From 2acaeab20e6d90997210994dab5fae58dc915e55 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 4 Jul 2026 11:52:57 +0000 Subject: [PATCH 1/4] ci(deps): bump pandera from 0.32.0 to 0.32.1 in /constraints Bumps [pandera](https://github.com/pandera-dev/pandera) from 0.32.0 to 0.32.1. - [Release notes](https://github.com/pandera-dev/pandera/releases) - [Commits](https://github.com/pandera-dev/pandera/compare/v0.32.0...v0.32.1) --- updated-dependencies: - dependency-name: pandera dependency-version: 0.32.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- constraints/security.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/constraints/security.txt b/constraints/security.txt index 628cc4f72..c4b74d926 100644 --- a/constraints/security.txt +++ b/constraints/security.txt @@ -79,7 +79,7 @@ pydantic==2.13.4 pydantic-settings==2.14.2 # pandera: DataFrame validation, data quality and security -pandera==0.32.0 +pandera==0.32.1 # ============================================================================ # System packages - Known vulnerability fixes From 2fd008d7e8a873ea5f28d66651cd0f61a2bffd24 Mon Sep 17 00:00:00 2001 From: neuron7xLab <226363063+neuron7xLab@users.noreply.github.com> Date: Wed, 8 Jul 2026 06:54:18 +0300 Subject: [PATCH 2/4] fix(deps): relock after pandera 0.32.1 constraint bump MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Regenerate requirements.lock, requirements-dev.lock, and requirements-scan.lock using each file's own recorded pip-compile header command, so the pandera==0.32.1 pin in constraints/security.txt (bumped by dependabot in this PR) no longer contradicts the stale pandera==0.32.0 pin baked into the locks. Fixes the D8 constraint/lock-divergence gate (constraints-lock-sync), which correctly caught the drift and fail-closed. requirements-dev.lock also picks up unrelated transitive churn from pyproject.toml dev-extra additions that predate this PR (cyclonedx-bom, jsonschema[format-nongpl], etc.) since the lock was stale independent of pandera. The two manually-pinned entries that pip-compile cannot auto-emit from pyproject.toml alone (pot, from the neuro_advanced extra; pytest-timeout, declared only in requirements-dev.txt) are re-added at their prior pinned versions (both still latest on PyPI), preserving the precedent set in commit 364e5388 (#1311). Verified: tools/deps/validate_dependency_truth.py --exit-on-drift now reports zero D8 drift (was 3, all pandera). D1 (5) and D6 (1) are unchanged pre-existing noise, confirmed via before/after diff. `pip install --dry-run -c constraints/security.txt -r ` resolves cleanly for all three locks with no ResolutionImpossible. Do NOT use `make deps-update` — its recipe is drifted (wrong input files, --strip-extras mismatch) and will corrupt the lock package set. Co-Authored-By: Claude Sonnet 5 --- requirements-dev.lock | 65 +++++++++++++++++++++++++++++++++++++++--- requirements-scan.lock | 2 +- requirements.lock | 2 +- 3 files changed, 63 insertions(+), 6 deletions(-) diff --git a/requirements-dev.lock b/requirements-dev.lock index ae6b9b803..bf23bcfee 100644 --- a/requirements-dev.lock +++ b/requirements-dev.lock @@ -38,6 +38,8 @@ anyio==4.11.0 # via # httpx # starlette +arrow==1.4.0 + # via isoduration async-timeout==5.0.1 # via aiokafka attrs==25.4.0 @@ -55,6 +57,8 @@ black==26.3.1 # via geosync (pyproject.toml) blinker==1.9.0 # via streamlit +boolean-py==5.0 + # via license-expression bracex==2.6 # via cibuildwheel build==1.3.0 @@ -80,6 +84,8 @@ cffi==2.0.0 # via # cryptography # pycares +chardet==5.2.0 + # via cyclonedx-bom charset-normalizer==3.4.4 # via # -c constraints/security.txt @@ -118,8 +124,14 @@ cuda-pathfinder==1.5.2 # via cuda-bindings cuda-toolkit[cublas,cudart,cufft,cufile,cupti,curand,cusolver,cusparse,nvjitlink,nvrtc,nvtx]==13.0.2 # via torch +cyclonedx-bom==7.3.0 + # via geosync (pyproject.toml) +cyclonedx-python-lib[validation]==11.11.0 + # via cyclonedx-bom deap==1.4.3 # via geosync (pyproject.toml) +defusedxml==0.7.1 + # via py-serializable dependency-groups==1.3.1 # via cibuildwheel docutils==0.22.2 @@ -141,6 +153,8 @@ filelock==3.20.3 # torch flake8==7.1.1 # via geosync (pyproject.toml) +fqdn==1.5.1 + # via jsonschema frozenlist==1.8.0 # via # aiohttp @@ -190,6 +204,7 @@ idna==3.18 # -c constraints/security.txt # anyio # httpx + # jsonschema # requests # yarl import-linter==2.11 @@ -198,6 +213,8 @@ importlib-metadata==8.7.0 # via opentelemetry-api iniconfig==2.1.0 # via pytest +isoduration==20.11.0 + # via jsonschema isort==5.13.2 # via geosync (pyproject.toml) jaraco-classes==3.4.0 @@ -230,22 +247,33 @@ joblib==1.5.2 # via # geosync (pyproject.toml) # scikit-learn -jsonschema==4.25.1 - # via altair +jsonpointer==3.1.1 + # via jsonschema +jsonschema[format-nongpl]==4.25.1 + # via + # altair + # cyclonedx-python-lib + # geosync (pyproject.toml) jsonschema-specifications==2025.9.1 # via jsonschema keyring==25.6.0 # via twine korean-lunar-calendar==0.3.1 # via exchange-calendars +lark==1.3.1 + # via rfc3987-syntax libcst==1.7.0 # via mutmut librt==0.9.0 # via mypy +license-expression==30.4.4 + # via cyclonedx-python-lib linkify-it-py==2.0.3 # via markdown-it-py llvmlite==0.46.0 # via numba +lxml==6.1.1 + # via cyclonedx-python-lib mako==1.3.12 # via # -c constraints/security.txt @@ -392,6 +420,10 @@ opt-einsum==3.4.0 # via jax optuna==3.6.2 # via geosync (pyproject.toml) +packageurl-python==0.17.6 + # via + # cyclonedx-bom + # cyclonedx-python-lib packaging==25.0 # via # aiokafka @@ -399,10 +431,12 @@ packaging==25.0 # black # build # cibuildwheel + # cyclonedx-bom # dependency-groups # hydra-core # optuna # pandera + # pip-requirements-parser # pytest # pytest-rerunfailures # strawberry-graphql @@ -414,7 +448,7 @@ pandas==2.3.3 # exchange-calendars # geosync (pyproject.toml) # streamlit -pandera==0.32.0 +pandera==0.32.1 # via # -c constraints/security.txt # geosync (pyproject.toml) @@ -429,6 +463,8 @@ pillow==12.2.0 # -c constraints/security.txt # captcha # streamlit +pip-requirements-parser==32.0.1 + # via cyclonedx-bom pip-tools==7.5.1 # via geosync (pyproject.toml) platformdirs==4.5.0 @@ -466,6 +502,8 @@ psycopg-binary==3.2.11 # via psycopg py-cpuinfo==9.0.0 # via pytest-benchmark +py-serializable==2.1.0 + # via cyclonedx-python-lib py-spy==0.4.1 # via geosync (pyproject.toml) pyarrow==24.0.0 @@ -514,6 +552,8 @@ pyjwt[crypto]==2.13.0 # streamlit-authenticator pyluach==2.3.0 # via exchange-calendars +pyparsing==3.3.2 + # via pip-requirements-parser pyproject-hooks==1.2.0 # via # build @@ -553,6 +593,7 @@ pytest-xdist==3.8.0 # via geosync (pyproject.toml) python-dateutil==2.9.0.post0 # via + # arrow # pandas # strawberry-graphql python-dotenv==1.2.2 @@ -580,6 +621,7 @@ redis==7.0.0 # via geosync (pyproject.toml) referencing==0.37.0 # via + # cyclonedx-python-lib # jsonschema # jsonschema-specifications requests==2.34.2 @@ -594,8 +636,14 @@ requests==2.34.2 # twine requests-toolbelt==1.0.0 # via twine +rfc3339-validator==0.1.4 + # via jsonschema rfc3986==2.0.0 # via twine +rfc3986-validator==0.1.1 + # via jsonschema +rfc3987-syntax==1.1.0 + # via jsonschema rich==14.2.0 # via # bandit @@ -630,12 +678,15 @@ six==1.17.0 # via # pytest-profiling # python-dateutil + # rfc3339-validator smmap==5.0.2 # via gitdb sniffio==1.3.1 # via anyio sortedcontainers==2.4.0 - # via hypothesis + # via + # cyclonedx-python-lib + # hypothesis sqlalchemy==2.0.51 # via # -c constraints/security.txt @@ -703,6 +754,7 @@ typing-extensions==4.15.0 # anyio # ccxt # cross-web + # cyclonedx-python-lib # fastapi # grimp # grpcio @@ -737,10 +789,13 @@ typing-inspection==0.4.2 # pydantic-settings tzdata==2025.2 # via + # arrow # exchange-calendars # pandas uc-micro-py==1.0.3 # via linkify-it-py +uri-template==1.3.0 + # via jsonschema urllib3==2.7.0 # via # -c constraints/security.txt @@ -750,6 +805,8 @@ uvicorn==0.49.0 # via geosync (pyproject.toml) watchdog==6.0.0 # via streamlit +webcolors==25.10.0 + # via jsonschema websockets==15.0.1 # via geosync (pyproject.toml) wheel==0.47.0 diff --git a/requirements-scan.lock b/requirements-scan.lock index b886455d5..c2482d246 100644 --- a/requirements-scan.lock +++ b/requirements-scan.lock @@ -73,7 +73,7 @@ opentelemetry-semantic-conventions==0.59b0 optuna==3.6.2 packaging==25.0 pandas==2.3.3 -pandera==0.32.0 +pandera==0.32.1 pillow==12.2.0 prometheus-client==0.25.0 propcache==0.4.1 diff --git a/requirements.lock b/requirements.lock index 7943b4de1..df211b67c 100644 --- a/requirements.lock +++ b/requirements.lock @@ -306,7 +306,7 @@ pandas==2.3.3 # exchange-calendars # geosync (pyproject.toml) # streamlit -pandera==0.32.0 +pandera==0.32.1 # via # -c constraints/security.txt # geosync (pyproject.toml) From 53d190e86b112e1ea1969e8be60fff567f92e203 Mon Sep 17 00:00:00 2001 From: neuron7xLab <226363063+neuron7xLab@users.noreply.github.com> Date: Wed, 8 Jul 2026 11:27:40 +0300 Subject: [PATCH 3/4] fix(deps): raise pandera scan floor to >=0.32.1 and relock scan lock --- requirements-scan.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements-scan.txt b/requirements-scan.txt index ce8a5313c..062672707 100644 --- a/requirements-scan.txt +++ b/requirements-scan.txt @@ -19,7 +19,7 @@ numba>=0.60.0 # Data validation pydantic>=2.13.4,<3.0.0 pydantic-settings>=2.14.2,<3.0.0 -pandera>=0.32.0,<1.0.0 +pandera>=0.32.1,<1.0.0 exchange-calendars>=4.11.1 # Configuration & instrumentation From 1c400fc9833205f283013a89dc71c5bfe33ef802 Mon Sep 17 00:00:00 2001 From: neuron7xLab <226363063+neuron7xLab@users.noreply.github.com> Date: Wed, 8 Jul 2026 11:41:10 +0300 Subject: [PATCH 4/4] fix(deps): re-relock after merging main (fastapi/pillow bumps landed) --- requirements-dev.lock | 4 ---- requirements-scan.lock | 2 +- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/requirements-dev.lock b/requirements-dev.lock index c0403fcae..c40b703f2 100644 --- a/requirements-dev.lock +++ b/requirements-dev.lock @@ -478,10 +478,6 @@ pluggy==1.6.0 # pytest-cov pot==0.9.6.post1 # via geosync (pyproject.toml) — neuro_advanced optional group; pinned here - # so the shared dev install (setup-geosync / fast-shard) can collect+run - # tests/research_lines/test_ricci_microstructure_v1.py, which imports the - # POT-backed Ollivier-Ricci kernel. NOT auto-emitted by `pip-compile` - # (optional extra); re-add after a relock. Floor: pyproject POT>=0.9.5. prometheus-client==0.25.0 # via geosync (pyproject.toml) propcache==0.4.1 diff --git a/requirements-scan.lock b/requirements-scan.lock index c2482d246..a7e44f197 100644 --- a/requirements-scan.lock +++ b/requirements-scan.lock @@ -74,7 +74,7 @@ optuna==3.6.2 packaging==25.0 pandas==2.3.3 pandera==0.32.1 -pillow==12.2.0 +pillow==12.3.0 prometheus-client==0.25.0 propcache==0.4.1 protobuf==6.33.5