #7

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions docs/releases/v0.1.0-alpha.6.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,8 +62,11 @@ benchmarks were not re-run.
1. **Serena's pinned Python environment** (`configs/serena/uv.lock`) pins
urllib3 2.7.0 and Werkzeug 3.1.7, which have open advisories
(GHSA-vxq7-64xx-v4gw, GHSA-8988-9cw3-xx77, GHSA-gh4c-6fx4-qh6g and
GHSA-g6x2-hccm-hh4m; fixed in urllib3 2.8.0 and Werkzeug 3.1.9). Upgrading
them needs the licence review the pin policy requires.
GHSA-g6x2-hccm-hh4m; fixed in urllib3 2.8.0 and Werkzeug 3.1.9). Serena
v1.7.0 itself requires exactly these versions (`urllib3==2.7.0`,
`werkzeug==3.1.7`), so the lock cannot move without overriding Serena's
own requirements. That needs the compatibility review the pin policy
requires for Serena (ADR-0008).
2. **Earlier limitations.** The limitations of
[v0.1.0-alpha.5](v0.1.0-alpha.5.md#known-limitations) still apply.

Expand Down
Loading