Repository navigation
fix: patch Python runtime and certificate trust dependencies - #119
Merged
Merged
Conversation
Update only affected security pins, installer bootstrapping and runtime image sources. Preserve application behavior and unrelated dependency versions. Validation: reviewed focused diffs, parsed changed manifests and checked updated package artifacts against official PyPI hashes. Project tests, environment synchronization, builds and deployments were not run, as requested. Co-authored-by: Codex <codex@openai.com>
uv 0.13.4 cannot find a standalone CPython 3.13.17 download. Use the official setup-python action pinned to its verified v6 commit in quality and release jobs, and request the same patched interpreter in release commands. Preserve uv 0.13.4 and all existing quality requirements. Validation: verified Python 3.13.17 Linux artifacts in actions/python-versions, parsed the workflow YAML and inspected installer ordering. No project tests, builds or installer execution were run locally. Co-authored-by: Codex <codex@openai.com>
Use the existing unbracketed version heading for the 2.0.25 security release so the release contract and publishing workflow can parse it. Keep the security versions and application code unchanged. Validation: inspected the one-line diff and the existing release parser; git diff --check passed. No project tests were run locally. Co-authored-by: Codex <codex@openai.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The SDK and consumer fixture locks selected the affected certifi bundle. Require certifi >=2026.10.19 in published dependencies, refresh those lock entries, pin Python 3.13.17 and uv 0.13.4, and prepare ms-tau-sdk 2.0.25. Use the official setup-python action for Python 3.13.17 because uv's standalone interpreter catalog lacks that release. Keep the changelog heading in TAU's established release format so release validation can parse version 2.0.25. Application APIs are unchanged.
Security context: certifi/emSign advisory and Python 3.13.17.
Validation: focused diff review, static parsing of changed manifests, consistency checks between package metadata and locks, and comparison of updated artifact hashes with official PyPI metadata. No project tests, environment sync, builds, package publication, deployments or service restarts were run locally. The existing required GitHub Quality workflow passed on adb5085, including formatting, lint, type checks, package/consumer checks and tests: https://github.com/mainsequence-sdk/ms-tau-sdk/actions/runs/39854972680. No unrelated dependency upgrades are included.