Repository navigation
chore(deps): resolve open dependabot security alerts - #1050
Merged
Abhijeet Prasad (AbhiPrasad) merged 2 commits intoNov 2, 2026
Merged
Conversation
> 🤖 **This text was AI-generated.** Bump vulnerable pins in the main lockfile and the deprecated integration lockfiles: ```text ddtrace 4.12.0 -> 4.15.6 mcp 1.28.1 -> 1.30.0 (test-mcp-v1 constraint) litellm 1.88.6 / 1.106.4 -> 1.103.10 (test-crewai, lint) pyasn1 0.6.4 -> 0.6.5 (adk-py) joserfc 1.6.8 -> 1.7.7 (adk-py) langgraph / langgraph-sdk -> 1.2.19 / 0.4.11 (langchain-py) ``` LiteLLM 1.104+ caps filelock<4, and releases before 1.100.4 carry GHSA-7hp6-4w63-5g45, so pin 1.103.10. That lets Python 3.11+ resolve patched filelock 4.2.x. Patched LiteLLM requires pydantic-settings>=2.14.1, which conflicts with CrewAI 1.13.0's pydantic-settings~=2.10.1. Skip the locked LiteLLM install for that version; its LiteLLM smoke test now skips when LiteLLM is absent and the event-bus tests still run. Filelock on Python 3.10 has no patched release (4.2.1+ requires 3.11). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
The lint group pinned opentelemetry 1.45.1 and langsmith 0.8.18 while the rest of the lockfile resolves 1.45.2 and 0.14.17. Align them so uv drops 13 duplicate package versions and the extra resolution forks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Abhijeet Prasad (AbhiPrasad)
deleted the
abhi/fix-dependabot-alerts-db2ad51f
branch
November 2, 2026 22:22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bump vulnerable pins in the main lockfile and the deprecated integration
lockfiles:
LiteLLM 1.104+ caps filelock<4, and releases before 1.100.4 carry
GHSA-7hp6-4w63-5g45, so pin 1.103.10. That lets Python 3.11+ resolve
patched filelock 4.2.x.
Patched LiteLLM requires pydantic-settings>=2.14.1, which conflicts with
CrewAI 1.13.0's pydantic-settings~=2.10.1. Skip the locked LiteLLM install
for that version; its LiteLLM smoke test now skips when LiteLLM is absent
and the event-bus tests still run.
Filelock on Python 3.10 has no patched release (4.2.1+ requires 3.11). The
matching alerts were dismissed as tolerable risk; the 3.10 copy comes only
from test and dev tooling.
Also align two lagging
lintpins with the versions the rest of thelockfile already resolves, which drops 13 duplicate package versions:
Most of the
py/uv.lockdeletions are uv resolution forks collapsing, notpackage removals. Dropping the duplicate LiteLLM, filelock, OpenTelemetry,
and langsmith versions cuts the per-package fork markers from 5,456 lines
to 754. The package set otherwise only changes for the bumps above, plus
the new
ddtrace-internaldependency.Validated:
test_openai_ddtrace,test_claude_agent_sdk(0.1.18),test_agentscope(1.0.0),test_crewai(latest),test_crewai(1.13.0),pylint(rerun after the lint pin alignment), and the langchain-py tests.🤖 Generated with Claude Code