fix: bump the uv group across 1 directory with 16 updates by dependabot[bot] · Pull Request #2486 · groupthinking/EventRelay

dependabot · 2026-10-28T08:30:30Z

Bumps the uv group with 16 updates in the / directory:

Package	From	To
ddtrace	`4.12.2`	`4.15.6`
aiohttp	`3.14.3`	`3.14.4`
black	`26.5.1`	`26.10.1`
pyjwt	`2.13.0`	`2.15.0`
gitpython	`3.1.62`	`3.2.1`
brotli	`1.2.0`	`1.2.1`
filelock	`3.32.2`	`4.2.1`
jupyterlab	`4.6.2`	`4.6.4`
mako	`1.3.12`	`1.4.2`
msgpack	`1.2.1`	`1.2.3`
multidict	`6.7.1`	`6.9.1`
nbconvert	`7.17.1`	`7.17.2`
oauthlib	`3.3.1`	`4.0.0`
opentelemetry-api	`1.44.0`	`1.45.1`
virtualenv	`21.7.1`	`21.15.1`
werkzeug	`3.1.8`	`3.1.9`

Updates ddtrace from 4.12.2 to 4.15.6

Release notes

Sourced from ddtrace's releases.

4.15.6

Security Issues

tracing: Fixes a security vulnerability, as described in GHSA-3633-r77q-h3v3.

4.15.5

Bug Fixes

Code Security (IAST): fixes an issue where taint tracking could abort the Python process when old-style % string formatting handled tainted text containing a lone surrogate character.

4.15.4

Bug Fixes

internal: Fixes an issue on macOS where starting a subprocess can deadlock while a hostname lookup is in progress.

tracing: Fixes a native memory leak on Linux when DD_TRACE_OTEL_CTX_ENABLED is set to true and a thread exits while an OpenTelemetry thread context is still attached.

4.15.3

Bug Fixes

LLM Observability:

Resolves an issue where a streamed Bedrock InvokeModelWithResponseStream request that ended in an error or was cancelled part-way produced a span with no output annotation. The text received before the failure is now tagged on the span.

Resolves an issue where a streamed Bedrock ConverseStream request that ended in an error or was cancelled part-way produced a span that was not marked as an error, making an interrupted request indistinguishable from a successful one.

This fix resolves an issue where cancelled or failed OpenAI streamed requests produced no LLM Observability span at all. These requests now produce an LLM span carrying the input messages, whatever output arrived before the stream ended, and estimated token metrics.

internal:

Fixes incorrect telemetry being collected when hitting cardinality limits during stats computation.

tracing:

Fixes an issue where the Python garbage collector stops and memory grows without limit when DD_RUNTIME_METRICS_ENABLED is true.

Profiling:

A crash that could occur in applications that use signal handlers to recover from crashes has been fixed.

4.15.2

Upgrade Notes

tracing: DD_TRACE_OTEL_CTX_ENABLED now defaults to false until a Linux-native memory leak caused by setting it to true is fixed.

Bug Fixes

LLM Observability: Fixes an issue where abandoned or disconnected streamed LLM requests can leave spans unfinished, causing memory to grow in long-running web workers.

CI Visibility: Fixes an issue where Auto Test Retries do not retry tests that use pytest-timeout thread mode and terminate a pytest-xdist worker.

4.15.1

Bug Fixes

LLM Observability

Resolves an issue where gen_ai.* attributes were added to APM spans when LLM Observability was disabled. These attributes are now only emitted when LLM Observability is enabled.

4.15.0

Estimated end-of-life date, accurate to within three months: 05-2027

See the support level definitions for more information.

... (truncated)

Commits

83ea398 fix(tracing): prevent quadratic query string obfuscation [backport 4.15] (#20...
4ae3a7f chore: bump version to 4.15.6 (#20863)
479a759 ci: update one-pipeline to 1.6.0 [4.15] (#20842)
8da5bb7 chore: bump version to 4.15.5 (#20833)
ace9724 fix(iast): avoid process abort in modulo_aspect on lone surrogates [backpor...
b97ac67 upgrade pyproject.toml version (#20715)
27e417f chore(native): bump libdatadog v43.0.1 → v43.0.2 (#20711)
45e21d6 fix(runtime): avoid macOS subprocess fork deadlock [backport 4.15] (#20678)
3c2beeb chore: bump version to 4.15.3 (#20630)
779fd48 fix(runtime-metrics): prevent gc stopping due to deadlock in gc monitor (#20624)
Additional commits viewable in compare view

Updates aiohttp from 3.14.3 to 3.14.4
Updates black from 26.5.1 to 26.10.1

Release notes

Sourced from black's releases.

26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)

Keep repeated lines outside the selected --line-ranges unchanged (#5436)

Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)

Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)

Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)

Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)

Preview style

Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)

Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)

Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)

Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)

Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)

Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)

Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

Configuration

Add --cache-dir to configure the cache directory from the command line (#5433)

Don't cache a file as formatted after formatting or checking it with --line-ranges,

... (truncated)

Changelog

Sourced from black's changelog.

Version 26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)

Keep repeated lines outside the selected --line-ranges unchanged (#5436)

Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)

Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)

Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)

Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)

Keep the parentheses around a walrus that is the only item in a set (for example {(x := f())}) when targeting Python 3.9 or older, since Python 3.8 and 3.9.0 can't parse it without them (#5502)

Preview style

Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)

Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)

Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)

Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)

Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)

Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)

Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

... (truncated)

Commits

258e7db Prepare release 26.10.1 (#5511)
ac1f715 Action: validate required-version better (#5510)
fe241cc Avoid splitting trailers when earlier bracket split exceeds length due to com...
4fb2897 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#5500)
6d0f557 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#5501)
c45f21d Handle PEP 695 type parameter whitespace in whitespace() (#5504)
8ec61a7 Skip UTF-8 BOM when reading .gitignore (#5497)
c9b1148 Fix module docstring last_line_length when docstring ends with newline (#5494)
eb88358 Parenthesize expressions with parameter comments in preview (#3113) (#5442)
939fa93 Keep the parentheses around a right-hand side when a dict value's parentheses...
Additional commits viewable in compare view

Updates pyjwt from 2.13.0 to 2.15.0

Release notes

Sourced from pyjwt's releases.

2.15.0

See the 2.15.0 changelog for complete release details.

2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

`v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0>`__

Security


- Wrap recursion errors from deeply nested JWT payloads in ``DecodeError``
  instead of exposing a raw ``RecursionError``.
Added

- Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) &lt;https://github.com/jpadilla/pyjwt/pull/1202&gt;`__
Changed



JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS
payload, so a cache hit no longer re-parses every key. JWKSetCache.put()
accepts either form and raises PyJWKSetError for anything else. As a
result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance
for as long as it stays cached, rather than a freshly built one per call in
[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;__
PyJWKClient.fetch_data() now raises
PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;) when
the endpoint response is not a JSON object, instead of returning it for
get_jwk_set() to reject. Callers reaching the JWKS through
get_jwk_set() see the same error as before in
[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;__

Fixed

- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError(&quot;The JWKS endpoint did not return a JSON
  object&quot;)``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914) &lt;https://github.com/jpadilla/pyjwt/issues/914&gt;`__ and
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__
- ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a
  ``fetch_data()`` override that filters or transforms the JWKS is no longer
  undone by the next cache hit in
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__
- Raise the documented ``PyJWTError`` subclass instead of leaking a
  ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a
  non-numeric, non-string value such as a list, dict, or ``null``.
- Reject OKP JWK private keys when their public ``x`` component does not
  match the private ``d`` component.
- Treat malformed JWK Set members as unusable keys rather than letting
  ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not
&lt;/tr&gt;&lt;/table&gt; 
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>

<li><a href="https://github.com/jpadilla/pyjwt/commit/1d41a6478e1562e68ff667fcd703356acf085f68&quot;&gt;&lt;code&gt;1d41a64&lt;/code&gt;&lt;/a> chore: prepare 2.15.0 release</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/9bc06658f875b9b40091539140bbbdc4639161c3&quot;&gt;&lt;code&gt;9bc0665&lt;/code&gt;&lt;/a> fix: make recursive payload tests deterministic</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b&quot;&gt;&lt;code&gt;5fde08a&lt;/code&gt;&lt;/a> fix: normalize recursive JWT payload errors</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/171062d2d734315272a901100aa4b109f2fc3c19&quot;&gt;&lt;code&gt;171062d&lt;/code&gt;&lt;/a> utils: mention bytes in force_bytes type error (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1173&quot;&gt;#1173&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/c9d4d5375bf464ef363506fed9eb6e7f33217ab6&quot;&gt;&lt;code&gt;c9d4d53&lt;/code&gt;&lt;/a> docs/conf: drop duplicate 'and' from read() docstring (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1174&quot;&gt;#1174&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/2763752196113e1473b0ed7905aa6034aedfbe53&quot;&gt;&lt;code&gt;2763752&lt;/code&gt;&lt;/a> Add support for Python 3.15 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1202&quot;&gt;#1202&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/4adcd02722f5011c60079d3978dfc167b9a8eaa5&quot;&gt;&lt;code&gt;4adcd02&lt;/code&gt;&lt;/a> Catch http.client.HTTPException in PyJWKClient.fetch_data (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1201&quot;&gt;#1201&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/9e501d993b4d3e7dba14bdb1722b1d993ac75097&quot;&gt;&lt;code&gt;9e501d9&lt;/code&gt;&lt;/a> fix: correct docstring typo in _validate_jti (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1179&quot;&gt;#1179&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/4047c44d51950ffda15f40054508d3f17c43b1e2&quot;&gt;&lt;code&gt;4047c44&lt;/code&gt;&lt;/a> docs: clarify JWK certificate member handling (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1212&quot;&gt;#1212&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/f4e2b59f543cc82d46d9d69922bba59e804216b9&quot;&gt;&lt;code&gt;f4e2b59&lt;/code&gt;&lt;/a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1210&quot;&gt;#1210&lt;/a&gt;)&lt;/li>

<li>Additional commits viewable in <a href="https://github.com/jpadilla/pyjwt/compare/2.13.0...2.15.0&quot;&gt;compare view</a></li>

</ul>

</details>
<br />

Updates gitpython from 3.1.62 to 3.2.1

Release notes
Sourced from gitpython's releases.

3.2.1
What's Changed

prepare for next release, v3.2 by @Byron in gitpython-developers/GitPython#2260
objects: decode a byte mode before reading its digits by @SashaMIT in gitpython-developers/GitPython#2261
build(deps): bump https://github.com/astral-sh/ruff-pre-commit from v0.16.5 to 0.16.9 in the pre-commit group by @dependabot[bot] in gitpython-developers/GitPython#2263
fix(submodule): validate destinations before mutation by @Byron in gitpython-developers/GitPython#2264
fix(util): create lock files in one exclusive step by @radhika1314 in gitpython-developers/GitPython#2267
fix(commit): accumulate gpgsig continuation lines in linear time by @Keerthana-64 in gitpython-developers/GitPython#2268
fix(index): accept a single PathLike in checkout by @kokotatan in gitpython-developers/GitPython#2269
fix(util): redact URL credentials without corrupting the host by @yunaremaia in gitpython-developers/GitPython#2270
change line for changelogs by @CrowZhen in gitpython-developers/GitPython#2272
fix(commit): reject identity fields that alter commit headers by @Keerthana-64 in gitpython-developers/GitPython#2271
fix: stop stalled remote commands when their timeout expires by @Byron in gitpython-developers/GitPython#2277
fix(util): reject symbolic links that alias .gitmodules by @Keerthana-64 in gitpython-developers/GitPython#2278
fix: send one object name or path per git stdin record by @Keerthana-64 in gitpython-developers/GitPython#2279
fix(stats): preserve whitespace in filenames by @v1shay in gitpython-developers/GitPython#2280
fix(config): preserve exact large integer values by @xiehuanyi in gitpython-developers/GitPython#2281
fix: resolve IterableList names independently of list attributes by @FanWu-ai in gitpython-developers/GitPython#2283
fix relative blocking lock 20261011 by @Byron in gitpython-developers/GitPython#2284

New Contributors

@SashaMIT made their first contribution in gitpython-developers/GitPython#2261
@kokotatan made their first contribution in gitpython-developers/GitPython#2269
@yunaremaia made their first contribution in gitpython-developers/GitPython#2270
@CrowZhen made their first contribution in gitpython-developers/GitPython#2272
@v1shay made their first contribution in gitpython-developers/GitPython#2280
@xiehuanyi made their first contribution in gitpython-developers/GitPython#2281
@FanWu-ai made their first contribution in gitpython-developers/GitPython#2283

Full Changelog: https://github.com/gitpython-developers/GitPython/compare/3.2.0...3.2.1
3.2.0 - Security
What's Changed

test: cover subdirectory discovery and pathspec commands in bare-repository worktrees by @christianvuerings in gitpython-developers/GitPython#2228
Read git's yes/no and on/off booleans in get_value by @rawsun007 in gitpython-developers/GitPython#2229
Clarify detached HEAD access and isolate test branch state by @Byron in gitpython-developers/GitPython#2231
Reject submodule move destinations through intermediate symlinks by @Byron in gitpython-developers/GitPython#2232
fix: validate checkout positional reference options by @Byron in gitpython-developers/GitPython#2233
Fix timeout child-process lookup on non-GNU systems by @aprylewu in gitpython-developers/GitPython#2236
Preserve implicit boolean config keys by @Byron in gitpython-developers/GitPython#2238
Reject comments after implicit boolean config keys by @Byron in gitpython-developers/GitPython#2239
Fix case-insensitive Git config name matching by @Byron in gitpython-developers/GitPython#2241
Move project metadata to pyproject.toml by @mwtoews in gitpython-developers/GitPython#2242
Move [doc] extra to a PEP 735 dependency group; add uv-sync CI check by @mwtoews in gitpython-developers/GitPython#2243
fix: strip inline config comments the way git does by @rawsun007 in gitpython-developers/GitPython#2245
Drop Python 3.7 by @mwtoews in gitpython-developers/GitPython#2246
fix: preserve positional operands in high-level Git commands by @Byron in gitpython-developers/GitPython#2247
submodule: option to update without fetching by @jeffro256 in gitpython-developers/GitPython#2244
bump minor version to indicate drop of python 3.7 support by @Byron in gitpython-developers/GitPython#2248
fix: skip a UTF-8 BOM when reading config files by @geek-alpha in gitpython-developers/GitPython#2249



... (truncated)


Changelog
Sourced from gitpython's changelog.

3.2.1
Security fixes for

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-83vg-56qc-22m7

If you can, also try and provide feedback on the upcoming v4 branch
gitpython-developers/GitPython#2274 - patches welcome.
See the following for all changes.
https://github.com/gitpython-developers/GitPython/releases/tag/3.2.1
3.2.0
Drops support for Python 3.7 (5 years after its EOL).
Security fixes for

Deprecate the pure-Python GitDB object database backend due to security and
performance issues. Selecting it or a subclass through odbt now emits a
DeprecationWarning. Remove odbt=GitDB to use GitCmdObjectDB, the
existing default, or select odbt=GitCmdObjectDB explicitly. The gitdb
package remains a dependency for shared types and utilities.
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-gq48-pqfc-9p58
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-23mf-xhv8-69c2
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-f9j4-qggq-h239
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-w8jc-g24h-crhw
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-m64x-33q8-m5h7
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fx3j-rwgx-fr94

If you can, also try and provide feedback on the upcoming v4 branch
gitpython-developers/GitPython#2274 - patches welcome.
See the following for all changes.
https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0



Commits

c179357 prepare changelog prior to release
97eadb8 fix(submodule): validate destinations before mutation
6a7180a prepare for next release, v3.2
0b64501 refactor(db): deprecate the pure-Python GitDB backend
9349ff5 fix(repo): preserve literal separate Git directory paths
8290c98 fix: bound actor and date parsing
9ad28cc fix: complete safety checks in Git command wrappers
ce2093b bump minor version to indicate drop of python 3.7 support
dafafff Merge pull request #2247 from gitpython-developers/pos-arg-sanitization
790bb31 fix(remote): reject option-shaped pull operands
Additional commits viewable in compare view




Updates brotli from 1.2.0 to 1.2.1

Release notes
Sourced from brotli's releases.

v1.2.1
SECURITY

CVE-2026-111497: out-of-bounds write permits remote code execution




Changelog
Sourced from brotli's changelog.

[1.2.1] - 2026-10-21
SECURITY

CVE-2026-111497: out-of-bounds write permits remote code execution




Commits

db24a98 prepare for release
b418fa8 Detect and report invalid stream earlier.
See full diff in compare view




Updates filelock from 3.32.2 to 4.2.1

Release notes
Sourced from filelock's releases.

4.2.1

Bug fixes

On a singleton wrapper, AsyncReadWriteLock.close() and AsyncSoftReadWriteLock.close() end only the holds that tasks acquired through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold. After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended hold, and close() on such a wrapper returns. Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. #832 by @gaborbernat.
ReadWriteLock locks again after a release() that an exception from a signal handler interrupted. The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled. AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an AsyncFileLock call joins its queue no longer blocks every later call on that lock. #833 by @gaborbernat.
Fix ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite now opens the database by name only in a directory no other account can write, and through a private hard link elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database in a directory other accounts cannot write, such as one under %LOCALAPPDATA%. The lock removes link directories through a checked descriptor rather than by name, reads a link directory's name only when the locking account owns it, and leaves alone a directory with other content renamed onto a link directory's name. A database whose schema takes more than a few kilobytes to load raises ValueError instead of running past the acquire timeout. #834 by @gaborbernat.
Fix five bugs in opening the lock file. UnixFileLock no longer truncates a file it did not create, such as one renamed to the lock path, and no longer applies mode to it. An on_acquired hook that writes holder metadata now truncates the file itself. A lease (Linux) or an oplock (Windows) on the lock file or a soft lock's marker no longer holds acquire() past its timeout or blocking=False, and an oplock no longer holds release(); ReadWriteLock on Windows waits for its timeout and raises Timeout. On Windows, a mode without group and other bits, such as 0o600, now creates the lock file with an owner-only permission list; the ReadWriteLock database gets the same. The soft locks' writability check no longer follows a symlink swapped in at the lock path. On a filesystem without flock, a contender from another account now waits on a marker it cannot write instead of raising PermissionError. #835 by @gaborbernat.
Fix SoftFileLock, MarkerSoftFileLock and SoftFileLease removing a live holder's marker in three cases: the holder and the contender run in Linux time namespaces with different boottime offsets; only one of them can read the boot id; a process other than the owner rewrote the marker. Soft markers no longer carry group or other write bits. A process name containing a carriage return or another line separator no longer makes the stale check raise ValueError. When /proc/self/ns/time exists but cannot be read, the stale check no longer compares start times and keeps the marker. #836 by @gaborbernat.
The async read-write locks record their hold under a task owner, so synchronous code on the executor thread that took the hold can no longer re-enter or release it. AsyncSoftReadWriteLock gives back one level on release, so synchronous readers of a shared singleton keep theirs. SoftReadWriteLock tracks read levels per thread: release() from a thread that holds none raises RuntimeError. After its heartbeat recorded a lost hold, it refuses new acquires until that hold is released. #838 by @gaborbernat.
StrictSoftFileLock creates <path>.filelock and its claims directory with the lock's mode and sets the sticky bit (a directory flag that lets only a file's owner remove it) on both. On the next acquisition it narrows a directory it owns that an earlier release created wider; it leaves a directory of another account as it is, so remove such leftovers by hand. It reaches claims through a descriptor opened without following symlinks; on Windows it holds both directories open and refuses a junction (a directory that points at another directory). Under a sticky parent such as /tmp it refuses a coordination directory of another account, as SoftReadWriteLock does for <path>.rw. One read grace now covers a whole claim scan, a failed claim cleanup no longer leaves the sentinel descriptor open, and a non-regular node at a sentinel private-record name raises SoftFileLockProtocolError. On Windows, contenders read claims without blocking their owner's unlink. #839 by @gaborbernat.
Fix a lock reporting a hold the OS had dropped after a signal handler raised during acquire or release. A release that a signal handler cuts short after it has started now completes before the error propagates. A handler that acquires the lock its own thread is releasing now gets RuntimeError instead of a hold that stays held. The singleton cache no longer hands out an is_singleton=True lock or a ReadWriteLock whose finalizer is running, which released the new holder's lock. A signal during os.fork() no longer leaves the other threads blocked in their next lock call, and a fork from another thread no longer waits for a ReadWriteLock acquire on a busy database. #840 by @gaborbernat.
Fix a lock on a relative path locking a file in the directory the process changed to while the lock waited, and leaving its marker behind on release after such a change. The path resolved when an acquisition starts stays in use until the hold ends. An is_singleton=True lookup no longer returns a cached lock whose relative path now resolves to another file; a held lock still matches the file it holds. A rename of the lock's directory during a hold no longer leaves the marker behind or reports a false lease compromise, and a waiter no longer creates a second lock file in a directory that was renamed away. #841 by @gaborbernat.
SoftReadWriteLock reaches its records through descriptors of <path>.rw and gen or holders opened without following symlinks. On Windows it holds those directories open and refuses a junction (a directory that points at another directory). A tree swapped in after an earlier acquire therefore cannot redirect them. Its heartbeat rewrites a holder record only when the name still leads to the file it created, and does not block on a FIFO (a named pipe). A heartbeat that finds <path>.rw replaced by a symlink or junction reports the hold lost instead of ending the heartbeat thread. A live lock object repeats the ownership check whenever the tree it opens is not the one it prepared. #842 by @gaborbernat.
Fix SoftFileLock, MarkerSoftFileLock and SoftFileLease removing or displacing a live holder's marker in five cases. ext4 gave a freed inode number to the next marker. A stalled FileLock removed its ENOSYS placeholder after a peer replaced it. A failed acquire cleaned up after a successor took the path. A stale break left the lock path empty while it checked the marker it had moved. A lifetime break judged a marker by a reused inode number. On Linux and macOS a stale marker now changes hands in one atomic exchange. On other platforms without one, except Windows, including NFS and SMB, the marker stays in place and waits for timeout or break_lock(). Restoring a marker no longer follows a symlink found under the break name. A holder that releases while a peer's exchange has its marker aside leaves a record no lock parses, so the put-back lands a marker that ages out. A lease heartbeat that finds another file at the lock path once, while a peer's break has its marker aside, waits for the next refresh before it reports a compromise. A contender that finds a dead breaker's marker puts back the marker that breaker left under its break name. A marker is the breaker's own only when it names the breaker's process on this host; the same process number on another host is a holder. A contender takes a stranded marker under a name of its own before it puts the marker back, so two contenders no longer reverse each other's exchange and remove the live holder's marker. A claim left behind by a failed put-back is retried on the next poll. #843 by @gaborbernat.
Canceling an AsyncReadWriteLock or AsyncSoftReadWriteLock acquire that waits for another process now stops the wait and raises the cancellation. It used to wait until that process released, or raise Timeout. A thread_local=True AsyncFileLock that threads with their own event loops share no longer deadlocks when one thread waits for the lock while another holds it. #844 by @gaborbernat.
SoftReadWriteLock refuses a commit that lands a whole retention window behind the log, so two committers stalled at adjacent generations can no longer admit a second writer. Its stale check samples the clock before it reads a holder record, so a pause between the two no longer counts as time the record stayed unchanged. #845 by @gaborbernat.
Fix a SoftFileLock contender evicting an empty marker after two seconds while its owner held the lock. The owner is a SoftFileLock before 3.22, which writes nothing into its marker, or a current one still writing its record. An empty marker now reads as held, and timeout, lifetime or break_lock() clears it. A contender that finds an empty marker a dead breaker left aside puts it back instead of removing it. #846 by @gaborbernat.
Fix ReadWriteLock on Windows acting on -journal and -wal files another account places beside its database: an acquire could fail with OperationalError, or SQLite could replay the journal and delete the file it names. The lock now reads the database directory's access control list. Where an account other than the locking account, SYSTEM and Administrators can add or remove names, SQLite opens a hard link inside a directory only those accounts can write. A filesystem without hard links raises OSError. #854 by @gaborbernat.
Fix SoftReadWriteLock subclasses sharing singleton instances with the base class or sibling subclasses. Each concrete class now keeps its own cache and construction guard, including after fork, while preserving cooperative class-definition keywords. #855 by @AryanRG.

New Contributors

@AryanRG made their first contribution in #855

🐍 PyPI release
📜 Full Changelog
4.2.0

Bug fixes

Fix StrictSoftFileLock raising SoftFileLockProtocolError on Windows when a contender read a claim whose owner was still finishing its unlink. #829 by @gaborbernat.


Performance

import filelock is about twice as fast: lock types other than FileLock load on first use. #831 by @gaborbernat.

🐍 PyPI release
📜 Full Changelog
4.1.2



... (truncated)


Changelog
Sourced from filelock's changelog.

###########
Changelog
###########
.. towncrier-draft-entries:: Unreleased
.. towncrier release notes start
.. _release-4-2-4:

4.2.4 (2026-10-19)

.. _release-4-2-3:

4.2.3 (2026-10-19)

.. _release-4-2-3-fixed:
Fixed

Creating a lock on a Python 3.15 interpreter without types.LazyImportType no longer triggers AttributeError at
exit. :pr:861 - by :user:gaborbernat.
Handle EFTYPE when a no-follow open refuses a symlink in a soft reader/writer lock's protocol tree, so heartbeat
reports lost ownership rather than a transient refresh error. :pr:859 - by :user:edsonsims.

.. _release-4-2-2:

4.2.2 (2026-10-18)

.. _release-4-2-2-fixed:
Fixed

Fix a lock on a relative path that stayed held after a later with lock: ended, when an earlier acquire() had
failed because the working directory no longer exists. That call still raises :class:FileNotFoundError, and it now
leaves the lock's hold count unchanged. :pr:856 - by :user:spicysharkco.

.. _release-4-2-1:

4.2.1 (2026-10-17)



... (truncated)


Commits

60331bb Release 4.2.1
834bf13 🧪 test(soft): skip Unix pin test on Windows
9d15e38 fix(soft-rw): isolate subclass singleton registries (#855)
e1e825b 🐛 fix(open): keep lock files intact, honor deadlines and mode (#835)
5e3f2ec 🐛 fix(read-write): keep SQLite off shared names, bound schema (#834)
bfa066d 🐛 fix(strict): keep claim directories private to the lock (#839)
977d2c3 🐛 fix(soft): wait on an empty marker instead of evicting (#846)
740ff66 🐛 fix(soft): break stale markers without emptying the lock path (#843)
86c6d5f 🐛 fix(async): honor cancellation and per-thread gates (#844)
eeceaa8 🐛 fix(soft): keep live holders when owner identity differs (#836)
Additional commits viewable in compare view




Updates jupyterlab from 4.6.2 to 4.6.4

Release notes
Sourced from jupyterlab's releases.

v4.6.4
4.6.4
(Full Changelog)
Security fixes

GHSA-3325-v43h-43rv - moderate
GHSA-6966-vjj6-99xv - high
GHSA-jwrc-gm9j-263p - moderate
GHSA-3jqq-pw4j-pqcj - moderate

Bugs fixed

Backport of security patches on 4.6.x branch #19793 (@krassowski, @MUFFANUJ)
Cache and throttle path resolution to avoid requests storm #19726 (@krassowski)
Fix race when starting the search - keep correct filter #19765 (@krassowski)
Fix PyPI extension manager package.json inspection for tar.gz archives #19613 (@MUFFANUJ)
Fix resizing optimization for larger notebooks #19620 (@krassowski)
Preserve kernelspec metadata when spec is unavailable #19247 (@tomatotomata)
Fix respecting commsOverSubshells option in connectTo() #19734 (@krassowski)Description has been truncated

--- updated-dependencies: - dependency-name: ddtrace dependency-version: 4.15.6 dependency-type: direct:production dependency-group: uv - dependency-name: aiohttp dependency-version: 3.14.4 dependency-type: direct:production dependency-group: uv - dependency-name: black dependency-version: 26.10.1 dependency-type: direct:production dependency-group: uv - dependency-name: pyjwt dependency-version: 2.15.0 dependency-type: direct:production dependency-group: uv - dependency-name: gitpython dependency-version: 3.2.1 dependency-type: direct:production dependency-group: uv - dependency-name: brotli dependency-version: 1.2.1 dependency-type: indirect dependency-group: uv - dependency-name: filelock dependency-version: 4.2.1 dependency-type: indirect dependency-group: uv - dependency-name: jupyterlab dependency-version: 4.6.4 dependency-type: indirect dependency-group: uv - dependency-name: mako dependency-version: 1.4.2 dependency-type: indirect dependency-group: uv - dependency-name: msgpack dependency-version: 1.2.3 dependency-type: indirect dependency-group: uv - dependency-name: multidict dependency-version: 6.9.1 dependency-type: indirect dependency-group: uv - dependency-name: nbconvert dependency-version: 7.17.2 dependency-type: indirect dependency-group: uv - dependency-name: oauthlib dependency-version: 4.0.0 dependency-type: indirect dependency-group: uv - dependency-name: opentelemetry-api dependency-version: 1.45.1 dependency-type: indirect dependency-group: uv - dependency-name: virtualenv dependency-version: 21.15.1 dependency-type: indirect dependency-group: uv - dependency-name: werkzeug dependency-version: 3.1.9 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-10-28T08:30:33Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Oct 29, 2026 7:07am UTC

coderabbitai · 2026-10-28T08:30:40Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: groupthinking/EventRelay
Branch: main
File: .coderabbit.yaml
Commit: 0c99258
Layers: Repository YAML
Review profile: ASSERTIVE
Plan: Advanced
Run ID: e6550898-83d2-4340-979f-8dd7b948ee46

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-28T08:30:41Z

🔍 PR Validation

⚠️ Large PR detected (631 lines changed)

github-actions · 2026-10-28T08:36:18Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

uv.lock

Package	Version	License	Issue Type
ddtrace-internal	0.1.0	Null	Unknown License

Allowed Licenses:
MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, Python-2.0, BlueOak-1.0.0, MPL-2.0, CC0-1.0, 0BSD, MIT-CMU, Unlicense

Excluded from license check:
pkg:pypi/regex, pkg:pypi/torch, pkg:npm/caniuse-lite, pkg:npm/@sentry/nextjs, pkg:npm/@sentry/cli, pkg:npm/@sentry/cli-darwin, pkg:npm/@sentry/cli-linux-arm, pkg:npm/@sentry/cli-linux-arm64, pkg:npm/@sentry/cli-linux-i686, pkg:npm/@sentry/cli-linux-x64, pkg:npm/@sentry/cli-win32-arm64, pkg:npm/@sentry/cli-win32-i686, pkg:npm/@sentry/cli-win32-x64, pkg:npm/@sentry/bundler-plugin-core, pkg:npm/@sentry/babel-plugin-component-annotate, pkg:npm/@img/sharp-libvips-darwin-arm64, pkg:npm/@img/sharp-libvips-darwin-x64, pkg:npm/@img/sharp-libvips-linux-arm, pkg:npm/@img/sharp-libvips-linux-arm64, pkg:npm/@img/sharp-libvips-linux-ppc64, pkg:npm/@img/sharp-libvips-linux-riscv64, pkg:npm/@img/sharp-libvips-linux-s390x, pkg:npm/@img/sharp-libvips-linux-x64, pkg:npm/@img/sharp-libvips-linuxmusl-arm64, pkg:npm/@img/sharp-libvips-linuxmusl-x64, pkg:npm/@img/sharp-wasm32, pkg:npm/@img/sharp-win32-arm64, pkg:npm/@img/sharp-win32-ia32, pkg:npm/@img/sharp-win32-x64

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

pip/accelerate

1.15.0

🟢 6.7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 24/28 approved changesets -- score normalized to 8
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Packaging	🟢 10	packaging workflow detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
SAST	🟢 3	SAST tool is not run on all commits -- score normalized to 3

pip/aiohttp

3.14.4

Unknown

pip/black

26.10.1

Unknown

pip/brotli

1.2.1

🟢 7.7

Details

Check	Score	Reason
Token-Permissions	⚠️ -1	No tokens found
Maintained	🟢 10	30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	⚠️ -1	no workflows found
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Code-Review	⚠️ 2	Found 5/18 approved changesets -- score normalized to 2
Pinned-Dependencies	⚠️ -1	no dependencies found
CII-Best-Practices	⚠️ 2	badge detected: InProgress
Dependency-Update-Tool	🟢 10	update tool detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
License	🟢 10	license file detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 9	SAST tool is not run on all commits -- score normalized to 9
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
CI-Tests	🟢 10	20 out of 20 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 16 contributing companies or organizations

pip/ddtrace

4.15.6

Unknown

pip/ddtrace-internal

0.1.0

Unknown

pip/filelock

4.2.1

Unknown

pip/gitpython

3.2.1

Unknown

pip/jupyterlab

4.6.4

Unknown

pip/mako

1.4.2

Unknown

pip/msgpack

1.2.3

Unknown

pip/multidict

6.9.1

🟢 6.6

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 0/22 approved changesets -- score normalized to 0
Maintained	🟢 10	30 commit(s) and 26 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Fuzzing	🟢 10	project is fuzzed
Security-Policy	🟢 10	security policy file detected
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
Signed-Releases	🟢 8	5 out of the last 5 releases have a total of 5 signed artifacts.

pip/nbconvert

7.17.2

Unknown

pip/notebook

7.6.3

Unknown

pip/oauthlib

4.0.0

🟢 7.8

Details

Check	Score	Reason
Maintained	🟢 10	15 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 4	Found 4/9 approved changesets -- score normalized to 4
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ -1	internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `mistralai` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.
Branch-Protection	🟢 6	branch protection is not maximal on development and all release branches
Packaging	🟢 10	packaging workflow detected

pip/opentelemetry-api

1.45.1

Unknown

pip/opentelemetry-distro

0.66b1

Unknown

pip/opentelemetry-exporter-http-transport

0.66b1

Unknown

pip/opentelemetry-exporter-otlp

1.45.1

Unknown

pip/opentelemetry-exporter-otlp-common

0.66b1

Unknown

pip/opentelemetry-exporter-otlp-proto-common

1.45.1

Unknown

pip/opentelemetry-exporter-otlp-proto-grpc

1.45.1

Unknown

pip/opentelemetry-exporter-otlp-proto-http

1.45.1

Unknown

pip/opentelemetry-instrumentation

0.66b1

Unknown

pip/opentelemetry-proto

1.45.1

Unknown

pip/opentelemetry-sdk

1.45.1

Unknown

pip/opentelemetry-semantic-conventions

0.66b1

Unknown

pip/packaging

26.3

Unknown

pip/pyjwt

2.15.0

Unknown

pip/python-discovery

1.6.7

Unknown

pip/tornado

6.6

Unknown

pip/virtualenv

21.15.1

Unknown

pip/werkzeug

3.1.9

Unknown

pip/yarl

1.25.1

🟢 6.3

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 1/14 approved changesets -- score normalized to 0
Maintained	🟢 10	30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Security-Policy	🟢 10	security policy file detected
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
Signed-Releases	🟢 4	3 out of the last 5 releases have a total of 3 signed artifacts.

Scanned Files

uv.lock

## Current status — approved exact-head repair Head `85f1815ddb7ec121680d067d165e18eb40d90eda` targets `main` at merge commit `e010c9f3cec5ae72be16814d0841578ea9f8ded2`, after [#2487](#2487) merged at exact head `148cbf55fdce412255d2a61780459143521fa4c4`. The verified merge commit has the same tree as that head, so this PR's seven-file diff is unchanged. It adds complete npm lockfile coverage, preserves the scoped `uv.lock` classification, and combines both lock types into one manual snapshot so GitHub's pinned review action can compare the full base and head graphs. The controlled [#2501](#2501) test passed on an exact four-file dependency update. This has **not** yet produced a passing dependency comparison against the current `main` or cleared the original review queue. The exact-head [dependency review run 40760369080](https://github.com/groupthinking/EventRelay/actions/runs/40760369080) succeeded through its **code-only no-delta** path: the full-tree and combined lock submissions were correctly skipped because this PR changes workflow code and tests, not dependency inputs. Before the automatic base retarget, all 30 hosted checks at this same code head finished: **27 successful, 3 skipped, zero failed or pending**. The retarget did not run a new dependency comparison. A green no-delta check does not substitute for the controlled #2501 dependency test or a postmerge real PR test. A description-only edit may rerun metadata checks. ## Canonical issue Fixes #2505 on merge under the repository's issue-link rule. Parent #2490 stays open until a repaired `main` snapshot and a refreshed real dependency PR pass the full comparison. #2487 merged at the approved head, and GitHub automatically retargeted this draft to `main` at `e010c9f3cec5ae72be16814d0841578ea9f8ded2`. The head and seven-file diff remain unchanged. Hayden approved marking this exact head ready and merging it. Main-based dependency comparison remains a required postmerge verification. ## Changes - Remove focused one-ecosystem snapshot staging from `.github/workflows/dependency-review.yml`. Submit the same full-tree component-detection scan on `main` pushes and same-repository dependency PR heads at the exact commit SHA and ref. Keep the verified upstream component-detection v0.2.0 pin from #2397 and the existing severity, license and advisory policy. - Treat Dependabot configuration changes as configuration, and compare a PR head to its merge base when detecting new dependency inputs. A stale branch cannot turn a change made only on `main` into a dependency update in that PR. Real changed manifests and locks remain subject to review. - Include **every distinct name/version** from the tracked npm lockfiles, including nested second versions that component detection can omit. Group duplicate installed paths with runtime scope if any path is runtime. Submit those npm manifests and the scoped root `uv.lock` manifest in **one** manual snapshot after the full-tree scan. The scoped uv manifest treats packages reached only through `dev` or `docs` as development. The evidence recorder rejects missing, extra, wrong-manifest, wrong-version or wrong-scope rows against the exact changed lockfiles. - Increase the bounded per-file Python `PipReport` scan from 120 to 240 seconds and the job window to 30 minutes after an observed timeout produced unrelated requirements-file removals. A timeout still falls back to declared dependencies and can omit transitive packages; the guard rejects unrelated graph drift. Keep the 600-second snapshot-warning retry and warning rejection. - Add regression coverage for workflow selection, stale branches, npm nested versions and duplicate scope, combined one-request submission, scoped uv reachability, and exact evidence validation. ## Changed paths - `.github/workflows/dependency-review.yml` - `scripts/ci/record_dependency_review.py` - `scripts/ci/submit_npm_lock_snapshot.py` - `scripts/ci/submit_uv_lock_snapshot.py` - `tests/unit/test_dependency_review_workflow.py` - `tests/unit/test_submit_npm_lock_snapshot.py` - `tests/unit/test_submit_uv_lock_snapshot.py` ## Validation - Focused workflow, recorder, npm and uv snapshot suite: `uv run --no-project --with pytest --with pyyaml python -m pytest -q -o addopts='' tests/unit/test_submit_npm_lock_snapshot.py tests/unit/test_submit_uv_lock_snapshot.py tests/unit/test_dependency_review_workflow.py` — **31 passed in 3.10s** at the source head. `uv run --no-project --with ruff ruff check` and `ruff format --check` on those affected Python files, plus `git diff --check`, passed. - Controlled uv [#2499](#2499) used the exact `uv.lock` delta from original #2486 on matching off-main branches. Final [hosted run 40738274345, attempt 2](https://github.com/groupthinking/EventRelay/actions/runs/40738274345) passed policy, recorder and upload with **65 exact rows** (34 additions, 31 removals), correct package names, versions, manifests and development scopes, and no reported vulnerabilities. `ddtrace-internal` had unknown license metadata. The first attempt raced the base snapshot; the unchanged rerun passed. #2499 was closed unmerged. - Earlier controlled [#2500](#2500) used original #2355's exact two npm lockfile changes and exposed a **10/12 coverage gap** in component detection: nested development `brace-expansion` 2.1.4→2.1.7 was missing. Independent local npm audits of both lockfiles found no new advisory and fewer findings after the update (fetch 18→14; SDK 10→9). That green hosted check was insufficient; #2500 was closed unmerged. - Final controlled [#2501](#2501) used the exact four-file #2355 patch between base `eb6e556ef9eb8df80250613291c73abfb59b9f0e` and head `050f211b9715918f52c488a912d3ae797e76d68e`. [Base run 40759330706](https://github.com/groupthinking/EventRelay/actions/runs/40759330706) submitted the full-tree and combined lock snapshots; [head run 40759346059](https://github.com/groupthinking/EventRelay/actions/runs/40759346059) passed policy, recorder and upload. Its artifact and independent GitHub comparison contain **all 12 exact lock changes**, only from the two changed npm locks, with the nested `brace-expansion` row, correct scopes, zero added vulnerabilities, and added licenses MIT or BSD-3-Clause. GitHub's comparison with the review action's `per_page=5` request is also warning free. #2501 was closed unmerged; its temporary refs were deleted. - The final #2501 success followed two diagnosed issues: an unchanged Python requirements file generated 83 false removals after a 120-second fallback, and the pinned review action's five-item API page returned a **0-base/3-head** warning when full-tree, uv and npm were submitted separately (six snapshots across both sides). The same comparison with a larger page was warning free and had the correct 12 rows. Combining uv and npm manifests leaves two submissions per side and yielded the passing hosted result. Earlier #2493–#2496 diagnostics documented the initial main snapshot mismatch, the upstream manifest mapping update and scope validation; those results remain historical evidence, not a main-based pass. ## Remaining gates - [x] #2487 merged at its approved head; this draft automatically retargeted to `main`, and its unchanged seven-file diff was reviewed. - [x] Complete npm lock coverage and correct uv scope demonstrated in controlled hosted canaries, with the five-item review comparison warning free on #2501. - [x] Exact-head #2492 code-only dependency check and other hosted checks passed or skipped before the base retarget (27 successful, 3 skipped). This does not prove a main-based dependency update comparison. - [x] Hayden approved marking exact head `85f1815ddb7ec121680d067d165e18eb40d90eda` ready and merging #2492 after review of the main snapshot uncertainty. - [ ] After the merge, confirm the new `main` full-tree and combined lock submission, refresh one original manifest-changing PR onto that main, and require a warning-free hosted policy verdict plus complete artifact matching its actual dependency files. Then refresh and recheck the remaining original dependency PRs. Do not claim the original 21 dependency failures are resolved until this passes. - [ ] Resolve any outstanding review findings and merge decisions for the original PRs independently of this shared repair.

groupthinking

I reviewed exact head bd7172e5bf2bfacc0ed969e87c9b46ebd1cacee0 on the repaired main. The PR changes only uv.lock: the 16 grouped updates resolve to 34 changed package names. The current dependency-review artifact has a warning-free 65-row comparison that matches fresh GitHub dependency-graph readback, with 11 added and 11 removed development-scoped rows and no newly added vulnerability entries. Current hosted checks are 26 successful and 3 skipped, including Python 3.11/3.12 tests, dependency review, and the production web build. Prior locked Python 3.11/3.12 compatibility tests and a local trace/metric smoke test passed. I approve this lockfile change at the current head.

ddtrace-internal 0.1.0 is a new runtime dependency with no license metadata in the artifact or current PyPI record; this approval does not certify its license. An external telemetry service was not exercised. The PR remains open and unmerged; any merge decision and release policy check are separate.

dependabot Bot requested a review from groupthinking as a code owner October 28, 2026 08:30

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 28, 2026

dependabot Bot mentioned this pull request Oct 28, 2026

fix: bump the uv group across 1 directory with 2 updates #2484

Closed

vercel Bot deployed to Preview October 28, 2026 08:31

View deployment

Merge branch 'main' into dependabot/uv/uv-27604d1789

bd7172e

vercel Bot deployed to Preview October 29, 2026 07:07

View deployment

groupthinking approved these changes Oct 29, 2026

View reviewed changes

Conversation

dependabot Bot commented on behalf of github Oct 28, 2026

4.15.6

Security Issues

4.15.5

Bug Fixes

4.15.4

Bug Fixes

4.15.3

Bug Fixes

4.15.2

Upgrade Notes

Bug Fixes

4.15.1

Bug Fixes

4.15.0

26.10.1

Highlights

Stable style

Preview style

Configuration

Version 26.10.1

Highlights

Stable style

Preview style

2.15.0

2.14.0

v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0>__

3.2.1

What's Changed

New Contributors

3.2.0 - Security

What's Changed

3.2.1

3.2.0

v1.2.1

SECURITY

[1.2.1] - 2026-10-21

SECURITY

4.2.1

Bug fixes

New Contributors

4.2.0

Bug fixes

Performance

4.1.2

Fixed

Fixed

v4.6.4

4.6.4

Security fixes

Bugs fixed

Uh oh!

vercel Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Oct 28, 2026

🔍 PR Validation

Uh oh!

github-actions Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

License Issues

uv.lock

OpenSSF Scorecard

Scanned Files

Uh oh!

groupthinking left a comment

Choose a reason for hiding this comment

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

`v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0>`__

vercel Bot commented Oct 28, 2026 •

edited

Loading

coderabbitai Bot commented Oct 28, 2026 •

edited

Loading

github-actions Bot commented Oct 28, 2026 •

edited

Loading