build(deps): update pydantic-settings requirement from <3.0.0,>=2.2.1 to >=2.14.2,<3.0.0 - #8
Open
dependabot[bot] wants to merge 41 commits into
Open
Conversation
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Add the container runner submodule at src/modules/rest.mdm-sn-container-runner pointing to RedTeamSubnet/rest.hb-bot-executer. Remove the empty __init__.py that conflicts with the submodule directory.
Enable setuptools package discovery under src/ for bv_challenge. Fix version attr to reference __version__ directly and dependencies file to list format. Update all project URLs from challenge-template to bot-virus-challenge.
Change VERSION_FILE_PATH from VERSION.txt to bv_challenge.__version__.py. bump-version.sh now writes '__version__ = "x.y.z"' format. get-version.sh now parses Python __version__ assignment instead of raw text.
Add src/bot/ package with Selenium-based WebUI automation: - main.py: entrypoint with config loading, internet check, session loop - core/bot.py: automation logic with failed-challenge detection - driver.py: Chromium driver setup with stealth options - constants.py: environment-based configuration - Dockerfile + Dockerfile.base: multi-stage container builds - compose.yml: standalone bot compose stack - Scripts: build-base.sh, build.sh, docker-entrypoint.sh, run.sh
Add bot-runner service that runs the WebUI automation bot container with Docker socket access and privileged mode. Introduce two bridge networks: bot-virus-challenge-net (external) and bot-executor-net (internal, isolated). Harden existing challenge service with explicit linux/amd64 platform, privileged mode, and nofile ulimit (32768). Add named volumes for bot-runner logs and data persistence.
Remove the legacy multi-file bot build (Dockerfile.base, compose.yml, build scripts, multiple source modules, entrypoint) and replace with a single bot.py + minimal Dockerfile two-file contract. The new reference bot uses Selenium to open the challenge /_web page with headless Chrome and waits for the browser-side SDK to collect runtime-integrity signals and POST the encrypted payload to /_eval. It does NOT fill forms, move the mouse, scroll, or submit from Python.
Expose the hostname and port the spawned bot container uses to reach the challenge API on the bot-executor network, so the new reference bot can resolve the /_web URL at runtime.
Rewrite the /_web challenge page and backend for HBv6 non-behavioral scoring. The page is no longer a login form — it serves a minimal browser-verification page that loads the SDK to collect runtime- integrity signals only. Backend changes: - service.py: Add SCHEMA_VERSION, _short_digest() for stable config fingerprinting, per-session key management (advancing claim pointer on each /_web load), and session-binding template context (sessionId, nonce, publicKeyId, configHash, schemaVersion). - schemas.py: Update the Dockerfile template to use a venv-based setup (the vm-runner strips ENTRYPOINT/CMD and forces its own). - index.html: Replace the login form + checkbox-rendering page with a minimal verification page. Remove ACTIONS_LIST, APP_ID, and behavioral TASK_CONFIG selectors. Inject BV_SESSION and PUBLIC_KEY globals only.
Complete rewrite of the browser SDK for non-behavioral HBv6 scoring.
collector.js:
- Remove all behavioral series recording (movements, clicks, keydowns,
keyups, scroll, eventSequence, targets, taskProgress, trusted stats).
- Add SECTION_KEYS for non-behavioral integrity sections (automation,
runtimeIntegrity, fingerprint, apiAvailability, navigator, display,
correlation, sessionBinding).
- Retain legacy behavior series as empty arrays for shape back-compat.
- Add setSection() — first-write-wins per known section key.
sdk.js:
- Remove all DOM event wiring (mouse, keyboard, scroll, click, focus,
blur, visibility, pointer events).
- Remove ACTIONS_LIST input-id assignment and checkbox rendering.
- Add non-behavioral signal collectors: collectBrowserInfo,
collectAutomation, collectRuntimeIntegrity, collectApiAvailability,
collectFingerprint (WebGL/canvas/audio), collectNavigator,
collectDisplay, collectCorrelation, collectSessionBinding.
- Add hybrid encryption: RSA-OAEP-SHA256 for AES-256 key + IV,
AES-256-CBC/PKCS7 for payload body, base64-joined with '::'.
- Add submit() that POSTs {error: {data: blob}} to /_eval via fetch.
- Auto-run on load; mark window.BV_SUBMITTED on success.
test_web_page.py: - Replace behavioral element assertions (username, password, login button, scroll content, end-session) with minimal verification page checks. - Add tests for no-form/no-behavioral-elements, session-binding globals, SDK wiring, and non-leak of scoring internals. - Add test_sdk_does_not_collect_behavior. collector.test.js: - Replace behavioral metrics tests with integrity-section tests. - Test: empty legacy series, section first-write-wins, SECTION_KEYS contract, setSection rejection of unknown sections/non-objects. sdk.test.js: - Complete rewrite: test auto-collect of non-behavioral sections, hybrid RSA-OAEP + AES-256-CBC encryption round-trip, blob wire format (encKey::encIv::cipherText), window.BV_SUBMITTED flag, fetch() to /_eval, and NO behavioral fields in payload. test_eval_crypto.py (new): - Pin the wire-format contract between the JS SDK and the server decryptor: test blob charset, vault_unlock decrypt, and public cryptography round-trip.
Submodule now includes: - Bot cleanup: replace multi-file boilerplate with two-file contract - Runner refactor: clean build context, no forced ENTRYPOINT injection, new env var contract (CHALLENGE_BASE_URL/CHALLENGE_WEB_URL), no forced src/ scaffold copying - Fix default hostname from 'challenger-api' to 'challenge-api' - New test coverage for the clean two-file build contract
Add WebUI automation bot and refactor challenge scoring system
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/pip/pydantic-settings-gte-2.14.1-and-lt-3.0.0
branch
from
July 2, 2026 04:45
5492015 to
87c5b15
Compare
…directory and adjust build context
…d updating documentation
…and eliminate unused code
…, and utils modules
…to streamline challenge API
- Added PayloadManager class to manage scoring runs, including key pairs and session records. - Removed the TaskManager class and integrated its functionality into PayloadManager. - Updated scoring logic to utilize PayloadManager for session handling and scoring. - Simplified key pair generation and session management. - Refactored schemas to accommodate new data structures and validation. - Removed deprecated session_store module and its associated logic. - Updated utils to streamline VM request handling and scoring processes. - Adjusted requirements to remove unnecessary dependencies. - Added .gitkeep files for data and logs directories in the container runner volume.
Updates the requirements on [pydantic-settings](https://github.com/pydantic/pydantic-settings) to permit the latest version. - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](pydantic/pydantic-settings@v2.2.1...v2.14.2) --- updated-dependencies: - dependency-name: pydantic-settings dependency-version: 2.14.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/pip/pydantic-settings-gte-2.14.1-and-lt-3.0.0
branch
from
July 12, 2026 06:26
87c5b15 to
219a326
Compare
aliyuldashev
force-pushed
the
main
branch
3 times, most recently
from
July 30, 2026 08:31
0a72bba to
c9b07fc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the requirements on pydantic-settings to permit the latest version.
Release notes
Sourced from pydantic-settings's releases.
Commits
d703bd7Prepare release 2.14.2 (#890)e95c30bPrepare release 2.14.1 (#859)0c87345Fix field namedclsconflicting with classmethod parameter (#858)7bd0072Bump the python-packages group with 2 updates (#856)b03e573Bump the github-actions group with 3 updates (#853)eaa3b43Bump the python-packages group with 5 updates (#854)9f95615Bump the python-packages group with 4 updates (#850)8916beePrepare release 2.14.0 (#848)39e551cFix CLI descriptions lost underpython -OOby falling back to `json_schema_...9ed7f48Bump the python-packages group with 4 updates (#847)