Repository navigation
chore(deps): bump the python-security group across 1 directory with 3 updates - #4127
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Castiron custom codeEvaluated main: Trusted main policy: ✅ No new custom-code files detected. 42 mixed files remain; 0 existing customizations changed. Compared 42 existing customizations unchanged
2 more in the full report. A changed generated baseline means this report cannot reliably identify which handwritten lines changed. Inspect the custom-code diffDownload the exact patch produced by this run (requires repository access): gh run download 39630509514 --repo openai/openai-python \
--name castiron-custom-code-39630509514-1 --dir /tmp/castiron-custom-code-39630509514-1
git apply --stat /tmp/castiron-custom-code-39630509514-1/custom-code.patch
cat /tmp/castiron-custom-code-39630509514-1/custom-code.patchOr reproduce it from an SDK checkout containing the vendored reporter: git fetch --no-tags origin b668ee88e7cb670704a0fd300152da29666b26cc 3ede68ca159108c26a9e0fe70e71e2e362bf9f8b
python3 scripts/castiron/custom_code_report.py report \
--base b668ee88e7cb670704a0fd300152da29666b26cc \
--head 3ede68ca159108c26a9e0fe70e71e2e362bf9f8b --target-branch main --fetch --require-head-hash --public \
--out /tmp/castiron-custom-code-3ede68ca1591
cat /tmp/castiron-custom-code-3ede68ca1591/custom-code.patchThis is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1b9bcf031f
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| @@ -1650,7 +1735,7 @@ wheels = [ | |||
|
|
|||
| [[package]] | |||
| name = "openai" | |||
| version = "3.35.1" # x-release-please-version | |||
| version = "3.35.1" | |||
There was a problem hiding this comment.
Keep # x-release-please-version on this version entry. The Verify dependency groups and committed lock step in .github/workflows/ci.yml explicitly requires that exact marked line, so CI fails for every run of this commit; additionally, release-please-config.json lists uv.lock as an extra version file and needs the marker to update it during the next release.
Useful? React with 👍 / 👎.
| @@ -55,7 +55,7 @@ wheels = [ | |||
|
|
|||
| [[package]] | |||
| name = "aiohttp" | |||
| version = "3.14.3" | |||
| version = "3.14.4" | |||
There was a problem hiding this comment.
Do not update only the locked artifacts for this security PR: pyproject.toml still publishes aiohttp>=3.14.3, retains the pyjwt>=2.14.0 security constraint, and declares no reviewed floor for the updated transitive multidict. Consequently, downstream openai[aiohttp] installations and future lock regenerations can still select the affected releases this change is intended to replace; advance the corresponding dependency declarations and security-floor tests along with these lock versions.
AGENTS.md reference: AGENTS.md:L31-L34
Useful? React with 👍 / 👎.
1b9bcf0 to
6157b25
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6157b25a82
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| @@ -2804,116 +2888,150 @@ wheels = [ | |||
|
|
|||
| [[package]] | |||
| name = "yarl" | |||
| version = "1.24.2" | |||
| version = "1.25.1" | |||
There was a problem hiding this comment.
This security PR also upgrades the transitive yarl package from 1.24.2 to 1.25.1, although its declared scope and release summary list only aiohttp, multidict, and PyJWT. Either retain yarl 1.24.2 or explicitly include the new release in the reviewed dependency boundaries and security tests; otherwise the locked networking stack absorbs a fourth package release without the required transitive-dependency provenance and installation review.
AGENTS.md reference: AGENTS.md:L31-L34
Useful? React with 👍 / 👎.
… updates --- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.4 dependency-type: direct:production dependency-group: python-security - dependency-name: multidict dependency-version: 6.9.1 dependency-type: indirect dependency-group: python-security - dependency-name: pyjwt dependency-version: 2.15.0 dependency-type: indirect dependency-group: python-security ... Signed-off-by: dependabot[bot] <[email protected]>
6157b25 to
3ede68c
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3ede68ca15
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| @@ -1,5 +1,5 @@ | |||
| version = 1 | |||
| revision = 5 | |||
| revision = 3 | |||
There was a problem hiding this comment.
Keep this lock at revision 5. The downgrade also removes the root package's default-groups = ["dev", "pydantic-v2"] entry even though pyproject.toml still declares those defaults; the dependency-locks job uses uv 0.12.5 and runs uv lock --check, which will regenerate this newer lock representation and reject the committed file as stale even after the separate release marker is restored.
Useful? React with 👍 / 👎.
Bumps the python-security group with 3 updates in the / directory: aiohttp, multidict and pyjwt.
Updates
aiohttpfrom 3.14.3 to 3.14.4Updates
multidictfrom 6.7.1 to 6.9.1Release notes
Sourced from multidict's releases.
... (truncated)
Changelog
Sourced from multidict's changelog.
... (truncated)
Commits
0a1770cRelease 6.9.1 (#1504)d220522Upload release assets one at a time to avoid the secondary rate limit (#1503)30cd596Stop a GIL-releasing del from segfaulting the standard C extension build ...d1c331aRecheck the reader gate after taking the retired list (#1502)b37f07cAllocate deferred decrefs in fixed-size blocks (#1501)563f667Run CodSpeed benchmarks on Python 3.14 and loop the smallest ones (#1498)157c87cCancel superseded CI runs on pull requests (#1500)d43adfeDrop -I from the ASan test command so PYTHONMALLOC takes effect (#1499)2a68472Stop items() iteration from reading a freed entry in CIMultiDict (#1496)cd528d6Rename GHSA-54p9-h82j-f925 changelog fragment to the merged commit (#1495)Updates
pyjwtfrom 2.14.0 to 2.15.0Release notes
Sourced from pyjwt's releases.
Changelog
Sourced from pyjwt's changelog.