chore(deps-dev): update hypothesis requirement from <7.0,>=6.165.4 to >=6.165.10,<7.0 in /agent-governance-python/agent-hypervisor #5549
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright (c) Microsoft Corporation. Licensed under the MIT License. | |
| name: Dependency Review | |
| on: | |
| pull_request: | |
| paths-ignore: | |
| - '**/*.md' | |
| - 'docs/**' | |
| - 'agent-governance-python/notebooks/**' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| dependency-review: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| with: | |
| fail-on-severity: moderate | |
| comment-summary-in-pr: always | |
| # The vendored Agent Control Specification engine (policy-engine/**) | |
| # brings a Rust dependency tree whose transitive crates carry a few | |
| # permissive licenses not originally on this list. Each was reviewed | |
| # and added explicitly so the policy change is visible in review: | |
| # - Unicode-3.0: Unicode Consortium license used by the ICU/zerovec | |
| # family (icu_*, tinystr, yoke, zerovec, unicode-ident, ...). | |
| # OSI-approved, permissive. | |
| # - Apache-2.0 WITH LLVM-exception (ar_archive_writer, target-lexicon): | |
| # Apache-2.0 (already allowed) plus a linking exception that is | |
| # strictly MORE permissive. | |
| # - CDLA-Permissive-2.0 (webpki-roots, webpki-root-certs): Mozilla CA | |
| # trust-root data under a permissive Community Data License. | |
| allow-licenses: > | |
| MIT, Apache-2.0, Apache-2.0 WITH LLVM-exception, | |
| BSD-2-Clause, BSD-3-Clause, ISC, | |
| PSF-2.0, Python-2.0, 0BSD, Unlicense, CC0-1.0, | |
| CC-BY-4.0, Zlib, BSL-1.0, MPL-2.0, JSON, | |
| Unicode-3.0, CDLA-Permissive-2.0 | |
| # futures-timer declares a non-conformant SPDX expression | |
| # ("MIT/Apache-2.0") that the scanner reports as | |
| # LicenseRef-bad-mitapache-2.0. The crate is in fact dual-licensed | |
| # MIT OR Apache-2.0 (both allowed above), so allow it by package | |
| # rather than encoding the malformed identifier in allow-licenses. | |
| allow-dependencies-licenses: pkg:cargo/futures-timer |