build(deps): bump types-pyyaml from 6.0.12.20260510 to 6.0.12.20260518

[dependabot]

Bumps types-pyyaml from 6.0.12.20260510 to 6.0.12.20260518.

Commits

• See full diff in compare view

---

Note

Low Risk
Lockfile-only dev typing stub bump with no production code or behavior changes.

Overview
Bumps the optional dev typing stub package types-pyyaml from 6.0.12.20260510 to 6.0.12.20260518 in pyproject.toml and refreshes poetry.lock (including the lock content-hash). No application or runtime dependency changes—only mypy/type-checking stubs for PyYAML.

^{Reviewed by Cursor Bugbot for commit 704a28d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

Investigating the dependency update and malware scan findings for this types-pyyaml bump.
Verdict: benign

Summary: This is a routine typeshed stub refresh with no signs of compromise. The malware scanner’s two heuristic warnings are false positives for this package class.

Evidence by category

Check	Result
Classic obfuscation / runtime behavior	types-pyyaml is stubs-only (Typing :: Stubs Only on PyPI). No executable code, install hooks, network calls, or new transitive dependencies (requires_dist: null).
Unicode / GlassWorm	Scanner: 0 unicode, 0 confusable, 0 IOC findings.
Dependency integrity	PR only bumps pyproject.toml and the types-pyyaml entry in poetry.lock. Wheel/sdist SHA256 hashes match PyPI 6.0.12.20260518. Publisher unchanged: typeshed_bot.
Upstream content	Typeshed change between releases is formatting-only (blank lines from black 26.5.0) plus one stub line in _yaml.pyi — normal maintenance, not payload-like behavior.

Scanner findings (disagree on severity)

1. ghost_version_or_missing_tag — Expected for typeshed packages. Versions use date suffixes (6.0.12.20260518), not git tags. The release exists on PyPI and is not yanked.
2. maintainer_drift (npm-maintainers) — False positive: npm-oriented heuristic applied to a Python stub package with a stable PyPI owner.

Action: Safe to merge from a supply-chain perspective. Optional sanity check: run mypy in CI/dev — stub-only changes could theoretically affect type-check results, but that is a typing concern, not a security one.

Compatibility Analysis

Gathering dependency usage, upstream type-stub changes, and compatibility signals for this bump.

Compatibility & adoption analysis — types-pyyaml 6.0.12.20260510 → 6.0.12.20260518

1) Where it appears / is used

Layer	Location
Dependency declaration	pyproject.toml — optional dev extra (types-pyyaml >= 6.0.12.20260518); locked in poetry.lock
Runtime PyYAML	Separate pin: pyyaml >= 6.0.2 (actual library, not this stub package)
Type-checking	Pulled in only with [dev] extras for mypy

Code that imports yaml (stub-relevant, all use high-level APIs):

• chia/util/config.py — yaml.safe_load, yaml.safe_dump
• chia/util/file_keyring.py — yaml.safe_load, yaml.safe_dump
• chia/util/virtual_project_analysis.py — yaml.safe_load
• chia/data_layer/util/plugin.py, chia/data_layer/s3_plugin_service.py — yaml.safe_load, yaml.safe_dump
• chia/cmds/{init_funcs,configure,dump_keyring,dev/gh}.py — yaml.safe_load, yaml.safe_dump, yaml.dump
• Tests: chia/_tests/core/util/test_config.py, chia/_tests/tools/test_virtual_project.py

No direct use of yaml.constructor, custom loaders, add_constructor, etc.

---

2) Intersection with upstream changes

Upstream typeshed diff between these releases (.upstream-dependency, stubs/PyYAML/):

Commit	Date	Change
9f3a260bb — constructor type hints	May 9	Adds bool annotations to construct_object / construct_pairs — already in 20260510
5372bd5c9 — black 26.5.0	May 17	Formatting only: blank lines between overloads in yaml/__init__.pyi and yaml/_yaml.pyi

Overlap with Chia usage: None meaningful. Chia calls only safe_load / safe_dump / dump; the delta between versions is whitespace in stub files, not signature changes to those APIs.

---

3) Risks / unknowns

Risk	Severity
Runtime behavior	None — types-pyyaml is stubs-only; not shipped in production installs
Build / CI (mypy)	Very low — no semantic stub changes in this bump; unlikely to introduce new mypy errors
Malware scan heuristics	False positives — ghost_version_or_missing_tag (date-suffixed PyPI releases) and maintainer_drift (npm heuristic on a Python stub package)
Unknown	Whether CI mypy job has already run green on this PR (standard gate, not a blocker for merge given the diff)

---

4) Recommendation: merge

Routine typeshed stub refresh with formatting-only changes between the two versions. No intersection with Chia’s YAML usage patterns, no runtime impact, and no meaningful typing-risk surface. Safe to merge; optional confirmation is a green mypy CI check if not already present.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 0
• Resolution strategy: unresolved
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved refs: from=n/a to=n/a
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 2

Top findings

• types-pyyaml:0 ghost_version_or_missing_tag :: 6.0.12.20260518
• types-pyyaml:0 maintainer_drift :: 6.0.12.20260510->6.0.12.20260518

[coveralls-official]

Coverage Report for CI Build 26484009213

Coverage decreased (-0.03%) to 91.471%

Details

• Coverage decreased (-0.03%) from the base build.
• Patch coverage: No coverable lines changed in this PR.
• 43 coverage regressions across 5 files.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

43 previously-covered lines in 5 files lost coverage.

File	Lines Losing Coverage	Coverage
chia/_tests/core/util/test_lockfile.py	24	77.42%
chia/timelord/timelord.py	11	73.36%
chia/server/node_discovery.py	4	80.34%
chia/server/server.py	3	85.99%
chia/wallet/wallet_node.py	1	87.16%

---

Coverage Stats

Relevant Lines:	121996
Covered Lines:	111767
Line Coverage:	91.62%
Relevant Branches:	12032
Covered Branches:	10830
Branch Coverage:	90.01%
Branches in Coverage %:	Yes
Coverage Strength:	1.83 hits per line

---

💛 - Coveralls

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

Reviewing the dependency update: checking lockfile changes, upstream typeshed diff, and malware scanner findings.
Verdict: benign

Summary: Routine typeshed stub refresh with no malware indicators. Safe to merge from a supply-chain perspective.

Evidence by checklist

Category	Result
Classic obfuscation	Not applicable. types-pyyaml ships only .pyi typing stubs (no runtime code, no install scripts, no network/process behavior).
Invisible Unicode / GlassWorm	Scanner: 0 unicode, confusable, and IOC findings.
Dependency integrity	Single direct dev dependency bump in pyproject.toml and poetry.lock only. No new transitive deps. Version step 6.0.12.20260510 → 6.0.12.20260518 is an 8-day typeshed snapshot, not a semver jump. Lockfile hashes present and consistent (sha256:…).
Dependabot scope	Expected files only (pyproject.toml, poetry.lock). No .github/workflows/ or vendor/node_modules changes.

Upstream content (typeshed stubs/PyYAML/)

Between these versions, the only PyYAML stub change is commit 5372bd5c9 (“Upgrade black to 26.5.0”) — 12 blank-line formatting insertions in yaml/__init__.pyi and yaml/_yaml.pyi. No logic, imports, or API changes.

Scanner findings — false positives

The scanner reported warn with 2 heuristics, but they do not indicate compromise here:

1. ghost_version_or_missing_tag — Expected for typeshed packages. Versions use date suffixes (6.0.12.YYYYMMDD) published to PyPI from main; there is no per-release git tag with that name. The scanner could not resolve refs (resolution_strategy: unresolved, changed_files_count: 0).
2. maintainer_drift (npm-maintainers) — Misapplied heuristic. types-pyyaml is a PyPI package from python/typeshed, not npm.

Impact in this repo

types-pyyaml is an optional dev extra used for mypy typing of yaml imports (config, keyring, etc.). It does not affect production/runtime behavior.

Action: Approve. The scanner warnings can be ignored for this PR; consider allowlisting typeshed date-stamped stub packages in the scanner to reduce noise on future bumps.

Compatibility Analysis

Analyzing types-pyyaml usage and upstream changes between the two versions.

Compatibility & adoption analysis: types-pyyaml 6.0.12.20260510 → 6.0.12.20260518

1) Where it’s used

Layer	Location
Dependency declaration	pyproject.toml — optional dev dep (>=6.0.12.20260518), in [project.optional-dependencies] dev
Lockfile	poetry.lock — resolved to 6.0.12.20260518, extra == "dev" only
Type-checking	Pre-commit + CI mypy (manage-mypy.py, .pre-commit-config.yaml, .github/workflows/upload-pypi-source.yml)
Runtime yaml usage (typed via stubs, runs on pyyaml, not types-pyyaml)	11 files: chia/util/config.py, file_keyring.py, virtual_project_analysis.py, data_layer/util/plugin.py, data_layer/s3_plugin_service.py, cmds/configure.py, init_funcs.py, dump_keyring.py, cmds/dev/gh.py, plus tests

APIs actually called: yaml.safe_load, yaml.safe_dump, yaml.dump only. No use of BaseConstructor, custom loaders, or add_constructor / add_representer.

---

2) Intersection with upstream changes

Between the two releases, typeshed’s PyYAML stubs changed in two commits:

Commit	Change	Intersects chia usage?
#15746	construct_object / construct_pairs get deep: bool = False annotations in constructor.pyi	No — constructor APIs unused
#15801	Black 26.5.0 reformat (blank lines) in __init__.pyi, _yaml.pyi	No semantic change to safe_load / safe_dump / dump signatures

Chia’s usage sites do not overlap with the only substantive stub change.

---

3) Risks / unknowns

Risk	Severity
Runtime / production	None — types-pyyaml is dev-only; runtime uses pyyaml >= 6.0.2
Mypy regressions	Very low — no signature changes on APIs chia calls
Malware scan warnings (ghost_version_or_missing_tag, maintainer_drift)	Expected noise for typeshed dated PyPI releases; not a supply-chain signal
Unverified in this review	CI mypy green on the PR branch (standard sanity check)

---

4) Recommendation: merge

Routine typeshed snapshot bump with no meaningful API impact on chia’s YAML usage. Zero runtime exposure; type-check risk is negligible. Merge after CI (especially mypy) passes — no caveats beyond normal CI gate.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 0
• Resolution strategy: unresolved
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved refs: from=n/a to=n/a
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 2

Top findings

• types-pyyaml:0 ghost_version_or_missing_tag :: 6.0.12.20260518
• types-pyyaml:0 maintainer_drift :: 6.0.12.20260510->6.0.12.20260518

[dependabot]

Looks like types-pyyaml is up-to-date now, so this is no longer needed.