Repository navigation
build(deps): patch urllib3 in remaining comparison locks - #126
Merged
stefan-jansen merged 6 commits intoOct 15, 2026
Merged
stefan-jansen merged 6 commits into
stefan-jansen merged 6 commits into
Conversation
dependabot
Bot
added
dependencies
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.7.0 to 2.8.0. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.7.0...2.8.0) --- updated-dependencies: - dependency-name: urllib3 dependency-version: 2.8.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/uv/validation/environments/lean/urllib3-2.8.0
branch
from
October 8, 2026 21:09
0c156bf to
1a4bc1d
Compare
stefan-jansen
changed the title
stefan-jansen
deleted the
dependabot/uv/validation/environments/lean/urllib3-2.8.0
branch
October 15, 2026 16:09
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Outcome
Patch urllib3 to 2.8.0 in the remaining LEAN, VectorBT OSS, current VectorBT Pro and historical VectorBT Pro comparison locks. Preserve the exact framework builds and their source or engine-image identities.
This addresses the published urllib3 streaming and proxy-TLS advisories, including GHSA-vxq7-64xx-v4gw and GHSA-8988-9cw3-xx77. These upstream advisories identify 2.8.0 as patched. The root and Zipline locks were already repaired separately.
Required historical lock repair
The 2025.12.31 VectorBT Pro lock still selected Specs 0.1.3 although Backtest now requires >=0.1.4. The real command below failed on
6ace8de034176ff77e9113ad75493ce29eb95819with a stale-lock error:The lock was regenerated with uv to compatible Specs 0.1.5. Its VectorBT Pro source stays at
1305a1e1974325db9382eaeacc6452e9b075ca71. The locked install now succeeds, and an actual one-order portfolio ends at the independently expected equity of 101 from starting cash 100 and prices 1 then 2.Verification
1a4bc1d5ce09aded26478be8ec269f7001306d20: verified locked CLI 1.0.228 and immutable engine image; all 13 native behavior checks and three retained case-study comparisons passed.32cb4398f37ebac9feff94789e7ac95b4f848701: actual locked installs and imports verified urllib3 2.8.0, preserved exact framework identities, and passed both current VectorBT native behavior checks, 17 checks each.Selected head
5d5ecb82d235cf8754b8b6046944cde899d015a5, based on main6b53fbe017cdd57da7b8bb018be01982e30b8b76: all four locks passuv lock --check, all hooks pass, and 14 support-policy/environment-builder tests pass. Final exact-head supported hosted CI and package checks are pending and must pass before ordinary merge. The numerical engine and timed runner source are unchanged by these lock updates. Previously measured reports retain their real generating revisions and environments; no new timing or parity claim is made from this dependency update.Scope and AI assistance
This reuses the existing dependency PR for the same urllib3 security repair. Automated dependency updates retain the owning-issue exception. Codex reviewed the original update, reproduced the historical locked-install defect, generated the additional locks with uv, ran the recorded native and dependency checks, and drafted this description. No independent human review is asserted.
No release, tag, PyPI publication or deployment is part of this PR.