Repository navigation
Qualify dependency locks and restore required Biofirm secret scanning - #9
Merged
Merged
Conversation
Bumps [pytest](https://github.com/pytest-dev/pytest) from 9.0.3 to 9.1.1. - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.3...9.1.1) --- updated-dependencies: - dependency-name: pytest dependency-version: 9.1.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [requests](https://github.com/psf/requests) from 2.33.0 to 2.34.2. - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.33.0...v2.34.2) --- updated-dependencies: - dependency-name: requests dependency-version: 2.34.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [inferactively-pymdp](https://github.com/infer-actively/pymdp) from 1.0.3 to 1.0.4. - [Release notes](https://github.com/infer-actively/pymdp/releases) - [Changelog](https://github.com/infer-actively/pymdp/blob/main/CHANGELOG.md) - [Commits](infer-actively/pymdp@v1.0.3...v1.0.4) --- updated-dependencies: - dependency-name: inferactively-pymdp dependency-version: 1.0.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…ofirm-qualified-dependencies-20261018
…ofirm-qualified-dependencies-20261018
…ofirm-qualified-dependencies-20261018
docxology
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The three dependency proposals updated pyproject.toml without updating the committed universal and exported locks. Integrate pytest 9.1.1, requests 2.34.2 and inferactively-pymdp 1.0.4, and regenerate both locks with the exact CI uv 0.11.6. The transitive cryptography resolution also updates from 49.0.0 to patched 50.0.2 for the actual open GHSA-g6cj-pr64-35w5 advisory. All other resolved package versions and all application, test and data bytes remain unchanged. Original proposal histories are parents of this integration.
Validation: all 102 tests pass, 90.05% coverage; Ruff and format, strict typing, Bandit, repository scan, documentation/data validation, wheel and sdist. The original isolated installed-wheel commands also pass outside the checkout: validation, slide-rule simulation, random-controller sweep, analysis, visualization, description parsing and business evaluation. Existing tests exercise the real active-inference dependency. No scientific research result is promoted by this software qualification.
Addresses #6, #7 and #8. Fresh Python 3.11 and 3.12 hosted gates are required before integration.
The final cryptography 50.0.2 locks passed the complete 102-test owner suite and the same real isolated installed-wheel controls again. The prior three-dependency qualification is retained separately. Alert closure is verified after main publication, never dismissed manually.
The licensed Gitleaks Action fails before scanning for this organization. The required replacement uses SHA-256-verified official Gitleaks8.30.1, full checkout history and synthetic negative controls. The human owner confirmed on2026-10-18 that all affected historical OpenAI keys were revoked. Four exact commit/path/rule/line fingerprints are recorded in.gitleaksignore; no broad path, rule or pattern exemption is added. This records owner-reported revocation rather than independently checking the provider. The actual full-history scan passes with these four exact exceptions. A synthetic new Git commit at the former key-file path is still rejected, as is the directory control. No secret values are published or tested against services; historical credentials are not claimed absent.