Weekly dependency refresh 2026-08-17

[fabrica-cc-engineering-agent]

Dependency Refresh Summary

(a) Updated packages

Package	From → To	Age (days)	Audit verdict
huggingface-hub	1.26.0 → 1.27.0	10	Drop-in — additive release (auto hf-cli skill, engine flags for Inference Endpoints, resolve_revision()). APIs used by the repo (hf_hub_url, upload_file, HfApi, RepoFolder, EntryNotFoundError) are all present and unchanged in 1.27.0. Exercised via openavmkit/cloud/huggingface.py.
numba	0.66.0 → 0.67.0	6	Drop-in — adds NumPy 2.5 support, upgrades llvmlite to 0.49 with LLVM 23. njit and prange APIs unchanged. Repo uses numba as an optional JIT accelerator in openavmkit/shap_analysis.py (imported inside a try/except, falls back gracefully if absent). Python 3.11 supported (requires_python >=3.10).

(b) Exact-pinned because latest is < 5 days old

Package	Selected	Skipped (too fresh)	Skipped age
python-dotenv	1.2.2 (no change — current is latest aged-in)	1.2.3	1 day (released 2026-08-16)

python-dotenv 1.2.3 will age in next week's run.

(c) Code changes required by a bump

None.

(d) Held back this week

Package	Installed	Newest available	Newest age	Reason
numpy	2.4.6	2.5.2	8 days	numpy 2.5.0 dropped Python 3.11 support; CI matrix and Dockerfile both test/run on Python 3.11. Staying at 2.4.x until the project drops 3.11 support.
xgboost	3.2.0	3.4.1	2 days	xgboost 3.3.0+ requires Python >=3.12 (Python 3.11 dropped). 3.4.1 also fails the 5-day guard. No aged-in 3.x release supports Python 3.11 beyond 3.2.0. Requires Python 3.11 end-of-support to unblock.
shap	0.51.0	0.52.0	81 days	shap 0.52.0 requires Python >=3.12 (Python 3.11 dropped). 0.51.0 is the latest supporting Python 3.11.
ipython	8.12.3	8.39.0	143 days	Range pin ~=8.12.3 restricts to 8.12.x; 8.12.3 is already the latest in that subrange. Updating to 8.39.x requires changing the range pin — a 26-minor-version jump that warrants a dedicated PR with changelog review.

Note: paramiko (4.0.0, CVE-2026-44405) and pyarrow (22.0.0, CVE-2026-25087) also appear in the held-back category from a security perspective — see section (f).

(e) Skipped majors

Package	Installed	Available	Notes
paramiko	4.0.0	5.0.0	Major bump 4→5. CVE-2026-44405 (SHA-1 allowed) in 4.x; fix requires 5.0.0. Flag for dedicated security PR.
pyarrow	22.0.0	23.0.1, 24.0.0, 25.0.1	Multiple major bumps (22→23→24→25). CVE-2026-25087 (Use-After-Free in IPC file reads) fixed in 23.0.1. Flag for dedicated security migration PR — each major needs changelog review.
pandas	2.3.3 (via ~=2.3.3)	3.0.5	Major bump 2→3. Out of scope for weekly refresh.

(f) Verification status

pip-audit (pre-change): 3 findings — same 3 pre-existing vulns (paramiko, pdfkit, pyarrow), all requiring major version bumps. No new vulnerabilities introduced by this PR.

pip-audit (post-change, --no-deps):

Name     | Version | ID              | Fix Versions
---------|---------|-----------------|-------------
paramiko | 4.0.0   | PYSEC-2026-2858 | (none — fix is 5.0.0, major bump)
pdfkit   | 1.0.0   | PYSEC-2026-2860 | (none — 1.0.0 is latest; no patch available)
pyarrow  | 22.0.0  | PYSEC-2026-113  | 23.0.1 (major bump)

All 3 are pre-existing — they were present before this PR and are unchanged by it. They require major bumps to fix, which are out of scope for the weekly same-major refresh. Each is flagged for a dedicated security PR.

Reachability assessment for security findings:

• paramiko / CVE-2026-44405 (SHA-1 allowed, MEDIUM): exercised — openavmkit/cloud/sftp.py uses paramiko.SSHClient for SFTP connections. Risk is medium; affects key exchange crypto hardening. Dedicated security PR needed.
• pdfkit / CVE-2025-26240 (path traversal in from_string, HIGH): exercised — openavmkit/reports.py calls pdfkit directly. No patch available for 1.0.0 (latest). Flag for upstream reporting and potential replacement PR.
• pyarrow / CVE-2026-25087 (Use-After-Free in IPC file read, MEDIUM/HIGH): present but reachability is limited — openavmkit uses pyarrow.parquet and pyarrow.fs, not the IPC file reader directly. No direct ipc.open_file() calls found in the codebase. Risk is lower than CVSS suggests, but still warrants a major-bump migration PR.

Package installation: ✅ pip install huggingface-hub==1.27.0 and pip install numba==0.67.0 both succeed cleanly in Python 3.12.

Import / API check: ✅ All APIs used by the repo verified present in updated versions:

• huggingface_hub.hf_hub_url, upload_file, HfApi, RepoFolder, errors.EntryNotFoundError
• numba.njit, numba.prange

Full test suite (pytest on Python 3.11 + 3.12): Delegated to PR CI. The repo's pytest.yml and ci.yml workflows run the full matrix automatically on push to deps/weekly-refresh. Secrets and ML backends required by integration tests are unavailable in the refresh agent environment. The two bumped packages have no behavioral changes that would affect test outcomes — huggingface-hub 1.27.0 is fully backward-compatible, and numba 0.67.0 only adds NumPy 2.5 support on top of 0.66.0.

(g) Reviewer note

What to smoke-test before merging:

• HuggingFace cloud integration (openavmkit/cloud/huggingface.py): Verify file listing and download still work against a real HF dataset repo. The list_repo_tree call with repo_type="dataset" and recursive=True is the key path to exercise.
• numba JIT paths (openavmkit/shap_analysis.py): Run a SHAP analysis pass to confirm numba JIT compilation still succeeds. If numba is unavailable, the fallback path is exercised instead — either is acceptable.
• Pre-existing security findings: Three vulns (paramiko, pdfkit, pyarrow) are pre-existing and unaffected by this PR. Recommend creating dedicated security PRs for paramiko 5.x migration and pyarrow 23+ migration.

---

Upstream drift (informational): fabrica-land/openavmkit integration branch is 36 commits ahead, 0 commits behind larsiusprime/openavmkit master. No automatic sync — drift is expected. If the gap grows significantly, consider a sync ticket.

🤖 Generated with Claude Code