omnigent-ci[bot]
99e5ab4d59
* Bump version to 0.9.0.dev0 Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(deps): drop the stale gitpython cooldown exemption The per-package cutoff (2026-07-24) was added to make 3.1.55 resolvable while it was inside the P7D window; it aged out, and the frozen cutoff now excludes 3.1.56/3.1.57, which fix GHSA-p538-c434-8v24 and GHSA-3f7w-8rr8-f37f — so the OSV audit fails on any PR touching the lock. The global P7D cooldown admits 3.1.57 on its own now. Lockfile regen follows via /regen upgrade gitpython. Co-authored-by: Isaac Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com> * chore(oss): regenerate public lockfiles against public PyPI/npm * chore(oss): regenerate public lockfiles against public PyPI/npm * chore(deps): normalize the lockfile back to canonical form The /regen runs regenerate uv.lock without the normalize step the other lock-writing workflows gained, re-adding the size fields the canonical form forbids. Text-only cleanup; the resolved versions (gitpython 3.1.57, aiohttp 3.14.2) are unchanged. Co-authored-by: Isaac Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com> * chore(deps): restore main's pnpm-lock.yaml The /regen runs regenerate the npm lockfile from scratch even for a Python-only package upgrade; this PR changes no JS dependency, so main's lockfile is exactly right for it. Co-authored-by: Isaac Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com> --------- Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Dhruv Gupta <dhruv.gupta@databricks.com> Co-authored-by: omnigent-ci[bot] <294685417+omnigent-ci[bot]@users.noreply.github.com>
30 lines
1.9 KiB
TOML
30 lines
1.9 KiB
TOML
# Fail loudly on a uv too old to honor the cooldown below: relative
|
|
# `exclude-newer` durations parse from 0.11, and the lockfile sentinel
|
|
# handling that keeps `uv sync --locked` stable landed in 0.11.8.
|
|
required-version = ">=0.11.8"
|
|
|
|
# Dependency cooldown: never resolve a distribution uploaded within the
|
|
# last 7 days, so a compromised or yanked release has a window to surface
|
|
# before it gets pinned. uv records the relative span in uv.lock (as
|
|
# `exclude-newer-span`) rather than a fixed date, so the pinned versions
|
|
# stay reproducible and `uv sync --locked` keeps passing; the cooldown is
|
|
# only re-applied when a resolution actually runs (`uv lock`, `--upgrade`,
|
|
# `--refresh`, or a dependency change).
|
|
exclude-newer = "P7D"
|
|
|
|
# Per-package cooldown exemptions (each scoped to one package, a fixed date
|
|
# just past its publish time, so the global P7D supply-chain cooldown still
|
|
# guards every other dependency):
|
|
# - cwsandbox: first-party CoreWeave SDK pinned to an exact, tested version
|
|
# (the `cwsandbox` extra), published 2026-06-11. Drop once aged past P7D.
|
|
# - google-antigravity: the SDK the `antigravity` harness drives (the
|
|
# `antigravity` extra in pyproject), published 2026-06-11. Drop once aged
|
|
# past P7D.
|
|
# - cryptography / pydantic-settings: open security advisories. Exempted so the
|
|
# patched releases (48.0.1 / 2.14.2) are resolvable now rather than after the
|
|
# P7D window; the bump itself is applied via `/regen upgrade cryptography
|
|
# pydantic-settings` (uv lock --upgrade-package). Drop once both aged past P7D.
|
|
# - nimble-python: the verified Agent API V2 1.2 contract release, required by
|
|
# nimble_research for typed run fields. Drop once it has aged past P7D.
|
|
exclude-newer-package = { cwsandbox = "2026-06-12T00:00:00Z", google-antigravity = "2026-06-12T00:00:00Z", cryptography = "2026-06-26T00:00:00Z", pydantic-settings = "2026-06-26T00:00:00Z", nimble-python = "2026-07-29T00:00:00Z" }
|