build(deps-dev): update pyright requirement from <2.0.0,>=1.1.392 to >=1.1.411,<2.0.0 - #1
Open
dependabot[bot] wants to merge 23 commits into
Open
build(deps-dev): update pyright requirement from <2.0.0,>=1.1.392 to >=1.1.411,<2.0.0#1dependabot[bot] wants to merge 23 commits into
dependabot[bot] wants to merge 23 commits into
Conversation
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Add the container runner submodule at src/modules/rest.mdm-sn-container-runner pointing to RedTeamSubnet/rest.hb-bot-executer. Remove the empty __init__.py that conflicts with the submodule directory.
Enable setuptools package discovery under src/ for bv_challenge. Fix version attr to reference __version__ directly and dependencies file to list format. Update all project URLs from challenge-template to bot-virus-challenge.
Change VERSION_FILE_PATH from VERSION.txt to bv_challenge.__version__.py. bump-version.sh now writes '__version__ = "x.y.z"' format. get-version.sh now parses Python __version__ assignment instead of raw text.
Add src/bot/ package with Selenium-based WebUI automation: - main.py: entrypoint with config loading, internet check, session loop - core/bot.py: automation logic with failed-challenge detection - driver.py: Chromium driver setup with stealth options - constants.py: environment-based configuration - Dockerfile + Dockerfile.base: multi-stage container builds - compose.yml: standalone bot compose stack - Scripts: build-base.sh, build.sh, docker-entrypoint.sh, run.sh
Add bot-runner service that runs the WebUI automation bot container with Docker socket access and privileged mode. Introduce two bridge networks: bot-virus-challenge-net (external) and bot-executor-net (internal, isolated). Harden existing challenge service with explicit linux/amd64 platform, privileged mode, and nofile ulimit (32768). Add named volumes for bot-runner logs and data persistence.
Remove the legacy multi-file bot build (Dockerfile.base, compose.yml, build scripts, multiple source modules, entrypoint) and replace with a single bot.py + minimal Dockerfile two-file contract. The new reference bot uses Selenium to open the challenge /_web page with headless Chrome and waits for the browser-side SDK to collect runtime-integrity signals and POST the encrypted payload to /_eval. It does NOT fill forms, move the mouse, scroll, or submit from Python.
Expose the hostname and port the spawned bot container uses to reach the challenge API on the bot-executor network, so the new reference bot can resolve the /_web URL at runtime.
Rewrite the /_web challenge page and backend for HBv6 non-behavioral scoring. The page is no longer a login form — it serves a minimal browser-verification page that loads the SDK to collect runtime- integrity signals only. Backend changes: - service.py: Add SCHEMA_VERSION, _short_digest() for stable config fingerprinting, per-session key management (advancing claim pointer on each /_web load), and session-binding template context (sessionId, nonce, publicKeyId, configHash, schemaVersion). - schemas.py: Update the Dockerfile template to use a venv-based setup (the vm-runner strips ENTRYPOINT/CMD and forces its own). - index.html: Replace the login form + checkbox-rendering page with a minimal verification page. Remove ACTIONS_LIST, APP_ID, and behavioral TASK_CONFIG selectors. Inject BV_SESSION and PUBLIC_KEY globals only.
Complete rewrite of the browser SDK for non-behavioral HBv6 scoring.
collector.js:
- Remove all behavioral series recording (movements, clicks, keydowns,
keyups, scroll, eventSequence, targets, taskProgress, trusted stats).
- Add SECTION_KEYS for non-behavioral integrity sections (automation,
runtimeIntegrity, fingerprint, apiAvailability, navigator, display,
correlation, sessionBinding).
- Retain legacy behavior series as empty arrays for shape back-compat.
- Add setSection() — first-write-wins per known section key.
sdk.js:
- Remove all DOM event wiring (mouse, keyboard, scroll, click, focus,
blur, visibility, pointer events).
- Remove ACTIONS_LIST input-id assignment and checkbox rendering.
- Add non-behavioral signal collectors: collectBrowserInfo,
collectAutomation, collectRuntimeIntegrity, collectApiAvailability,
collectFingerprint (WebGL/canvas/audio), collectNavigator,
collectDisplay, collectCorrelation, collectSessionBinding.
- Add hybrid encryption: RSA-OAEP-SHA256 for AES-256 key + IV,
AES-256-CBC/PKCS7 for payload body, base64-joined with '::'.
- Add submit() that POSTs {error: {data: blob}} to /_eval via fetch.
- Auto-run on load; mark window.BV_SUBMITTED on success.
test_web_page.py: - Replace behavioral element assertions (username, password, login button, scroll content, end-session) with minimal verification page checks. - Add tests for no-form/no-behavioral-elements, session-binding globals, SDK wiring, and non-leak of scoring internals. - Add test_sdk_does_not_collect_behavior. collector.test.js: - Replace behavioral metrics tests with integrity-section tests. - Test: empty legacy series, section first-write-wins, SECTION_KEYS contract, setSection rejection of unknown sections/non-objects. sdk.test.js: - Complete rewrite: test auto-collect of non-behavioral sections, hybrid RSA-OAEP + AES-256-CBC encryption round-trip, blob wire format (encKey::encIv::cipherText), window.BV_SUBMITTED flag, fetch() to /_eval, and NO behavioral fields in payload. test_eval_crypto.py (new): - Pin the wire-format contract between the JS SDK and the server decryptor: test blob charset, vault_unlock decrypt, and public cryptography round-trip.
Submodule now includes: - Bot cleanup: replace multi-file boilerplate with two-file contract - Runner refactor: clean build context, no forced ENTRYPOINT injection, new env var contract (CHALLENGE_BASE_URL/CHALLENGE_WEB_URL), no forced src/ scaffold copying - Fix default hostname from 'challenger-api' to 'challenge-api' - New test coverage for the clean two-file build contract
Add WebUI automation bot and refactor challenge scoring system
Updates the requirements on [pyright](https://github.com/RobertCraigie/pyright-python) to permit the latest version. - [Release notes](https://github.com/RobertCraigie/pyright-python/releases) - [Commits](RobertCraigie/pyright-python@v1.1.392...v1.1.411) --- updated-dependencies: - dependency-name: pyright dependency-version: 1.1.410 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/pip/pyright-gte-1.1.410-and-lt-2.0.0
branch
from
July 2, 2026 04:45
f196903 to
944a285
Compare
aliyuldashev
force-pushed
the
main
branch
2 times, most recently
from
July 30, 2026 08:31
0a72bba to
c9b07fc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the requirements on pyright to permit the latest version.
Commits
392b6baPyright NPM Package update to 1.1.411 (#363)509391aPyright NPM Package update to 1.1.410 (#361)d7508e5[pyright updated to 1.1.409] Update Version (#359)81b795aPyright NPM Package update to 1.1.408 (#357)53e8efbPyright NPM Package update to 1.1.407 (#356)1d515b7Pyright NPM Package update to 1.1.406 (#355)e211ec8Pyright NPM Package update to 1.1.405 (#353)d393df1Pyright NPM Package update to 1.1.404 (#352)047488fPyright NPM Package update to 1.1.403 (#350)708a9d4Pyright NPM Package update to 1.1.402 (#349)