From c6d717f95c9da616e908bdd826a6311feba4021c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 4 Jul 2026 11:52:45 +0000 Subject: [PATCH 1/2] ci(deps): update pillow requirement in /constraints Updates the requirements on [pillow](https://github.com/python-pillow/Pillow) to permit the latest version. - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0) --- updated-dependencies: - dependency-name: pillow dependency-version: 12.3.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- constraints/security.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/constraints/security.txt b/constraints/security.txt index 628cc4f72..ea9b858e0 100644 --- a/constraints/security.txt +++ b/constraints/security.txt @@ -123,7 +123,7 @@ Brotli>=1.2.0 # Vulnerable: >= 10.3.0, < 12.2.0. Pillow enters the install tree via # scientific/ML extras (e.g. torchvision-adjacent paths). Pin the floor # here so transitive resolution cannot regress below the fix line. -pillow>=12.2.0 +pillow>=12.3.0 # Security floors — CVE remediation (pip-audit 2026-06-19). # tornado: GHSA-3x9g-8vmp-wqvf, GHSA-cx3h-4qpv-8hc9, GHSA-mgf9-4vpg-hj56, GHSA-pw6j-qg29-8w7f From c9314df8ad6091d525a9f1ba94ed00336ef6d292 Mon Sep 17 00:00:00 2001 From: neuron7xLab <226363063+neuron7xLab@users.noreply.github.com> Date: Wed, 8 Jul 2026 06:55:36 +0300 Subject: [PATCH 2/2] fix(deps): relock after pillow constraint bump Dependabot bumped pillow>=12.3.0 in constraints/security.txt but cannot regenerate the pip-compiled requirements*.lock files, leaving them at pillow==12.2.0. That contradiction makes `pip install -c constraints/security.txt -r requirements.lock` fail with ResolutionImpossible before any real CI job runs. Regenerated requirements.lock, requirements-dev.lock, and requirements-scan.lock by re-running each file's own recorded pip-compile header command verbatim (pip-tools==7.5.1, Python 3.12) -- NOT `make deps-update`, whose recipe reads the wrong input files and silently drops jax/jaxlib/ml-dtypes/opt-einsum (see prior incident PRs #775/#776). requirements-dev.lock also picked up unrelated transitive drift (cyclonedx-bom/jsonschema[format-nongpl] extras, arrow, etc.) because pyproject.toml's dev extra had moved on since the lock was last compiled; that churn is expected from a full pip-compile resolve and was left as-is. Restored the two manually-pinned lines that `pip-compile --extra=dev` cannot emit from pyproject.toml alone: pot==0.9.6.post1 (neuro_advanced extra, required by tests/research_lines/test_ricci_microstructure_v1.py) and pytest-timeout==2.4.0 (requirements-dev.txt, required by `make l2-test` / the l2-demo-gate CI job's --timeout=60 flag). Dropping either would have broken those suites the same way the broken deps-update recipe drops packages. Verified: `pip install -c constraints/security.txt -r requirements.lock` now succeeds end-to-end (previously reproduced ResolutionImpossible against the stale lock). tools/deps/validate_dependency_truth.py reports 0 D8 drifts and unchanged D1/D6 counts (5/1, pre-existing, unrelated to this change). Co-Authored-By: Claude Sonnet 5 --- requirements-dev.lock | 65 +++++++++++++++++++++++++++++++++++++++--- requirements-scan.lock | 2 +- requirements.lock | 2 +- 3 files changed, 63 insertions(+), 6 deletions(-) diff --git a/requirements-dev.lock b/requirements-dev.lock index ae6b9b803..74d2be079 100644 --- a/requirements-dev.lock +++ b/requirements-dev.lock @@ -38,6 +38,8 @@ anyio==4.11.0 # via # httpx # starlette +arrow==1.4.0 + # via isoduration async-timeout==5.0.1 # via aiokafka attrs==25.4.0 @@ -55,6 +57,8 @@ black==26.3.1 # via geosync (pyproject.toml) blinker==1.9.0 # via streamlit +boolean-py==5.0 + # via license-expression bracex==2.6 # via cibuildwheel build==1.3.0 @@ -80,6 +84,8 @@ cffi==2.0.0 # via # cryptography # pycares +chardet==5.2.0 + # via cyclonedx-bom charset-normalizer==3.4.4 # via # -c constraints/security.txt @@ -118,8 +124,14 @@ cuda-pathfinder==1.5.2 # via cuda-bindings cuda-toolkit[cublas,cudart,cufft,cufile,cupti,curand,cusolver,cusparse,nvjitlink,nvrtc,nvtx]==13.0.2 # via torch +cyclonedx-bom==7.3.0 + # via geosync (pyproject.toml) +cyclonedx-python-lib[validation]==11.11.0 + # via cyclonedx-bom deap==1.4.3 # via geosync (pyproject.toml) +defusedxml==0.7.1 + # via py-serializable dependency-groups==1.3.1 # via cibuildwheel docutils==0.22.2 @@ -141,6 +153,8 @@ filelock==3.20.3 # torch flake8==7.1.1 # via geosync (pyproject.toml) +fqdn==1.5.1 + # via jsonschema frozenlist==1.8.0 # via # aiohttp @@ -190,6 +204,7 @@ idna==3.18 # -c constraints/security.txt # anyio # httpx + # jsonschema # requests # yarl import-linter==2.11 @@ -198,6 +213,8 @@ importlib-metadata==8.7.0 # via opentelemetry-api iniconfig==2.1.0 # via pytest +isoduration==20.11.0 + # via jsonschema isort==5.13.2 # via geosync (pyproject.toml) jaraco-classes==3.4.0 @@ -230,22 +247,33 @@ joblib==1.5.2 # via # geosync (pyproject.toml) # scikit-learn -jsonschema==4.25.1 - # via altair +jsonpointer==3.1.1 + # via jsonschema +jsonschema[format-nongpl]==4.25.1 + # via + # altair + # cyclonedx-python-lib + # geosync (pyproject.toml) jsonschema-specifications==2025.9.1 # via jsonschema keyring==25.6.0 # via twine korean-lunar-calendar==0.3.1 # via exchange-calendars +lark==1.3.1 + # via rfc3987-syntax libcst==1.7.0 # via mutmut librt==0.9.0 # via mypy +license-expression==30.4.4 + # via cyclonedx-python-lib linkify-it-py==2.0.3 # via markdown-it-py llvmlite==0.46.0 # via numba +lxml==6.1.1 + # via cyclonedx-python-lib mako==1.3.12 # via # -c constraints/security.txt @@ -392,6 +420,10 @@ opt-einsum==3.4.0 # via jax optuna==3.6.2 # via geosync (pyproject.toml) +packageurl-python==0.17.6 + # via + # cyclonedx-bom + # cyclonedx-python-lib packaging==25.0 # via # aiokafka @@ -399,10 +431,12 @@ packaging==25.0 # black # build # cibuildwheel + # cyclonedx-bom # dependency-groups # hydra-core # optuna # pandera + # pip-requirements-parser # pytest # pytest-rerunfailures # strawberry-graphql @@ -424,11 +458,13 @@ pathspec==1.0.0 # via # black # mypy -pillow==12.2.0 +pillow==12.3.0 # via # -c constraints/security.txt # captcha # streamlit +pip-requirements-parser==32.0.1 + # via cyclonedx-bom pip-tools==7.5.1 # via geosync (pyproject.toml) platformdirs==4.5.0 @@ -466,6 +502,8 @@ psycopg-binary==3.2.11 # via psycopg py-cpuinfo==9.0.0 # via pytest-benchmark +py-serializable==2.1.0 + # via cyclonedx-python-lib py-spy==0.4.1 # via geosync (pyproject.toml) pyarrow==24.0.0 @@ -514,6 +552,8 @@ pyjwt[crypto]==2.13.0 # streamlit-authenticator pyluach==2.3.0 # via exchange-calendars +pyparsing==3.3.2 + # via pip-requirements-parser pyproject-hooks==1.2.0 # via # build @@ -553,6 +593,7 @@ pytest-xdist==3.8.0 # via geosync (pyproject.toml) python-dateutil==2.9.0.post0 # via + # arrow # pandas # strawberry-graphql python-dotenv==1.2.2 @@ -580,6 +621,7 @@ redis==7.0.0 # via geosync (pyproject.toml) referencing==0.37.0 # via + # cyclonedx-python-lib # jsonschema # jsonschema-specifications requests==2.34.2 @@ -594,8 +636,14 @@ requests==2.34.2 # twine requests-toolbelt==1.0.0 # via twine +rfc3339-validator==0.1.4 + # via jsonschema rfc3986==2.0.0 # via twine +rfc3986-validator==0.1.1 + # via jsonschema +rfc3987-syntax==1.1.0 + # via jsonschema rich==14.2.0 # via # bandit @@ -630,12 +678,15 @@ six==1.17.0 # via # pytest-profiling # python-dateutil + # rfc3339-validator smmap==5.0.2 # via gitdb sniffio==1.3.1 # via anyio sortedcontainers==2.4.0 - # via hypothesis + # via + # cyclonedx-python-lib + # hypothesis sqlalchemy==2.0.51 # via # -c constraints/security.txt @@ -703,6 +754,7 @@ typing-extensions==4.15.0 # anyio # ccxt # cross-web + # cyclonedx-python-lib # fastapi # grimp # grpcio @@ -737,10 +789,13 @@ typing-inspection==0.4.2 # pydantic-settings tzdata==2025.2 # via + # arrow # exchange-calendars # pandas uc-micro-py==1.0.3 # via linkify-it-py +uri-template==1.3.0 + # via jsonschema urllib3==2.7.0 # via # -c constraints/security.txt @@ -750,6 +805,8 @@ uvicorn==0.49.0 # via geosync (pyproject.toml) watchdog==6.0.0 # via streamlit +webcolors==25.10.0 + # via jsonschema websockets==15.0.1 # via geosync (pyproject.toml) wheel==0.47.0 diff --git a/requirements-scan.lock b/requirements-scan.lock index b886455d5..cb065b169 100644 --- a/requirements-scan.lock +++ b/requirements-scan.lock @@ -74,7 +74,7 @@ optuna==3.6.2 packaging==25.0 pandas==2.3.3 pandera==0.32.0 -pillow==12.2.0 +pillow==12.3.0 prometheus-client==0.25.0 propcache==0.4.1 protobuf==6.33.5 diff --git a/requirements.lock b/requirements.lock index 7943b4de1..ffd324649 100644 --- a/requirements.lock +++ b/requirements.lock @@ -310,7 +310,7 @@ pandera==0.32.0 # via # -c constraints/security.txt # geosync (pyproject.toml) -pillow==12.2.0 +pillow==12.3.0 # via # -c constraints/security.txt # captcha