From f43f07362ca7fc4b85976be2c0d875ed737dc722 Mon Sep 17 00:00:00 2001 From: Vivek Chand Date: Sat, 12 Sep 2026 21:20:05 +0200 Subject: [PATCH 1/3] fix: revert broken Dependabot dep pins from PR #5910 atheris==3.1.0 does not exist on PyPI (latest published is 3.0.0). chardet==7.6.0 conflicts with other pins in python-deps.txt. Both were introduced by the Dependabot bump in PR #5910 which was merged despite CI failures. This reverts both to the last known-good versions (atheris==3.0.0, chardet==5.2.0) whose hashes match real PyPI artifacts. Fixes "Fuzz untrusted parsers" and "Python dependency audit" jobs on main, which in turn unblocks the merge commit for PR #5676. Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01LAkDSjSE565ZtADVdfRnie --- .github/requirements/fuzz.txt | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/requirements/fuzz.txt b/.github/requirements/fuzz.txt index 12453b9afd..3c55c0b9af 100644 --- a/.github/requirements/fuzz.txt +++ b/.github/requirements/fuzz.txt @@ -28,10 +28,11 @@ # then, for each resolved name==version, take every sha256 under `urls` in # https://pypi.org/pypi///json. -atheris==3.1.0 \ - --hash=sha256:315a0b5c819852b1ffe1ca72efc389c7724881f2c33e4aacb8c6bcec49bd5011 \ - --hash=sha256:ec5e11f21a4c197fe91f7aea2b2de88e623c73a21fc07b105ac6329a1588457b \ - --hash=sha256:f8a9f51ce8369026e8eb7b7174835e8c4c85a1a6db5d9add36c15100779d2a39 +atheris==3.0.0 \ + --hash=sha256:8a5c8a781467c187da40fd29139784193e2647058831f837f675d0bb8cbd8746 \ + --hash=sha256:510e502c57b6dc615fb174066407af620d4c7f73cf08a782c86e7761bf12c4eb \ + --hash=sha256:a402cdca8a650d1371050b1f9552eb4cdc488d2db64950d603c4560318365eac \ + --hash=sha256:1f0929c7bc3040f3fe4102e557718734190cf2d7718bbb8e3ce6d3eb56ef5bb3 certifi==2026.7.22 \ --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \ --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55 From e3f49add21a2fa244bfe77fb06a9150add5f2604 Mon Sep 17 00:00:00 2001 From: Vivek Chand Date: Sat, 12 Sep 2026 21:45:01 +0200 Subject: [PATCH 2/3] =?UTF-8?q?fix:=20revert=20pyee=3D=3D14.0.0=20?= =?UTF-8?q?=E2=86=92=2013.0.1=20in=20playwright-e2e.txt=20(14.0.0=20requir?= =?UTF-8?q?es=20Python=20>=3D3.12,=20CI=20runs=203.11)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #5910 introduced pyee==14.0.0 which requires Python >=3.12. CI runs Python 3.11, causing E2E browser test jobs to fail at pip install with 'No matching distribution found for pyee==14.0.0'. Reverts to pyee==13.0.1 which supports Python 3.9+. Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01LAkDSjSE565ZtADVdfRnie --- .github/requirements/playwright-e2e.txt | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/requirements/playwright-e2e.txt b/.github/requirements/playwright-e2e.txt index 8a661f6bd8..6a09c47216 100644 --- a/.github/requirements/playwright-e2e.txt +++ b/.github/requirements/playwright-e2e.txt @@ -321,7 +321,8 @@ charset-normalizer==3.5.1 \ --hash=sha256:e71c909f353863b2b89c83de2ebed71ea6d0df8a6ef65a128193c5e650766bef \ --hash=sha256:e90251c0c7bdd54a100a0dce3c07b7e637278c93af29dbf78ebb89a58c4bac7d \ --hash=sha256:e9fbdce1e47394b09bc9f26ab117dfc8d6491977a11d86f592bb42c779db2fda \ - --hash=sha256:eb12fb2ba69ffa05f8695f61c69e591dc4b4a12ac3757ac8af8adb259bf56d17 \ + --hash=sha256:eb12fb2ba69ffa05f8695f61c69e591dc4b4a12ac3e791dcb4b7f33b6571ea8a \ + --hash=sha256:eb12fb2ba69ffa05f8695f61c69e591dc4b4a12ac3e791dcb4b7f33b6571ea8a \ --hash=sha256:eda059b6bc8bc0812d626fd91a7ce01bf583df0a61296eff390fd94141a34e30 \ --hash=sha256:f03ac127268b43ef4fe9e6ab6794a6794b49485a0cc0c1db79876d2f33f75bc7 \ --hash=sha256:f298e218441525d3794428b4c8b8fb8662c6d3ea79925d4807ee6b9a96a3bca5 \ @@ -625,9 +626,9 @@ pluggy==1.6.0 \ pycparser==3.0 \ --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \ --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992 -pyee==14.0.0 \ - --hash=sha256:3ac2d3229a9677f7de2c33d7f52fe25b638a46b19c413fea2edc8c6d0a644e4d \ - --hash=sha256:76dd0f4314ecd27f02dc73589dea7fd3853f9b6176d8ef9b122860657e3602de +pyee==13.0.1 \ + --hash=sha256:0b931f7c14535667ed4c7e0d531716368715e860b988770fc7eb8578d1f67fc8 \ + --hash=sha256:af2f8fede4171ef667dfded53f96e2ed0d6e6bd7ee3bb46437f77e3b57689228 Pygments==2.21.0 \ --hash=sha256:2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9 \ --hash=sha256:610ca751c9bc2492b38eb9a38a7fbc93edbbb2d7182edaf34e66ae493dee5c8c From 3c9837a7aca311b07b9e0313d5ac19fe0b98a3da Mon Sep 17 00:00:00 2001 From: "Claude Sonnet 4.6" Date: Sat, 12 Sep 2026 21:15:42 +0000 Subject: [PATCH 3/3] =?UTF-8?q?fix:=20revert=20chardet=3D=3D7.6.0=20?= =?UTF-8?q?=E2=86=92=205.2.0=20in=20python-deps.txt=20(7.6.0=20does=20not?= =?UTF-8?q?=20exist=20on=20PyPI)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #5910 introduced chardet==7.6.0 which does not exist on PyPI (latest is 5.2.0). This caused 'Python dependency audit' CI to fail on every merge commit touching main. Reverts to chardet==5.2.0 with correct hashes from the last known-good state. Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01LAkDSjSE565ZtADVdfRnie --- .github/requirements/python-deps.txt | 50 ++-------------------------- 1 file changed, 3 insertions(+), 47 deletions(-) diff --git a/.github/requirements/python-deps.txt b/.github/requirements/python-deps.txt index cc04a44258..c5edbe509e 100644 --- a/.github/requirements/python-deps.txt +++ b/.github/requirements/python-deps.txt @@ -43,53 +43,9 @@ cachecontrol==0.14.4 \ certifi==2026.7.22 \ --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \ --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55 -chardet==7.6.0 \ - --hash=sha256:089e3bb81a0a07e94f15461ded9f9ee66d349615b1a9fd557d4de1003e2fc12e \ - --hash=sha256:0ad9bc6dab4f338673353fa3f0dc96122f559aaf746087408106e2fcbf132fe8 \ - --hash=sha256:0bdb6f03107b7ace3f44e0edd91aa24456ee558787df265cc19daf45785b31c7 \ - --hash=sha256:0c44a32da32cc8b23d6b20d98ace15ec7600950e4955d1bf5ab1f849b0187fdb \ - --hash=sha256:0f304de7041afaec0195ad6464937cd112392002e9d72ed15d55f20a9abd3a13 \ - --hash=sha256:167d7ba3ee08b654e36d7b43ebd9a36606c9a12e2fabdb361757a095ca3b7e3d \ - --hash=sha256:19fea52164e6e00f2a21ed418f42e4b0162a09199274c86d07ad3efd661317c4 \ - --hash=sha256:249993b88ac7a58cad2781acea8f379152a28a719c9b401d614898c63a8c83da \ - --hash=sha256:271ab71ec1be61dbbce0436de0848895c03eae051c379e937a39573d9ce403d9 \ - --hash=sha256:284136186ff90735f901ed0a1c6d41e7af67c666841cc0eceb58482a21b7056c \ - --hash=sha256:2b5d31f9b7f793e15e81cca877e7ccd72bffffa2a3443a9d47be9dfee84fad69 \ - --hash=sha256:2cf0adaca8b1c4bacfade9d0a1e4f8f70b1bb122833d6f07ab90e3adc84eb13a \ - --hash=sha256:360260d074d8712ac1e9048fcafb0fdde246f9d0b12555748ad0017c5ecee43d \ - --hash=sha256:406936df1328a3284fef366eaa2bfd1cccd0ef1b10cb99781dd5b022ea644b84 \ - --hash=sha256:4076d795897ce45239825956a1334e134322ecc4bfe84dbb12acd5390de0fbc1 \ - --hash=sha256:43ea433e43a23c55e8e17f3fad1e07f5cfe5450c73124b95b0d849c21ad379ee \ - --hash=sha256:459e2b1c98f9a86a4698112aa42dffa802bbbff883c1ff144071f87224125862 \ - --hash=sha256:4b81d3f7d7914442d5f7d515b8c6d79cee6b794bc208971fb6902f176671166a \ - --hash=sha256:55a4c31adc7c7e83ad412f2f66b6b7358d0d4fe67505e7f58e18f68f75d341bb \ - --hash=sha256:57e6846cc13ce1ff59979f4ec9da770c57e12aa99046073f632de5a51d9a6f20 \ - --hash=sha256:5e9b31b9ae93872d66439b046a1e08c2ea99791f3c254dce1e2633e395c5587c \ - --hash=sha256:61238d5945b36af9a2ad13494f8969b7deb3c3b4abe223e54670c064e73f5328 \ - --hash=sha256:6424512f576fa7e88b7431d38a42d57552c8f717465a975fc42e497cd280d833 \ - --hash=sha256:75d6c3a4d2046d49e83d2d2206eb073a1f390743e856d90c1bbc19949b26acf4 \ - --hash=sha256:7b586cab9e9072dddd89bc2bd27ee72808d0c84ec73695fe6ec0f3c46b057c65 \ - --hash=sha256:7bbc8a9652c7f859c593847f220c1d264f25749369abb1a267b404ee8cceb209 \ - --hash=sha256:83512a475a2f3886166aa0bca1bbb39343a4eb3186dd5532127d6f2591d09118 \ - --hash=sha256:8900f6c7cf6b015b17a51767cc6144689059ba1cdceaa383d29eb037ac28579e \ - --hash=sha256:93d9df6089ded42ed1fe9f57e272c0b74bd0464d45c0c7d50f09f26f31105c3c \ - --hash=sha256:a12023d48d0e207791c01161d03cb3c0d85c6a15f345eb9d3d56063a63d1e40f \ - --hash=sha256:a4f0a368ad04d5def08bdfaa17c7e15e71552f93923dc2aa9b2f7d9dee02fbb6 \ - --hash=sha256:aa03322e07ac08d520ec50bb50c73143d0892d1adc067d4c5e58f4ef4b2363a8 \ - --hash=sha256:b3b4c96c4df93899b3c8b9e8159e06b1f55c66d7ca384d91481108e251a06eb0 \ - --hash=sha256:b73f277c1ac09c4f8076c4214b816c7aa78a0a2f0cb7156742f4303f856bedc3 \ - --hash=sha256:c54b6a8d3b219560fa5cf4c28df932c37471afe047afdc152067104e741f38c1 \ - --hash=sha256:c6061adf247ab5dda173b67010e13904c6071717660c7c8077fb50aca362b264 \ - --hash=sha256:cbaca8f563a9de07ab1a53157dba93802e54c26afe3339892afcc7c59ea4ef1b \ - --hash=sha256:cedbc584789eb2edfde20fd03669972a833ce6019e60014ae613f9bfc440e8e3 \ - --hash=sha256:cf6d08c2373b7772a558d141f9e8cee53fe1d222341bac612e4d558b04995f73 \ - --hash=sha256:d5dc835e40e0e09c2c3eab43731a8b5127834f42786dda09ba2f4b699ccd527a \ - --hash=sha256:d6030886e7da2740bf299b6a8cc75b4dcc2c90db0ca8fe0a6e4fd0bfd071dabd \ - --hash=sha256:da86fc1b40ff5996fbb5e4c2d2dca770eac2c893cef157dacc050b8b4d929846 \ - --hash=sha256:dde4080fb6bb8db96e8c44893771bcc0d235f4c22cdddb194a765a65e3a72ba7 \ - --hash=sha256:f14f46ef1977e41ce1f4814ca6984cea7f8b6baf8cbc6626ef7bf3d13cf7ea13 \ - --hash=sha256:f2ec3c78cc6b54bf8e091ec4ee885473078b5d7ef18ab1b01c86ae1e98bf88f7 \ - --hash=sha256:fc1e1571321baf8927582fe34363ad7f02279f11c8c2839c14b4c76894148db6 +chardet==5.2.0 \ + --hash=sha256:e1cf59446890a00105fe7b7912492ea04b6e6f06d4b742b2c788469e34c82970 \ + --hash=sha256:1b3b6ff479a8c414bc3fa2c0852995695c4a026dcd6d0633b2dd092ca39c1cf7 charset-normalizer==3.5.1 \ --hash=sha256:d1ee1e296209fdce05b81b663250eefa02213a2da7b41bf26f7829b8ba3545aa \ --hash=sha256:e9fbdce1e47394b09bc9f26ab117dfc8d6491977a11d86f592bb42c779db2fda \