Skip to content

chore(deps-dev): update hypothesis requirement from <7.0,>=6.165.4 to >=6.165.10,<7.0 in /agent-governance-python/agent-hypervisor #5549

chore(deps-dev): update hypothesis requirement from <7.0,>=6.165.4 to >=6.165.10,<7.0 in /agent-governance-python/agent-hypervisor

chore(deps-dev): update hypothesis requirement from <7.0,>=6.165.4 to >=6.165.10,<7.0 in /agent-governance-python/agent-hypervisor #5549

# Copyright (c) Microsoft Corporation. Licensed under the MIT License.
name: Dependency Review
on:
pull_request:
paths-ignore:
- '**/*.md'
- 'docs/**'
- 'agent-governance-python/notebooks/**'
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
permissions:
contents: read
pull-requests: write
jobs:
dependency-review:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
with:
fail-on-severity: moderate
comment-summary-in-pr: always
# The vendored Agent Control Specification engine (policy-engine/**)
# brings a Rust dependency tree whose transitive crates carry a few
# permissive licenses not originally on this list. Each was reviewed
# and added explicitly so the policy change is visible in review:
# - Unicode-3.0: Unicode Consortium license used by the ICU/zerovec
# family (icu_*, tinystr, yoke, zerovec, unicode-ident, ...).
# OSI-approved, permissive.
# - Apache-2.0 WITH LLVM-exception (ar_archive_writer, target-lexicon):
# Apache-2.0 (already allowed) plus a linking exception that is
# strictly MORE permissive.
# - CDLA-Permissive-2.0 (webpki-roots, webpki-root-certs): Mozilla CA
# trust-root data under a permissive Community Data License.
allow-licenses: >
MIT, Apache-2.0, Apache-2.0 WITH LLVM-exception,
BSD-2-Clause, BSD-3-Clause, ISC,
PSF-2.0, Python-2.0, 0BSD, Unlicense, CC0-1.0,
CC-BY-4.0, Zlib, BSL-1.0, MPL-2.0, JSON,
Unicode-3.0, CDLA-Permissive-2.0
# futures-timer declares a non-conformant SPDX expression
# ("MIT/Apache-2.0") that the scanner reports as
# LicenseRef-bad-mitapache-2.0. The crate is in fact dual-licensed
# MIT OR Apache-2.0 (both allowed above), so allow it by package
# rather than encoding the malformed identifier in allow-licenses.
allow-dependencies-licenses: pkg:cargo/futures-timer