Repository navigation
Update RxInfer 6.1, fix aiohttp/Pillow advisories, and streamline CI - #275
Merged
Merged
Conversation
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.38.3 to 4.39.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@24c5418...6f2ac81) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.38.3 to 4.39.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@24c5418...6f2ac81) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.39.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.38.3 to 4.39.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@24c5418...6f2ac81) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.39.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
docxology
marked this pull request as ready for review
October 20, 2026 23:00
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The committed Julia environments and native examples now support RxInfer 6.1.0 / ReactiveMP 7 on Julia 1.13.2. Migrate trajectory custom rules and retain exact categorical/Gaussian numerical witnesses and structured-model checks. Execution uses the frozen environments and fails explicitly when prerequisites are unavailable.
Resolve aiohttp 3.14.5 with a security floor of 3.14.4 for Dependabot alerts 195–197. Resolve Pillow 13.0.0 for nine additional advisories found by the final security audit. The latest Gradio still caps Pillow below 13, so supported frozen uv GUI profiles use an explicit override, qualified with native GUI/PNG/GIF/report checks. Document that plain pip GUI/all installs cannot resolve the upstream cap. Hashed security exports retain strict OSV checks without re-resolving the frozen profile; interpreter/platform marker scope is explicit and no advisories are suppressed.
Refresh compatible Python dependencies with uv 0.13.4, admit JAX 0.12, and regenerate all three Julia manifests. Preserve the documented Python/HDF5, PyMDP/Flax, ActiveInference.jl/Distributions and FEP-uv compatibility requirements. The default is Python 3.14.8; older supported interpreters retain tested compatibility splits.
Consolidate deterministic CI gates under one owner and remove the duplicate 73-case quality selection, preserving every ordinary test, marker selection, coverage threshold and required-status aggregate. Integrate all three CodeQL v4.39.0 updates (#272–#274) through their original commits. Cache versioned Julia inputs while rerunning native acceptance. Provision and warm both Julia environments and checksum-verified Ollama 0.40.6, with the qualified Gemma 3 1B profile for the complete Gridworld pipeline.
Fix Step 2 child run-context isolation, NumPyro chain configuration, current bnlearn API calls, cached Gradio fixture restoration and native installed-module checks, explicit Ray worker interpreter, and controlled streaming deadline tests over real HTTP. Synchronize the real Dask cancellation fixture at the wait boundary so scheduler load cannot bypass its required typed-exception witness; retain every result-order, cancellation and deadline assertion. Convergence and timeout thresholds remain enforced. External-link audits retain all observations and fail on 404/410; blocked/transient responses remain inconclusive, with the stronger all-findings strict mode preserved.
Update current runtime/workflow/setup documentation, every declared optional profile, the default dev-group/extra distinction and patched Torch/bnlearn installation guidance. Preserve historical benchmark/runtime observations. The local environment is synced to the frozen Python 3.14 profile, with the older compatibility environment archived.
Pin the accepted, merged FEP companion #208 at 82bd9785e41ea6df3d6e44acc520fac7f34046e7. Its full 22-job/15-cell workflow, automatic PR workflow and independent actual artifact/PDF review passed. Fresh source pinning, canonical rendering and native Q7 capture preserve the historical receipts. GNN’s paired workflow checks current-Q7 source/provenance on Python 3.14 after five immutable custody stages; it supplies no new native or generated-runner execution claim.
Local validation: all 15 strict gates and six final paired-runtime stages; 285 focused native GUI/image/report tests, 311 companion custody/proof tests and 79 capture tests; core/all-extras OSV audits plus the Python 3.11 compatibility split. Final GNN qualification at 67af81a passed all 17 workflows, including CI; Comprehensive native coverage; RxInfer native compatibility; Full Extras (Weekly); Gridworld boundary check; Supply chain audit. Independently replayed all three actual comprehensive artifact ZIPs, source manifests, installed Pillow/aiohttp/Gradio versions, five complete native lanes per profile, unchanged coverage denominators and executed-statement unions; each profile exceeds 80%. Actual full-extras JUnit has 9394 passed, 26 optional skips, zero failures/errors. The real distributed module also passes 52 tests serially and 52 with two workers.
The companion’s actual merged-main full workflow (22 jobs and 15 platform cells) and uploaded source/package/native/font/render evidence are independently accepted. Scoped PDF review directly inspected all seven changed pages; 382 pages match the accepted baseline in pixels and layout text. No whole-manuscript-defect-free or generated-runner execution claim.