Skip to content

Update Python dependencies and harden encryption workflows#8

Merged
brainx merged 4 commits into
mainfrom
dependabot/pip/python-runtime-and-dev-338cdfe73c
Jul 9, 2026
Merged

Update Python dependencies and harden encryption workflows#8
brainx merged 4 commits into
mainfrom
dependabot/pip/python-runtime-and-dev-338cdfe73c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 4, 2026 •
edited by brainx
Loading

Copy link
Copy Markdown
Contributor

Summary

  • update the grouped Python runtime and development dependencies while keeping docutils==0.22.4, because Sphinx 9.1 requires docutils<0.23
  • enforce authenticated-container payload bounds and harden workspace reads against symlink, FIFO, and size-change races
  • make Unicode download filenames header-safe and refresh a stale local API token once without retrying unrelated authorization failures
  • strengthen CI and release checks with npm auditing, API Bandit coverage, isolated installed-wheel smoke tests, a pinned liboqs 0.15.0 source revision, and least-privilege release publishing

Root causes addressed

The original Dependabot lock selected docutils==0.23, which is incompatible with the resolved Sphinx version. The hardened diff also closes malformed AES-GCM payload acceptance, blocking file-open races, Unicode response-header failures, stale browser token failures, checkout-shadowed wheel tests, and overly broad release permissions.

Security impact

Untrusted workspace files, encrypted containers, download filenames, and browser requests now fail closed at their trust boundaries. Release credentials are no longer available to dependency installation and build steps.

Validation

  • GitHub Actions CI run 24: all seven jobs passed, including Python 3.10/3.13, security, web UI, installed package, locked runtime, native liboqs, and CLI round-trip checks
  • local Python suite: 145 passed, 13 skipped
  • frontend API client suite: 2 passed
  • Black, Flake8, mypy, Bandit, pip check, and diff checks passed
  • all three Python dependency audits reported no known vulnerabilities; npm audit reported zero vulnerabilities
  • wheel and sdist builds passed Twine validation; isolated wheel imports, static assets, and localhost UI smoke passed

CodeQL default setup remains enabled for repository static analysis.

@dependabot
Bump the python-runtime-and-dev group across 1 directory with 18 updates
f287d20 
Bumps the python-runtime-and-dev group with 18 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cryptography](https://github.com/pyca/cryptography) | `48.0.1` | `49.0.0` |
| [altair](https://github.com/vega/altair) | `6.2.1` | `6.2.2` |
| [anyio](https://github.com/agronholm/anyio) | `4.13.0` | `4.14.1` |
| [ast-serialize](https://github.com/mypyc/ast_serialize) | `0.5.0` | `0.6.0` |
| [certifi](https://github.com/certifi/python-certifi) | `2026.5.20` | `2026.6.17` |
| [click](https://github.com/pallets/click) | `8.4.1` | `8.4.2` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.14.1` | `7.15.0` |
| [docutils](https://github.com/rtfd/recommonmark) | `0.22.4` | `0.23` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.29.4` | `3.29.5` |
| [httptools](https://github.com/MagicStack/httptools) | `0.6.4` | `0.8.0` |
| [librt](https://github.com/mypyc/librt) | `0.11.0` | `0.12.0` |
| [narwhals](https://github.com/narwhals-dev/narwhals) | `2.22.1` | `2.23.0` |
| [nh3](https://github.com/messense/nh3) | `0.3.5` | `0.3.6` |
| [pillow](https://github.com/python-pillow/Pillow) | `12.2.0` | `12.3.0` |
| [protobuf](https://github.com/protocolbuffers/protobuf) | `7.35.0` | `7.35.1` |
| [pydeck](https://github.com/visgl/deck.gl) | `0.9.2` | `0.9.3` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.0.3` | `9.1.1` |
| [typing-extensions](https://github.com/python/typing_extensions) | `4.15.0` | `4.16.0` |



Updates `cryptography` from 48.0.1 to 49.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@48.0.1...49.0.0)

Updates `altair` from 6.2.1 to 6.2.2
- [Release notes](https://github.com/vega/altair/releases)
- [Commits](vega/altair@v6.2.1...v6.2.2)

Updates `anyio` from 4.13.0 to 4.14.1
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.13.0...4.14.1)

Updates `ast-serialize` from 0.5.0 to 0.6.0
- [Commits](mypyc/ast_serialize@v0.5.0...v0.6.0)

Updates `certifi` from 2026.5.20 to 2026.6.17
- [Commits](certifi/python-certifi@2026.05.20...2026.06.17)

Updates `click` from 8.4.1 to 8.4.2
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md)
- [Commits](pallets/click@8.4.1...8.4.2)

Updates `coverage` from 7.14.1 to 7.15.0
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.14.1...7.15.0)

Updates `docutils` from 0.22.4 to 0.23
- [Changelog](https://github.com/readthedocs/recommonmark/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rtfd/recommonmark/commits)

Updates `filelock` from 3.29.4 to 3.29.5
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.29.4...3.29.5)

Updates `httptools` from 0.6.4 to 0.8.0
- [Release notes](https://github.com/MagicStack/httptools/releases)
- [Commits](MagicStack/httptools@v0.6.4...v0.8.0)

Updates `librt` from 0.11.0 to 0.12.0
- [Commits](mypyc/librt@v0.11.0...v0.12.0)

Updates `narwhals` from 2.22.1 to 2.23.0
- [Release notes](https://github.com/narwhals-dev/narwhals/releases)
- [Commits](narwhals-dev/narwhals@v2.22.1...v2.23.0)

Updates `nh3` from 0.3.5 to 0.3.6
- [Release notes](https://github.com/messense/nh3/releases)
- [Commits](messense/nh3@v0.3.5...v0.3.6)

Updates `pillow` from 12.2.0 to 12.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.2.0...12.3.0)

Updates `protobuf` from 7.35.0 to 7.35.1
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

Updates `pydeck` from 0.9.2 to 0.9.3
- [Release notes](https://github.com/visgl/deck.gl/releases)
- [Changelog](https://github.com/visgl/deck.gl/blob/master/CHANGELOG.md)
- [Commits](https://github.com/visgl/deck.gl/commits)

Updates `pytest` from 9.0.3 to 9.1.1
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.0.3...9.1.1)

Updates `typing-extensions` from 4.15.0 to 4.16.0
- [Release notes](https://github.com/python/typing_extensions/releases)
- [Changelog](https://github.com/python/typing_extensions/blob/main/CHANGELOG.md)
- [Commits](python/typing_extensions@4.15.0...4.16.0)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 49.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-runtime-and-dev
- dependency-name: altair
  dependency-version: 6.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime-and-dev
- dependency-name: anyio
  dependency-version: 4.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime-and-dev
- dependency-name: ast-serialize
  dependency-version: 0.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-runtime-and-dev
- dependency-name: certifi
  dependency-version: 2026.6.17
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime-and-dev
- dependency-name: click
  dependency-version: 8.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime-and-dev
- dependency-name: coverage
  dependency-version: 7.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-runtime-and-dev
- dependency-name: docutils
  dependency-version: '0.23'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-runtime-and-dev
- dependency-name: filelock
  dependency-version: 3.29.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-runtime-and-dev
- dependency-name: httptools
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime-and-dev
- dependency-name: librt
  dependency-version: 0.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-runtime-and-dev
- dependency-name: narwhals
  dependency-version: 2.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime-and-dev
- dependency-name: nh3
  dependency-version: 0.3.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-runtime-and-dev
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime-and-dev
- dependency-name: protobuf
  dependency-version: 7.35.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime-and-dev
- dependency-name: pydeck
  dependency-version: 0.9.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime-and-dev
- dependency-name: pytest
  dependency-version: 9.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-runtime-and-dev
- dependency-name: typing-extensions
  dependency-version: 4.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime-and-dev
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jul 4, 2026
@brainx brainx changed the title Bump the python-runtime-and-dev group across 1 directory with 18 updates Update Python dependencies and harden encryption workflows Jul 9, 2026
@brainx
brainx merged commit 382a4d6 into main Jul 9, 2026
11 checks passed
@dependabot
dependabot Bot deleted the dependabot/pip/python-runtime-and-dev-338cdfe73c branch July 9, 2026 20:22
brainx added a commit that referenced this pull request Jul 9, 2026
@brainx
Update Python dependencies and harden encryption workflows (#8)
1381e38 
Resolve the Sphinx/docutils dependency conflict, harden encrypted-container and workspace-file boundaries, fix local API recovery and Unicode downloads, and strengthen package, security, and release validation.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@brainx