diff --git a/.github/workflows/negentropy-perceives-ci.yml b/.github/workflows/negentropy-perceives-ci.yml index 6f5ae150d..bbf84b548 100644 --- a/.github/workflows/negentropy-perceives-ci.yml +++ b/.github/workflows/negentropy-perceives-ci.yml @@ -235,6 +235,12 @@ jobs: # transformers 受 pillow 冲突钉死 4.57.6，二者在 docling engine worker 导入链上不兼容 #（实测 parse-pdf 由 Success 变 Failed: cannot import name AutoProcessor）——见 I-092 --ignore-vuln CVE-2025-3000 + + # litellm 1.96.2 CVE-2026-114612（GHSA-7hp6-4w63-5g45）：仅在显式开启 + # EXPERIMENTAL_UI_LOGIN=true 时经 salt-key 复用提权 proxy_admin（RCE）——本项目 + # 未启用 proxy UI 登录（默认 false），攻击向量不可达；修复在 1.100.4+，需跳新线， + # 与 apps/negentropy 侧 litellm 残留同口径，随 litellm 新线升级一并清偿（follow-up） + --ignore-vuln CVE-2026-114612 ) uv run pip-audit "${ignore_args[@]}" diff --git a/apps/negentropy-influence/episodes/agent-skills-video/video/pnpm-lock.yaml b/apps/negentropy-influence/episodes/agent-skills-video/video/pnpm-lock.yaml index 60d21484c..9553a5e9c 100644 --- a/apps/negentropy-influence/episodes/agent-skills-video/video/pnpm-lock.yaml +++ b/apps/negentropy-influence/episodes/agent-skills-video/video/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: js-yaml: '>=4.3.2 <5.0.0' source-map-js: '>=1.2.2 <2.0.0' + fast-uri: '>=3.1.8 <4.0.0' importers: @@ -896,8 +897,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.7: - resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fs-monkey@1.0.3: resolution: {integrity: sha512-cybjIfiiE+pTWicSCLFHSrXZ6EilF30oh91FDP9S2B051prEa7QWfrVTQm10/dDpswBDXZugPa1Ogu8Yh+HV0Q==} @@ -2192,7 +2193,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.7 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2355,7 +2356,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.7: {} + fast-uri@3.1.9: {} fs-monkey@1.0.3: {} diff --git a/apps/negentropy-influence/episodes/agent-skills-video/video/pnpm-workspace.yaml b/apps/negentropy-influence/episodes/agent-skills-video/video/pnpm-workspace.yaml index a8e4981c3..13b1fa7cb 100644 --- a/apps/negentropy-influence/episodes/agent-skills-video/video/pnpm-workspace.yaml +++ b/apps/negentropy-influence/episodes/agent-skills-video/video/pnpm-workspace.yaml @@ -48,3 +48,6 @@ overrides: # GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免 # major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。 source-map-js: '>=1.2.2 <2.0.0' + # GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本 + # 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。 + fast-uri: '>=3.1.8 <4.0.0' diff --git a/apps/negentropy-influence/episodes/claude-code-concurrency-video/video/pnpm-lock.yaml b/apps/negentropy-influence/episodes/claude-code-concurrency-video/video/pnpm-lock.yaml index 736d07e2f..bb75de2e9 100644 --- a/apps/negentropy-influence/episodes/claude-code-concurrency-video/video/pnpm-lock.yaml +++ b/apps/negentropy-influence/episodes/claude-code-concurrency-video/video/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: js-yaml: '>=4.3.2 <5.0.0' source-map-js: '>=1.2.2 <2.0.0' + fast-uri: '>=3.1.8 <4.0.0' importers: @@ -988,8 +989,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.7: - resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fflate@0.8.3: resolution: {integrity: sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==} @@ -2396,7 +2397,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.7 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2566,7 +2567,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.7: {} + fast-uri@3.1.9: {} fflate@0.8.3: {} diff --git a/apps/negentropy-influence/episodes/claude-code-concurrency-video/video/pnpm-workspace.yaml b/apps/negentropy-influence/episodes/claude-code-concurrency-video/video/pnpm-workspace.yaml index 8568d679a..3dd447ba0 100644 --- a/apps/negentropy-influence/episodes/claude-code-concurrency-video/video/pnpm-workspace.yaml +++ b/apps/negentropy-influence/episodes/claude-code-concurrency-video/video/pnpm-workspace.yaml @@ -16,3 +16,6 @@ overrides: # GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免 # major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。 source-map-js: '>=1.2.2 <2.0.0' + # GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本 + # 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。 + fast-uri: '>=3.1.8 <4.0.0' diff --git a/apps/negentropy-influence/episodes/claude-code-explained-video/video/pnpm-lock.yaml b/apps/negentropy-influence/episodes/claude-code-explained-video/video/pnpm-lock.yaml index 736d07e2f..bb75de2e9 100644 --- a/apps/negentropy-influence/episodes/claude-code-explained-video/video/pnpm-lock.yaml +++ b/apps/negentropy-influence/episodes/claude-code-explained-video/video/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: js-yaml: '>=4.3.2 <5.0.0' source-map-js: '>=1.2.2 <2.0.0' + fast-uri: '>=3.1.8 <4.0.0' importers: @@ -988,8 +989,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.7: - resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fflate@0.8.3: resolution: {integrity: sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==} @@ -2396,7 +2397,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.7 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2566,7 +2567,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.7: {} + fast-uri@3.1.9: {} fflate@0.8.3: {} diff --git a/apps/negentropy-influence/episodes/claude-code-explained-video/video/pnpm-workspace.yaml b/apps/negentropy-influence/episodes/claude-code-explained-video/video/pnpm-workspace.yaml index 8568d679a..3dd447ba0 100644 --- a/apps/negentropy-influence/episodes/claude-code-explained-video/video/pnpm-workspace.yaml +++ b/apps/negentropy-influence/episodes/claude-code-explained-video/video/pnpm-workspace.yaml @@ -16,3 +16,6 @@ overrides: # GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免 # major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。 source-map-js: '>=1.2.2 <2.0.0' + # GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本 + # 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。 + fast-uri: '>=3.1.8 <4.0.0' diff --git a/apps/negentropy-influence/episodes/claude-code-memory-video/video/pnpm-lock.yaml b/apps/negentropy-influence/episodes/claude-code-memory-video/video/pnpm-lock.yaml index 736d07e2f..bb75de2e9 100644 --- a/apps/negentropy-influence/episodes/claude-code-memory-video/video/pnpm-lock.yaml +++ b/apps/negentropy-influence/episodes/claude-code-memory-video/video/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: js-yaml: '>=4.3.2 <5.0.0' source-map-js: '>=1.2.2 <2.0.0' + fast-uri: '>=3.1.8 <4.0.0' importers: @@ -988,8 +989,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.7: - resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fflate@0.8.3: resolution: {integrity: sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==} @@ -2396,7 +2397,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.7 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2566,7 +2567,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.7: {} + fast-uri@3.1.9: {} fflate@0.8.3: {} diff --git a/apps/negentropy-influence/episodes/claude-code-memory-video/video/pnpm-workspace.yaml b/apps/negentropy-influence/episodes/claude-code-memory-video/video/pnpm-workspace.yaml index 8568d679a..3dd447ba0 100644 --- a/apps/negentropy-influence/episodes/claude-code-memory-video/video/pnpm-workspace.yaml +++ b/apps/negentropy-influence/episodes/claude-code-memory-video/video/pnpm-workspace.yaml @@ -16,3 +16,6 @@ overrides: # GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免 # major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。 source-map-js: '>=1.2.2 <2.0.0' + # GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本 + # 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。 + fast-uri: '>=3.1.8 <4.0.0' diff --git a/apps/negentropy-influence/episodes/claude-code-multiagent-video/video/pnpm-lock.yaml b/apps/negentropy-influence/episodes/claude-code-multiagent-video/video/pnpm-lock.yaml index c8b450222..f56bf2ff0 100644 --- a/apps/negentropy-influence/episodes/claude-code-multiagent-video/video/pnpm-lock.yaml +++ b/apps/negentropy-influence/episodes/claude-code-multiagent-video/video/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: js-yaml: '>=4.3.2 <5.0.0' source-map-js: '>=1.2.2 <2.0.0' + fast-uri: '>=3.1.8 <4.0.0' importers: @@ -975,8 +976,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.7: - resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fflate@0.8.3: resolution: {integrity: sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==} @@ -2373,7 +2374,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.7 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2543,7 +2544,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.7: {} + fast-uri@3.1.9: {} fflate@0.8.3: {} diff --git a/apps/negentropy-influence/episodes/claude-code-multiagent-video/video/pnpm-workspace.yaml b/apps/negentropy-influence/episodes/claude-code-multiagent-video/video/pnpm-workspace.yaml index 8568d679a..3dd447ba0 100644 --- a/apps/negentropy-influence/episodes/claude-code-multiagent-video/video/pnpm-workspace.yaml +++ b/apps/negentropy-influence/episodes/claude-code-multiagent-video/video/pnpm-workspace.yaml @@ -16,3 +16,6 @@ overrides: # GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免 # major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。 source-map-js: '>=1.2.2 <2.0.0' + # GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本 + # 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。 + fast-uri: '>=3.1.8 <4.0.0' diff --git a/apps/negentropy-influence/episodes/claude-code-planning-video/video/pnpm-lock.yaml b/apps/negentropy-influence/episodes/claude-code-planning-video/video/pnpm-lock.yaml index 736d07e2f..bb75de2e9 100644 --- a/apps/negentropy-influence/episodes/claude-code-planning-video/video/pnpm-lock.yaml +++ b/apps/negentropy-influence/episodes/claude-code-planning-video/video/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: js-yaml: '>=4.3.2 <5.0.0' source-map-js: '>=1.2.2 <2.0.0' + fast-uri: '>=3.1.8 <4.0.0' importers: @@ -988,8 +989,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.7: - resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fflate@0.8.3: resolution: {integrity: sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==} @@ -2396,7 +2397,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.7 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2566,7 +2567,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.7: {} + fast-uri@3.1.9: {} fflate@0.8.3: {} diff --git a/apps/negentropy-influence/episodes/claude-code-planning-video/video/pnpm-workspace.yaml b/apps/negentropy-influence/episodes/claude-code-planning-video/video/pnpm-workspace.yaml index 8568d679a..3dd447ba0 100644 --- a/apps/negentropy-influence/episodes/claude-code-planning-video/video/pnpm-workspace.yaml +++ b/apps/negentropy-influence/episodes/claude-code-planning-video/video/pnpm-workspace.yaml @@ -16,3 +16,6 @@ overrides: # GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免 # major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。 source-map-js: '>=1.2.2 <2.0.0' + # GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本 + # 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。 + fast-uri: '>=3.1.8 <4.0.0' diff --git a/apps/negentropy-influence/episodes/context-layer-video/video/pnpm-lock.yaml b/apps/negentropy-influence/episodes/context-layer-video/video/pnpm-lock.yaml index 043dde87c..b8d073d53 100644 --- a/apps/negentropy-influence/episodes/context-layer-video/video/pnpm-lock.yaml +++ b/apps/negentropy-influence/episodes/context-layer-video/video/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: js-yaml: '>=4.3.2 <5.0.0' source-map-js: '>=1.2.2 <2.0.0' + fast-uri: '>=3.1.8 <4.0.0' importers: @@ -862,8 +863,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.7: - resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fs-monkey@1.0.3: resolution: {integrity: sha512-cybjIfiiE+pTWicSCLFHSrXZ6EilF30oh91FDP9S2B051prEa7QWfrVTQm10/dDpswBDXZugPa1Ogu8Yh+HV0Q==} @@ -2107,7 +2108,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.7 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2270,7 +2271,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.7: {} + fast-uri@3.1.9: {} fs-monkey@1.0.3: {} diff --git a/apps/negentropy-influence/episodes/context-layer-video/video/pnpm-workspace.yaml b/apps/negentropy-influence/episodes/context-layer-video/video/pnpm-workspace.yaml index 8568d679a..3dd447ba0 100644 --- a/apps/negentropy-influence/episodes/context-layer-video/video/pnpm-workspace.yaml +++ b/apps/negentropy-influence/episodes/context-layer-video/video/pnpm-workspace.yaml @@ -16,3 +16,6 @@ overrides: # GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免 # major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。 source-map-js: '>=1.2.2 <2.0.0' + # GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本 + # 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。 + fast-uri: '>=3.1.8 <4.0.0' diff --git a/apps/negentropy-influence/episodes/dream-rsi-video/video/pnpm-lock.yaml b/apps/negentropy-influence/episodes/dream-rsi-video/video/pnpm-lock.yaml index 043dde87c..b8d073d53 100644 --- a/apps/negentropy-influence/episodes/dream-rsi-video/video/pnpm-lock.yaml +++ b/apps/negentropy-influence/episodes/dream-rsi-video/video/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: js-yaml: '>=4.3.2 <5.0.0' source-map-js: '>=1.2.2 <2.0.0' + fast-uri: '>=3.1.8 <4.0.0' importers: @@ -862,8 +863,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.7: - resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fs-monkey@1.0.3: resolution: {integrity: sha512-cybjIfiiE+pTWicSCLFHSrXZ6EilF30oh91FDP9S2B051prEa7QWfrVTQm10/dDpswBDXZugPa1Ogu8Yh+HV0Q==} @@ -2107,7 +2108,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.7 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2270,7 +2271,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.7: {} + fast-uri@3.1.9: {} fs-monkey@1.0.3: {} diff --git a/apps/negentropy-influence/episodes/dream-rsi-video/video/pnpm-workspace.yaml b/apps/negentropy-influence/episodes/dream-rsi-video/video/pnpm-workspace.yaml index 8568d679a..3dd447ba0 100644 --- a/apps/negentropy-influence/episodes/dream-rsi-video/video/pnpm-workspace.yaml +++ b/apps/negentropy-influence/episodes/dream-rsi-video/video/pnpm-workspace.yaml @@ -16,3 +16,6 @@ overrides: # GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免 # major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。 source-map-js: '>=1.2.2 <2.0.0' + # GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本 + # 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。 + fast-uri: '>=3.1.8 <4.0.0' diff --git a/apps/negentropy-influence/episodes/experience-era-agents-video/video/pnpm-lock.yaml b/apps/negentropy-influence/episodes/experience-era-agents-video/video/pnpm-lock.yaml index 043dde87c..b8d073d53 100644 --- a/apps/negentropy-influence/episodes/experience-era-agents-video/video/pnpm-lock.yaml +++ b/apps/negentropy-influence/episodes/experience-era-agents-video/video/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: js-yaml: '>=4.3.2 <5.0.0' source-map-js: '>=1.2.2 <2.0.0' + fast-uri: '>=3.1.8 <4.0.0' importers: @@ -862,8 +863,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.7: - resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fs-monkey@1.0.3: resolution: {integrity: sha512-cybjIfiiE+pTWicSCLFHSrXZ6EilF30oh91FDP9S2B051prEa7QWfrVTQm10/dDpswBDXZugPa1Ogu8Yh+HV0Q==} @@ -2107,7 +2108,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.7 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2270,7 +2271,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.7: {} + fast-uri@3.1.9: {} fs-monkey@1.0.3: {} diff --git a/apps/negentropy-influence/episodes/experience-era-agents-video/video/pnpm-workspace.yaml b/apps/negentropy-influence/episodes/experience-era-agents-video/video/pnpm-workspace.yaml index 8568d679a..3dd447ba0 100644 --- a/apps/negentropy-influence/episodes/experience-era-agents-video/video/pnpm-workspace.yaml +++ b/apps/negentropy-influence/episodes/experience-era-agents-video/video/pnpm-workspace.yaml @@ -16,3 +16,6 @@ overrides: # GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免 # major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。 source-map-js: '>=1.2.2 <2.0.0' + # GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本 + # 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。 + fast-uri: '>=3.1.8 <4.0.0' diff --git a/apps/negentropy-influence/episodes/horizon-context-video/video/pnpm-lock.yaml b/apps/negentropy-influence/episodes/horizon-context-video/video/pnpm-lock.yaml index 66781a41c..eec8d9b9f 100644 --- a/apps/negentropy-influence/episodes/horizon-context-video/video/pnpm-lock.yaml +++ b/apps/negentropy-influence/episodes/horizon-context-video/video/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: js-yaml: '>=4.3.2 <5.0.0' source-map-js: '>=1.2.2 <2.0.0' + fast-uri: '>=3.1.8 <4.0.0' importers: @@ -887,8 +888,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.7: - resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fs-monkey@1.0.3: resolution: {integrity: sha512-cybjIfiiE+pTWicSCLFHSrXZ6EilF30oh91FDP9S2B051prEa7QWfrVTQm10/dDpswBDXZugPa1Ogu8Yh+HV0Q==} @@ -2170,7 +2171,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.7 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2333,7 +2334,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.7: {} + fast-uri@3.1.9: {} fs-monkey@1.0.3: {} diff --git a/apps/negentropy-influence/episodes/horizon-context-video/video/pnpm-workspace.yaml b/apps/negentropy-influence/episodes/horizon-context-video/video/pnpm-workspace.yaml index 8568d679a..3dd447ba0 100644 --- a/apps/negentropy-influence/episodes/horizon-context-video/video/pnpm-workspace.yaml +++ b/apps/negentropy-influence/episodes/horizon-context-video/video/pnpm-workspace.yaml @@ -16,3 +16,6 @@ overrides: # GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免 # major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。 source-map-js: '>=1.2.2 <2.0.0' + # GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本 + # 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。 + fast-uri: '>=3.1.8 <4.0.0' diff --git a/apps/negentropy-influence/episodes/jev-decision-model-video/video/pnpm-lock.yaml b/apps/negentropy-influence/episodes/jev-decision-model-video/video/pnpm-lock.yaml index 043dde87c..b8d073d53 100644 --- a/apps/negentropy-influence/episodes/jev-decision-model-video/video/pnpm-lock.yaml +++ b/apps/negentropy-influence/episodes/jev-decision-model-video/video/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: js-yaml: '>=4.3.2 <5.0.0' source-map-js: '>=1.2.2 <2.0.0' + fast-uri: '>=3.1.8 <4.0.0' importers: @@ -862,8 +863,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.7: - resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fs-monkey@1.0.3: resolution: {integrity: sha512-cybjIfiiE+pTWicSCLFHSrXZ6EilF30oh91FDP9S2B051prEa7QWfrVTQm10/dDpswBDXZugPa1Ogu8Yh+HV0Q==} @@ -2107,7 +2108,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.7 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2270,7 +2271,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.7: {} + fast-uri@3.1.9: {} fs-monkey@1.0.3: {} diff --git a/apps/negentropy-influence/episodes/jev-decision-model-video/video/pnpm-workspace.yaml b/apps/negentropy-influence/episodes/jev-decision-model-video/video/pnpm-workspace.yaml index 8568d679a..3dd447ba0 100644 --- a/apps/negentropy-influence/episodes/jev-decision-model-video/video/pnpm-workspace.yaml +++ b/apps/negentropy-influence/episodes/jev-decision-model-video/video/pnpm-workspace.yaml @@ -16,3 +16,6 @@ overrides: # GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免 # major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。 source-map-js: '>=1.2.2 <2.0.0' + # GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本 + # 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。 + fast-uri: '>=3.1.8 <4.0.0' diff --git a/apps/negentropy-influence/episodes/openviking-video/video/pnpm-lock.yaml b/apps/negentropy-influence/episodes/openviking-video/video/pnpm-lock.yaml index 043dde87c..b8d073d53 100644 --- a/apps/negentropy-influence/episodes/openviking-video/video/pnpm-lock.yaml +++ b/apps/negentropy-influence/episodes/openviking-video/video/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: js-yaml: '>=4.3.2 <5.0.0' source-map-js: '>=1.2.2 <2.0.0' + fast-uri: '>=3.1.8 <4.0.0' importers: @@ -862,8 +863,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.7: - resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fs-monkey@1.0.3: resolution: {integrity: sha512-cybjIfiiE+pTWicSCLFHSrXZ6EilF30oh91FDP9S2B051prEa7QWfrVTQm10/dDpswBDXZugPa1Ogu8Yh+HV0Q==} @@ -2107,7 +2108,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.7 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2270,7 +2271,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.7: {} + fast-uri@3.1.9: {} fs-monkey@1.0.3: {} diff --git a/apps/negentropy-influence/episodes/openviking-video/video/pnpm-workspace.yaml b/apps/negentropy-influence/episodes/openviking-video/video/pnpm-workspace.yaml index 8568d679a..3dd447ba0 100644 --- a/apps/negentropy-influence/episodes/openviking-video/video/pnpm-workspace.yaml +++ b/apps/negentropy-influence/episodes/openviking-video/video/pnpm-workspace.yaml @@ -16,3 +16,6 @@ overrides: # GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免 # major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。 source-map-js: '>=1.2.2 <2.0.0' + # GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本 + # 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。 + fast-uri: '>=3.1.8 <4.0.0' diff --git a/apps/negentropy-influence/episodes/self-evolving-coding-agents-video/video/pnpm-lock.yaml b/apps/negentropy-influence/episodes/self-evolving-coding-agents-video/video/pnpm-lock.yaml index 043dde87c..b8d073d53 100644 --- a/apps/negentropy-influence/episodes/self-evolving-coding-agents-video/video/pnpm-lock.yaml +++ b/apps/negentropy-influence/episodes/self-evolving-coding-agents-video/video/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: js-yaml: '>=4.3.2 <5.0.0' source-map-js: '>=1.2.2 <2.0.0' + fast-uri: '>=3.1.8 <4.0.0' importers: @@ -862,8 +863,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.7: - resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fs-monkey@1.0.3: resolution: {integrity: sha512-cybjIfiiE+pTWicSCLFHSrXZ6EilF30oh91FDP9S2B051prEa7QWfrVTQm10/dDpswBDXZugPa1Ogu8Yh+HV0Q==} @@ -2107,7 +2108,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.7 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2270,7 +2271,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.7: {} + fast-uri@3.1.9: {} fs-monkey@1.0.3: {} diff --git a/apps/negentropy-influence/episodes/self-evolving-coding-agents-video/video/pnpm-workspace.yaml b/apps/negentropy-influence/episodes/self-evolving-coding-agents-video/video/pnpm-workspace.yaml index 8568d679a..3dd447ba0 100644 --- a/apps/negentropy-influence/episodes/self-evolving-coding-agents-video/video/pnpm-workspace.yaml +++ b/apps/negentropy-influence/episodes/self-evolving-coding-agents-video/video/pnpm-workspace.yaml @@ -16,3 +16,6 @@ overrides: # GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免 # major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。 source-map-js: '>=1.2.2 <2.0.0' + # GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本 + # 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。 + fast-uri: '>=3.1.8 <4.0.0' diff --git a/apps/negentropy-influence/episodes/self-improving-agents-video/video/pnpm-lock.yaml b/apps/negentropy-influence/episodes/self-improving-agents-video/video/pnpm-lock.yaml index 920feb99a..bac1bb158 100644 --- a/apps/negentropy-influence/episodes/self-improving-agents-video/video/pnpm-lock.yaml +++ b/apps/negentropy-influence/episodes/self-improving-agents-video/video/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: js-yaml: '>=4.3.2 <5.0.0' source-map-js: '>=1.2.2 <2.0.0' + fast-uri: '>=3.1.8 <4.0.0' importers: @@ -862,8 +863,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.7: - resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fs-monkey@1.0.3: resolution: {integrity: sha512-cybjIfiiE+pTWicSCLFHSrXZ6EilF30oh91FDP9S2B051prEa7QWfrVTQm10/dDpswBDXZugPa1Ogu8Yh+HV0Q==} @@ -2107,7 +2108,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.7 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2270,7 +2271,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.7: {} + fast-uri@3.1.9: {} fs-monkey@1.0.3: {} diff --git a/apps/negentropy-influence/episodes/self-improving-agents-video/video/pnpm-workspace.yaml b/apps/negentropy-influence/episodes/self-improving-agents-video/video/pnpm-workspace.yaml index 8568d679a..3dd447ba0 100644 --- a/apps/negentropy-influence/episodes/self-improving-agents-video/video/pnpm-workspace.yaml +++ b/apps/negentropy-influence/episodes/self-improving-agents-video/video/pnpm-workspace.yaml @@ -16,3 +16,6 @@ overrides: # GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免 # major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。 source-map-js: '>=1.2.2 <2.0.0' + # GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本 + # 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。 + fast-uri: '>=3.1.8 <4.0.0' diff --git a/apps/negentropy-influence/episodes/skills-supply-chain-video/video/pnpm-lock.yaml b/apps/negentropy-influence/episodes/skills-supply-chain-video/video/pnpm-lock.yaml index 043dde87c..b8d073d53 100644 --- a/apps/negentropy-influence/episodes/skills-supply-chain-video/video/pnpm-lock.yaml +++ b/apps/negentropy-influence/episodes/skills-supply-chain-video/video/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: js-yaml: '>=4.3.2 <5.0.0' source-map-js: '>=1.2.2 <2.0.0' + fast-uri: '>=3.1.8 <4.0.0' importers: @@ -862,8 +863,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.7: - resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fs-monkey@1.0.3: resolution: {integrity: sha512-cybjIfiiE+pTWicSCLFHSrXZ6EilF30oh91FDP9S2B051prEa7QWfrVTQm10/dDpswBDXZugPa1Ogu8Yh+HV0Q==} @@ -2107,7 +2108,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.7 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2270,7 +2271,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.7: {} + fast-uri@3.1.9: {} fs-monkey@1.0.3: {} diff --git a/apps/negentropy-influence/episodes/skills-supply-chain-video/video/pnpm-workspace.yaml b/apps/negentropy-influence/episodes/skills-supply-chain-video/video/pnpm-workspace.yaml index 8568d679a..3dd447ba0 100644 --- a/apps/negentropy-influence/episodes/skills-supply-chain-video/video/pnpm-workspace.yaml +++ b/apps/negentropy-influence/episodes/skills-supply-chain-video/video/pnpm-workspace.yaml @@ -16,3 +16,6 @@ overrides: # GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免 # major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。 source-map-js: '>=1.2.2 <2.0.0' + # GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本 + # 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。 + fast-uri: '>=3.1.8 <4.0.0' diff --git a/apps/negentropy-perceives/pyproject.toml b/apps/negentropy-perceives/pyproject.toml index 071f5b4e0..d544ad797 100644 --- a/apps/negentropy-perceives/pyproject.toml +++ b/apps/negentropy-perceives/pyproject.toml @@ -31,7 +31,7 @@ classifiers = [ dependencies = [ # --- MCP 框架 --- - "fastmcp>=3.2.4", + "fastmcp>=3.4.10", # --- 网页抓取 --- "aiohttp>=3.14.4", # >=3.14.0 修复 CVE-2026-34993 / CVE-2026-47265；>=3.14.4 修复 CVE-2026-111063..111066/111748..111750, GHSA-2g87-pp6c-29x5（I-237 2026-10-23 增补） "beautifulsoup4>=4.14.0", @@ -189,7 +189,8 @@ ignore_missing_imports = true # lxml>=6.1.0：修复 CVE-2026-41066（间接依赖） # urllib3>=2.8.0：修复 CVE-2026-44431, CVE-2026-44432 与 PYSEC-2026-4175/4176/4177（间接依赖；I-231 抬地板） # idna>=3.15：修复 CVE-2026-45409（间接依赖，requests/urllib3 传递依赖） -# authlib>=1.7.1：修复 GHSA-r95x-qfjj-fjj2（OIDC Implicit/Hybrid Open Redirect，medium） +# authlib>=1.7.1：修复 GHSA-r95x-qfjj-fjj2（OIDC Implicit/Hybrid Open Redirect，medium）； +# >=1.9.0 修复 CVE-2026-96760 + CVE-2026-114614..114618/114620（fastmcp 传递，fix 1.8.0/1.9.0/1.9.1） # joserfc>=1.6.7：修复 CVE-2026-48990（间接依赖 fastmcp → authlib → joserfc） # openai>=2.20.0：litellm>=1.83.7 要求 openai>=2.20.0（覆盖 marker-pdf<2.0.0 约束） # transformers 锁定 4.x——根因已更新（2026-09-06）：marker-pdf 2.0.0 / surya-ocr 0.22.1 已适配 transformers>=5.12.1（旧「transformers.onnx 崩溃」不再成立），但二者同时要求 pillow<11，与本项目 pillow 系列抬地板（12.3.0 修 8 条、13.0.0 修 35 条图像解析 CVE，本项目直接解析不可信 PDF/图片、攻击面可达）直接冲突；transformers 零直接 import、仅加载第一方模型 artifact，攻击面不可达——升级为负收益交换。mineru 3.0.9 的 transformers<5.0.0 仅 vlm/pipeline extra 生效，不构成约束 @@ -200,7 +201,7 @@ ignore_missing_imports = true # starlette>=1.3.1：修复 CVE-2026-48817/48818/54282/54283（间接依赖 fastapi，MCP http-transport 攻击面） # python-multipart>=0.0.32：修复 CVE-2026-53538/53539/53540（间接依赖 fastapi，表单解析攻击面） # cryptography>=48.0.1：修复 GHSA-537c-gmf6-5ccf（间接依赖 authlib/google-auth/joserfc/pdfminer-six/secretstorage） -# msgpack>=1.2.1：修复 GHSA-6v7p-g79w-8964（传递依赖，反序列化 DoS） +# msgpack>=1.2.1：修复 GHSA-6v7p-g79w-8964（传递依赖，反序列化 DoS）；>=1.2.3 修复 CVE-2026-114613 # pillow>=13.0.0（覆盖上方 12.2.0 统一约束）：12.3.0 修 PYSEC-2026-2253/2254/2255/2256/2257/3451/3452/3453；13.0.0 修 2026-10-23 新报 35 条（CVE-2026-112390..112406/112891..112901/96636..96644/96778, GHSA-78g4-xqwv-q3g8，fixed 仅 13.0.0；图像解析攻击面，perceives 直接解析不可信 PDF/图片，必须升级）——marker-pdf/surya 的 pillow<11 声明在 12.3.0 抬地板时已越（见上），13.0.0 同机制继续 override（I-237） # click>=8.3.3：修复 PYSEC-2026-2132（传递依赖 typer/uvicorn/litellm/marker-pdf/mineru/surya-ocr 等） # json-repair>=0.60.1：修复 GHSA-xf7x-x43h-rpqh（传递依赖 mineru） @@ -209,7 +210,11 @@ ignore_missing_imports = true # certifi>=2026.10.19：修复 PYSEC-2026-4320（间接依赖 requests/httpx/selenium/trafilatura/docling-slim；I-237） # opentelemetry-api>=1.45.1：修复 CVE-2026-114603（间接依赖 fastmcp；I-237） # virtualenv>=21.14.9：修复 CVE-2026-113722/113725（dev 组 pre-commit 传递；I-237） -override-dependencies = ["pillow>=13.0.0", "lxml>=6.1.0", "urllib3>=2.8.0", "idna>=3.15", "authlib>=1.7.1", "joserfc>=1.6.7", "transformers>=4.56.1,<5.0.0", "openai>=2.20.0", "pyjwt>=2.15.0", "docling-core>=2.101.1", "starlette>=1.3.1", "python-multipart>=0.0.32", "cryptography>=48.0.1", "msgpack>=1.2.1", "click>=8.3.3", "json-repair>=0.60.1", "mcp>=1.30.0", "datasets>=5.0.1", "certifi>=2026.10.19", "opentelemetry-api>=1.45.1", "virtualenv>=21.14.9"] +# fastmcp>=3.4.10：修复 GHSA-7xgj-8392-5q4r（直接依赖；3.2.4→3.4.x 公共 API 兼容，3.4 起拆出 fastmcp-slim 子包） +# filelock>=4.2.1：修复 CVE-2026-112907/112913/112940（传递依赖，fix 仅 4.x；FileLock 公共 API 3→4 兼容） +# setuptools>=84.1.0：修复 GHSA-xmj3-9gf7-h52w（传递依赖） +# dnspython>=2.9.0：修复 CVE-2026-114605（email-validator 传递） +override-dependencies = ["pillow>=13.0.0", "lxml>=6.1.0", "urllib3>=2.8.0", "idna>=3.15", "authlib>=1.9.0", "joserfc>=1.6.7", "transformers>=4.56.1,<5.0.0", "openai>=2.20.0", "pyjwt>=2.15.0", "docling-core>=2.101.1", "starlette>=1.3.1", "python-multipart>=0.0.32", "cryptography>=48.0.1", "msgpack>=1.2.3", "click>=8.3.3", "json-repair>=0.60.1", "mcp>=1.30.0", "datasets>=5.0.1", "certifi>=2026.10.19", "opentelemetry-api>=1.45.1", "virtualenv>=21.14.9", "filelock>=4.2.1", "setuptools>=84.1.0", "dnspython>=2.9.0"] [dependency-groups] dev = [ diff --git a/apps/negentropy-perceives/tests/integration/test_comprehensive_integration.py b/apps/negentropy-perceives/tests/integration/test_comprehensive_integration.py index f78b5ae6c..7be1481e5 100644 --- a/apps/negentropy-perceives/tests/integration/test_comprehensive_integration.py +++ b/apps/negentropy-perceives/tests/integration/test_comprehensive_integration.py @@ -484,7 +484,17 @@ async def test_error_logging_and_handling(self): convert_tool = tools["parse_webpage_to_markdown"] # Simulate various error conditions - with patch("negentropy.perceives.tools.markdown.web_scraper") as mock_scraper: + # 先隔离 Pipeline 路径：method="auto" 优先走 run_webpage_pipeline（anti_detection + # 阶段），CI runner 上 stealth 工具可用且 error-test.com 真实可解析，会使管线 + # 成功返回、绕开本用例要测的传统路径错误处理——patch 它强制降级到 legacy。 + with ( + patch( + "negentropy.perceives.pipeline.run_webpage_pipeline", + new_callable=AsyncMock, + side_effect=Exception("Pipeline unavailable"), + ), + patch("negentropy.perceives.tools.markdown.web_scraper") as mock_scraper, + ): # Network error simulation mock_scraper.scrape_url = AsyncMock(side_effect=Exception("Network error")) diff --git a/apps/negentropy-perceives/uv.lock b/apps/negentropy-perceives/uv.lock index c2795bdf9..0e29a58ef 100644 --- a/apps/negentropy-perceives/uv.lock +++ b/apps/negentropy-perceives/uv.lock @@ -10,23 +10,26 @@ resolution-markers = [ [manifest] overrides = [ - { name = "authlib", specifier = ">=1.7.1" }, + { name = "authlib", specifier = ">=1.9.0" }, { name = "certifi", specifier = ">=2026.10.19" }, { name = "click", specifier = ">=8.3.3" }, { name = "cryptography", specifier = ">=48.0.1" }, { name = "datasets", specifier = ">=5.0.1" }, + { name = "dnspython", specifier = ">=2.9.0" }, { name = "docling-core", specifier = ">=2.101.1" }, + { name = "filelock", specifier = ">=4.2.1" }, { name = "idna", specifier = ">=3.15" }, { name = "joserfc", specifier = ">=1.6.7" }, { name = "json-repair", specifier = ">=0.60.1" }, { name = "lxml", specifier = ">=6.1.0" }, { name = "mcp", specifier = ">=1.30.0" }, - { name = "msgpack", specifier = ">=1.2.1" }, + { name = "msgpack", specifier = ">=1.2.3" }, { name = "openai", specifier = ">=2.20.0" }, { name = "opentelemetry-api", specifier = ">=1.45.1" }, { name = "pillow", specifier = ">=13.0.0" }, { name = "pyjwt", specifier = ">=2.15.0" }, { name = "python-multipart", specifier = ">=0.0.32" }, + { name = "setuptools", specifier = ">=84.1.0" }, { name = "starlette", specifier = ">=1.3.1" }, { name = "transformers", specifier = ">=4.56.1,<5.0.0" }, { name = "urllib3", specifier = ">=2.8.0" }, @@ -231,15 +234,15 @@ wheels = [ [[package]] name = "authlib" -version = "1.7.2" +version = "1.9.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "cryptography" }, { name = "joserfc" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/36/98/7d93f30d029643c0275dbc0bd6d5a6f670661ee6c9a94d93af7ab4887600/authlib-1.7.2.tar.gz", hash = "sha256:2cea25fefcd4e7173bdf1372c0afc265c8034b23a8cd5dcb6a9164b826c64231", size = 176511, upload-time = "2026-05-06T08:10:23.116Z" } +sdist = { url = "https://files.pythonhosted.org/packages/c9/dc/087c08741a98d234c9b98beef8a28d3c309f814d14b6156422c5815bf6d6/authlib-1.9.1.tar.gz", hash = "sha256:5c7d9848f47cac340f060f76ae0bc09b59f5c8e89cc1bb032d4370a0c55b5974", size = 182700, upload-time = "2026-10-14T14:17:52.307Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/fb/95/adcb68e20c34162e9135f370d6e31737719c2b6f94bc953fe7ed1f10fe21/authlib-1.7.2-py2.py3-none-any.whl", hash = "sha256:3e1faedc9d87e7d56a164eca3ccb6ace0d61b94abe83e92242f8dc8bba9b4a9f", size = 259548, upload-time = "2026-05-06T08:10:21.436Z" }, + { url = "https://files.pythonhosted.org/packages/39/44/a46089266de32a0d809023b6bf31b80a1f26a46954446a7ce695a565cbea/authlib-1.9.1-py2.py3-none-any.whl", hash = "sha256:8b9be8b1e5174dcbf5520e984f1a22dc2edae5b6e40a61d4cedbf86b97e9e69b", size = 266042, upload-time = "2026-10-14T14:17:50.695Z" }, ] [[package]] @@ -763,11 +766,11 @@ wheels = [ [[package]] name = "dnspython" -version = "2.8.0" +version = "2.9.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/8c/8b/57666417c0f90f08bcafa776861060426765fdb422eb10212086fb811d26/dnspython-2.8.0.tar.gz", hash = "sha256:181d3c6996452cb1189c4046c61599b84a5a86e099562ffde77d26984ff26d0f", size = 368251, upload-time = "2025-09-07T18:58:00.022Z" } +sdist = { url = "https://files.pythonhosted.org/packages/ef/4a/50822184bd67cc6493f0fb6a880749158fcd31ab3fa07409acfd91f9fc85/dnspython-2.9.0.tar.gz", hash = "sha256:b44dc6b18f07a8b1c56676a19fbfdb5209415b046a9cece286baafa87ff3f7f1", size = 423560, upload-time = "2026-10-09T00:07:24.352Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/ba/5a/18ad964b0086c6e62e2e7500f7edc89e3faa45033c71c1893d34eed2b2de/dnspython-2.8.0-py3-none-any.whl", hash = "sha256:01d9bbc4a2d76bf0db7c1f729812ded6d912bd318d3b1cf81d30c0f845dbf3af", size = 331094, upload-time = "2025-09-07T18:57:58.071Z" }, + { url = "https://files.pythonhosted.org/packages/10/02/cdcc9b7c051786a103c3b09e1003a82fa0c66bcb91ffbdabcfbf7b4163b9/dnspython-2.9.0-py3-none-any.whl", hash = "sha256:9a4aedb833c3c1b49214d04d44d3032ab7a9135f7c1d29a549b4ff78fd82fda9", size = 354822, upload-time = "2026-10-09T00:07:22.622Z" }, ] [[package]] @@ -1029,36 +1032,68 @@ wheels = [ [[package]] name = "fastmcp" -version = "3.2.4" +version = "3.4.11" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "fastmcp-slim", extra = ["client", "server"] }, +] +sdist = { url = "https://files.pythonhosted.org/packages/f7/77/b5ef8688b0dd3e403b7671106533d62e93252d7d8f3c75f547e4686bba1e/fastmcp-3.4.11.tar.gz", hash = "sha256:36273b04eff98021da4601d4f86c64dfa10e61119e9ddd17ad80650465c65355", size = 28868316, upload-time = "2026-10-20T22:44:36.64Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/d5/fb/e6b04a2f4dbce64994f3239267b6899411e8fd9693238c39ee99fe6f2b35/fastmcp-3.4.11-py3-none-any.whl", hash = "sha256:f50a7aa4cc2a5954d02fcc9672ff1d69daff73a02387f959c2647523cd6d5606", size = 8028, upload-time = "2026-10-20T22:44:33.334Z" }, +] + +[[package]] +name = "fastmcp-slim" +version = "3.4.11" source = { registry = "https://pypi.org/simple" } dependencies = [ + { name = "platformdirs" }, + { name = "pydantic", extra = ["email"] }, + { name = "pydantic-settings" }, + { name = "python-dotenv" }, + { name = "rich" }, + { name = "typing-extensions" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/9d/35/5f61dc70141df213eddff40bb2b8ccf68b02ecd666da6a1efab7c55b5694/fastmcp_slim-3.4.11.tar.gz", hash = "sha256:50e29b0830fb216aba437f35cfc7dd4bce7451f2f85f8786d6fff3da78d79386", size = 610380, upload-time = "2026-10-20T22:44:12.833Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/ff/71/614669d0a0d8dea87dc0dc684650bb36793027fc409197526532f587fcab/fastmcp_slim-3.4.11-py3-none-any.whl", hash = "sha256:24535dd843b3dcb3272b86c88fdf6ada5026c39ec5b56e2426557223c4d2c8bf", size = 785938, upload-time = "2026-10-20T22:44:10.921Z" }, +] + +[package.optional-dependencies] +client = [ { name = "authlib" }, + { name = "certifi" }, + { name = "exceptiongroup" }, + { name = "httpx" }, + { name = "mcp" }, + { name = "opentelemetry-api" }, + { name = "py-key-value-aio", extra = ["filetree", "keyring", "memory"] }, + { name = "starlette" }, +] +server = [ + { name = "authlib" }, + { name = "certifi" }, { name = "cyclopts" }, { name = "exceptiongroup" }, { name = "griffelib" }, { name = "httpx" }, + { name = "joserfc" }, { name = "jsonref" }, { name = "jsonschema-path" }, { name = "mcp" }, { name = "openapi-pydantic" }, { name = "opentelemetry-api" }, { name = "packaging" }, - { name = "platformdirs" }, { name = "py-key-value-aio", extra = ["filetree", "keyring", "memory"] }, - { name = "pydantic", extra = ["email"] }, { name = "pyperclip" }, - { name = "python-dotenv" }, + { name = "python-multipart" }, { name = "pyyaml" }, - { name = "rich" }, + { name = "starlette" }, { name = "uncalled-for" }, { name = "uvicorn" }, { name = "watchfiles" }, { name = "websockets" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/9c/13/29544fbc6dfe45ea38046af0067311e0bad7acc7d1f2ad38bb08f2409fe2/fastmcp-3.2.4.tar.gz", hash = "sha256:083ecb75b44a4169e7fc0f632f94b781bdb0ff877c6b35b9877cbb566fd4d4d1", size = 28746127, upload-time = "2026-04-14T01:42:24.174Z" } -wheels = [ - { url = "https://files.pythonhosted.org/packages/cf/76/b310d52fa0e30d39bd937eb58ec2c1f1ea1b5f519f0575e9dd9612f01deb/fastmcp-3.2.4-py3-none-any.whl", hash = "sha256:e6c9c429171041455e47ab94bb3f83c4657622a0ec28922f6940053959bd58a9", size = 728599, upload-time = "2026-04-14T01:42:26.85Z" }, -] [[package]] name = "fasttext-predict" @@ -1113,11 +1148,11 @@ wheels = [ [[package]] name = "filelock" -version = "3.25.2" +version = "4.2.4" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/94/b8/00651a0f559862f3bb7d6f7477b192afe3f583cc5e26403b44e59a55ab34/filelock-3.25.2.tar.gz", hash = "sha256:b64ece2b38f4ca29dd3e810287aa8c48182bbecd1ae6e9ae126c9b35f1382694", size = 40480, upload-time = "2026-03-11T20:45:38.487Z" } +sdist = { url = "https://files.pythonhosted.org/packages/d8/28/3893324bcadf8f89b1616637468d766af3f625008c0735bf704fdfa86617/filelock-4.2.4.tar.gz", hash = "sha256:c6d8663535e1650ee430507b4ffbac7b464dd64b7647ea0112a9f406499d163d", size = 652444, upload-time = "2026-10-19T01:57:51.001Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/a4/a5/842ae8f0c08b61d6484b52f99a03510a3a72d23141942d216ebe81fefbce/filelock-3.25.2-py3-none-any.whl", hash = "sha256:ca8afb0da15f229774c9ad1b455ed96e85a81373065fb10446672f64444ddf70", size = 26759, upload-time = "2026-03-11T20:45:37.437Z" }, + { url = "https://files.pythonhosted.org/packages/e0/1b/5e74289a1878e666bb4b65fe5805a04cafcac2aa5f519ef1ead67ef91c56/filelock-4.2.4-py3-none-any.whl", hash = "sha256:301241438c57936ef93f4243a94f2559022268bfcf9b375a9a72eb0f8db8358e", size = 162475, upload-time = "2026-10-19T01:57:49.419Z" }, ] [[package]] @@ -2169,21 +2204,22 @@ wheels = [ [[package]] name = "msgpack" -version = "1.2.1" +version = "1.2.4" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/31/f9/c0a1c127f9049db9155afc316952ea571720dd01833ff5e4d7e8e6352dbb/msgpack-1.2.1.tar.gz", hash = "sha256:04c721c2c7448767e9e3f2520a475663d8ee0f09c31890f6d2bd70fd636a9647", size = 183960, upload-time = "2026-06-18T16:13:52.594Z" } +sdist = { url = "https://files.pythonhosted.org/packages/cc/52/1ec7ead2c7528bf3d1db73e886fa4df10f9e6f0eb7854a448b7090cfcef7/msgpack-1.2.4.tar.gz", hash = "sha256:475c44e12f2a5de766a8448783f149c9b33f3f49b88953c6cd739a77d93c732c", size = 197764, upload-time = "2026-10-26T17:55:48.593Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/b0/ac/dcddcab6f6c20ecb387ca5e980371cdb3f87ff69aeca388be97eebc4c074/msgpack-1.2.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:0a70e3cf2804a300d921bb0940426e35f4e489a23adfb77a808892241db0a064", size = 83151, upload-time = "2026-06-18T16:13:12.173Z" }, - { url = "https://files.pythonhosted.org/packages/64/71/fbcfa83a1d6a9c6091942d1cfd070962244664b87427a9a49a6897b1b219/msgpack-1.2.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:491cc39455ca765fad51fb451bf2915eb2cf41192ab5801ce8d67c1d614fe056", size = 82351, upload-time = "2026-06-18T16:13:13.194Z" }, - { url = "https://files.pythonhosted.org/packages/e3/10/ddf7b06db879e8792d13934ddda09ff20bd2a583fd84c9b59aae9b0e650b/msgpack-1.2.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f310233ef7fb9c14e201c93639fe5f5260b005f56f0b29048e999c30935596cc", size = 407518, upload-time = "2026-06-18T16:13:14.233Z" }, - { url = "https://files.pythonhosted.org/packages/79/d3/36a46a8ed992b781acbc05928bd5bee3c810cb0c3563bf81a7b0c04a1a76/msgpack-1.2.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:787c9bebb5833e8f6fc8abca3c0597683d8d87f56a8842b6b89c75a5f3176e2d", size = 416405, upload-time = "2026-06-18T16:13:15.435Z" }, - { url = "https://files.pythonhosted.org/packages/f9/84/e8e9598b557c0ba6ddae901a73780a4c75ac667dddf59414b1e56a42fb34/msgpack-1.2.1-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:dc871b997a9370d855b7394465f2f350e847a5b806dd38dcc9c989e7d87da155", size = 376257, upload-time = "2026-06-18T16:13:17.022Z" }, - { url = "https://files.pythonhosted.org/packages/40/16/738fe6d875ad7e2a9429c165322a4ec088f4f273cdfae63d96a89c467961/msgpack-1.2.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:85f57e960d877f2977f6430896191b04a21f8901b3b4baf2e4604329f4db5402", size = 397469, upload-time = "2026-06-18T16:13:18.287Z" }, - { url = "https://files.pythonhosted.org/packages/ca/be/6d5952df75a7f24f35833af764c3a6860780364cb3a0030beb8099e1b2b4/msgpack-1.2.1-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:1233ee2dd0cefba127583de50ea654677277047d238303521db35def3d7b2e7c", size = 372802, upload-time = "2026-06-18T16:13:19.685Z" }, - { url = "https://files.pythonhosted.org/packages/e1/39/e2ef7dbf0473bcb8dc7c50bf782a892d67414877b63e47fc88eb189ef5e6/msgpack-1.2.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:e3dc2feb0876209d9c38aa56cb1de169bd6c4348f1aa48271f241226590993e6", size = 411273, upload-time = "2026-06-18T16:13:21.028Z" }, - { url = "https://files.pythonhosted.org/packages/ef/c5/133f4512a56e983a93445c836c9d94d88f3bc2e0980ff4b9e577bd8416ce/msgpack-1.2.1-cp313-cp313-win32.whl", hash = "sha256:6d09badf350af2be9d189184e04e64cf54ad93569ab3d96fca58bd3e84aad707", size = 64471, upload-time = "2026-06-18T16:13:22.293Z" }, - { url = "https://files.pythonhosted.org/packages/e2/98/577e10b055096a7dd40732358cabaf7180a20c79ed1dcdbb618e4b9deac7/msgpack-1.2.1-cp313-cp313-win_amd64.whl", hash = "sha256:33f14fba63278b714efe6ad07e50ea5f03d91537aa6a1c5f1ceca4cf44013ca9", size = 71274, upload-time = "2026-06-18T16:13:23.455Z" }, - { url = "https://files.pythonhosted.org/packages/ba/ee/0c0048e7cfbef23c6a94791b8959ab28155232e7956de8a305b5ff588f05/msgpack-1.2.1-cp313-cp313-win_arm64.whl", hash = "sha256:afc5febcd4c99effbc02b528e49d6fd0760b2b7d48c05239e345a5fa6e743d9a", size = 64795, upload-time = "2026-06-18T16:13:24.687Z" }, + { url = "https://files.pythonhosted.org/packages/2d/26/16eaad5fe6e199334fa5bd66070778665717c86e9a273525dc706ddb06a7/msgpack-1.2.4-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:fb811ac3d463a75013b234d2aae56b9f0bdb0105caf4dd2ee65305b6a8a6078d", size = 92057, upload-time = "2026-10-26T17:54:19.616Z" }, + { url = "https://files.pythonhosted.org/packages/9c/b8/9660be6d120820bc05106f291e824c73d35f4ab77d927788ae67ea80889c/msgpack-1.2.4-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:36258fd0909e1bf26e94604439108846432abe4ffa9a23c9dc2f6f1c60f94b60", size = 90542, upload-time = "2026-10-26T17:54:20.965Z" }, + { url = "https://files.pythonhosted.org/packages/6c/10/cd55a69fec29df26884b178dc4b1803442ec82abf929604aac619881917a/msgpack-1.2.4-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e9c5ba0f053a7e98f013f083c9d1b2dffb26cad8c897c533d8286e44ed24c669", size = 455798, upload-time = "2026-10-26T17:54:22.434Z" }, + { url = "https://files.pythonhosted.org/packages/c9/94/562e0733593a780c70b0b18994f30c205149f7f9f4efbe3e9b00b88612c5/msgpack-1.2.4-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:7fabd415c41e62006c6641fcdf5b3e866f581c4e11c58328c0d0f69584b9577d", size = 469262, upload-time = "2026-10-26T17:54:24.043Z" }, + { url = "https://files.pythonhosted.org/packages/bb/92/76d1a5c597e04e1d360b05573d150bdb4502f5a014e6e9cf089c9537c156/msgpack-1.2.4-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:7433d340de45003db3ed909a642c9469b598d175530f7a707cbaba64287d27ce", size = 420789, upload-time = "2026-10-26T17:54:25.587Z" }, + { url = "https://files.pythonhosted.org/packages/8a/c6/b72b8d8022718380db459ced8ffbabc7570ad2d22c7f2fa659c872cb6734/msgpack-1.2.4-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:ccd6e4af5347eb9828147320449bcd30e3321f6397d4583ff16047485dd8be3d", size = 447068, upload-time = "2026-10-26T17:54:27.721Z" }, + { url = "https://files.pythonhosted.org/packages/cb/dc/f378ef1def4aa135e70325c09e22457f3203ae2a390a192e892267906f33/msgpack-1.2.4-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:23d1459a1d0b4c9f6629df072d592eb74424b3ed3656b69af507bc9023cc027f", size = 418896, upload-time = "2026-10-26T17:54:29.325Z" }, + { url = "https://files.pythonhosted.org/packages/62/93/a7e507378f43e91415cb6fda47e0ded0c9de1618a1f4ac4f2887912a92dd/msgpack-1.2.4-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:9e73761fe9fc55a4e9d2df8e8f59b0979231af4dbf80b8bf90cd64c74173d779", size = 465764, upload-time = "2026-10-26T17:54:30.719Z" }, + { url = "https://files.pythonhosted.org/packages/60/76/7f39f49cbcdaa4aafe64b4941b2640772dbdc1cac3a9332f4c9ba6994da9/msgpack-1.2.4-cp313-cp313-pyemscripten_2025_0_wasm32.whl", hash = "sha256:d088d1f552e129859db830692268747aba0a1ee3e6e0fe6344dbb3aab1df9f6c", size = 53615, upload-time = "2026-10-26T17:54:32.213Z" }, + { url = "https://files.pythonhosted.org/packages/67/9b/85b93350dbd7b52b358882f7f17a88a03664a7a59a359406e6315c162634/msgpack-1.2.4-cp313-cp313-win32.whl", hash = "sha256:892d4f17d7962bfd2c2928b0a47542bf2948f074a7c04721b73d4138b70481e4", size = 68724, upload-time = "2026-10-26T17:54:33.484Z" }, + { url = "https://files.pythonhosted.org/packages/02/4a/a7e2778ce09a943c17b6f91c7acb2f9488357657c01f2cccb278297621c4/msgpack-1.2.4-cp313-cp313-win_amd64.whl", hash = "sha256:318d4e634d2b320be10decd9968ad1ae0be1d80cba23b5528c37b429eeb0e3e0", size = 77039, upload-time = "2026-10-26T17:54:35.016Z" }, + { url = "https://files.pythonhosted.org/packages/64/16/9ff7495a9853e9d7de74965fdadce15017e7213ce564bb5dafc5403c9108/msgpack-1.2.4-cp313-cp313-win_arm64.whl", hash = "sha256:bec3e34749b90cfcf116149aad11295c720ff4a74a7d0a35abdb968a396c1524", size = 71873, upload-time = "2026-10-26T17:54:36.19Z" }, ] [[package]] @@ -2330,7 +2366,7 @@ requires-dist = [ { name = "camelot-py", specifier = ">=0.11.0" }, { name = "docling", specifier = ">=2.132.0" }, { name = "fake-useragent", specifier = ">=2.2.0" }, - { name = "fastmcp", specifier = ">=3.2.4" }, + { name = "fastmcp", specifier = ">=3.4.10" }, { name = "html2text", specifier = ">=2025.4.15" }, { name = "litellm", specifier = ">=1.96.2" }, { name = "lxml-html-clean", specifier = ">=0.4.0" }, @@ -3991,11 +4027,11 @@ wheels = [ [[package]] name = "setuptools" -version = "84.0.0" +version = "84.2.1" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/6d/44/f5da03a8ef95d369145c5bb53050e7877c9f3d312e128605fd9504829143/setuptools-84.0.0.tar.gz", hash = "sha256:f4695c21257f0d9b537ec2692c941d02ee143b7cc1276941349a546573b2ef73", size = 1168449, upload-time = "2026-08-08T18:27:58.365Z" } +sdist = { url = "https://files.pythonhosted.org/packages/70/b3/c19426f783614d625699a4b247faf628ea9ab1db228674491767b417f9e1/setuptools-84.2.1.tar.gz", hash = "sha256:3ff8b3b5492a0aa66960f4419365a86b84e013070d4313e4d4a6894f5d64d6bc", size = 1230289, upload-time = "2026-10-20T19:01:37.742Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/95/9c/c510029fc6ef33a6275cd2c5d3cecd6613dfd6aa401d57c54f1c18852ccf/setuptools-84.0.0-py3-none-any.whl", hash = "sha256:51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670", size = 818216, upload-time = "2026-08-08T18:27:56.719Z" }, + { url = "https://files.pythonhosted.org/packages/ef/55/6dc6d6bb953bdfc52519a0059592c52b6e3b8ad51cf8256dffceb55b0610/setuptools-84.2.1-py3-none-any.whl", hash = "sha256:ca140b45d5325a9478f880e351484f62fef15f336462e449ca0c03c873d589c2", size = 876263, upload-time = "2026-10-20T19:01:35.678Z" }, ] [[package]] diff --git a/apps/negentropy-ui/app/globals.css b/apps/negentropy-ui/app/globals.css index b5409e349..fb08b9979 100644 --- a/apps/negentropy-ui/app/globals.css +++ b/apps/negentropy-ui/app/globals.css @@ -453,14 +453,14 @@ body { */ .dark .katex .vlist-t2 > .vlist-r > .vlist > .vlist-s, .dark .katex .frac-line, -.dark .katex .overline .overline-line, -.dark .katex .underline .underline-line, +.dark .katex .katex-overline .overline-line, +.dark .katex .katex-underline .underline-line, .dark .katex .sqrt > .sqrt-line, -.dark .katex .hline { +.dark .katex .katex-hline { border-color: currentColor; } -.dark .katex .sqrt > .root { +.dark .katex .sqrt > .katex-root { color: currentColor; } diff --git a/apps/negentropy-ui/package.json b/apps/negentropy-ui/package.json index abca2b796..1784e2c3c 100644 --- a/apps/negentropy-ui/package.json +++ b/apps/negentropy-ui/package.json @@ -45,7 +45,7 @@ "graphology": "^0.26.0", "graphology-layout-forceatlas2": "^0.10.1", "highlight.js": "^11.11.1", - "katex": "^0.16.33", + "katex": "^0.18.11", "lucide-react": "^0.525.0", "mermaid": "^11.12.2", "micromark": "^4.0.0", diff --git a/apps/negentropy-wiki/package.json b/apps/negentropy-wiki/package.json index e5ade477d..8163a784b 100644 --- a/apps/negentropy-wiki/package.json +++ b/apps/negentropy-wiki/package.json @@ -24,7 +24,7 @@ "graphology": "^0.26.0", "graphology-layout-forceatlas2": "^0.10.1", "highlight.js": "^11.11.1", - "katex": "^0.16.47", + "katex": "^0.18.11", "mdast-util-to-string": "^4.0.0", "mermaid": "^11.15.0", "next": "16.4.1", diff --git a/apps/negentropy/pyproject.toml b/apps/negentropy/pyproject.toml index 8f1fc0f89..ad49722a6 100644 --- a/apps/negentropy/pyproject.toml +++ b/apps/negentropy/pyproject.toml @@ -31,7 +31,7 @@ dependencies = [ "pydantic-settings[yaml]>=2.14.2", # Configuration management with YAML support; >=2.14.2 修复 GHSA-4xgf-cpjx-pc3j (NestedSecretsSettingsSource 跟随 secrets_dir 外符号链接致本地文件读) "pyyaml>=6.0.2", # YAML parser for configuration files # LLM & AI Services - "litellm>=1.84.0", # Unified interface for various LLM providers (>=1.84.0 修复 GHSA-4xpc-pv4p-pm3w critical Host Header Injection 鉴权绕过; 兼容 1.83.7 的 SQLi/SSTI/MCP-RCE 修复 GHSA-9566-... / 90 / 88 / 89) + "litellm>=1.100.4", # Unified interface for various LLM providers (>=1.100.4 修复 GHSA-7hp6 High proxy_admin 提权——Dependency Review 硬门; >=1.95.0 修复 GHSA-g5ff 任意文件读; >=1.89.7 修复 GHSA-3cv6 认证 SSRF; >=1.84.0 修复 GHSA-4xpc-pv4p-pm3w critical 鉴权绕过; 1.100.x 起 litellm 强依赖 boto3/botocore, Bedrock 支持标配) # Google Cloud Services（GCS 退役：artifact/document blob 已迁至 PostgreSQL，不再直接依赖 google-cloud-storage； # 该包仍经 google-adk 传递安装，但 negentropy 自身无任何直接引用） "google-auth>=2.48.0", # Authentication for Google services @@ -145,14 +145,14 @@ exclude_lines = [ [tool.uv] override-dependencies = [ - "aiohttp>=3.14.3", # CVE-2026-34993/47265 等 (25 个): microsandbox==0.1.8 锁死 <3.11.0, 强制覆盖升级至 3.14.3 (新增 C 解析器堆越界读 + WebSocket 请求走私) + "aiohttp>=3.14.4", # CVE-2026-34993/47265 等 (25 个): microsandbox==0.1.8 锁死 <3.11.0, 强制覆盖升级至 3.14.4 (含 GHSA-5wr8/6cjc/pqxq 等 8 个 3.14.4 修复; 新增 C 解析器堆越界读 + WebSocket 请求走私) ] constraint-dependencies = [ # ── 既有约束 ── "authlib>=1.7.1", # GHSA-jj8c-mmj3-mmgv: OIDC Open Redirect + OAuth client cache CSRF (+ 保留历史 CVE-2026-27962 等防御) "joserfc>=1.6.7", # CVE-2026-48990: b64=false RFC7797 JWS payload 绕过 JWSRegistry 大小限制 (authlib → joserfc 间接) "pyasn1>=0.6.4", # CVE-2026-30922 + GHSA-m4p7-r5rc-7g4j 等 (3 个): BER/CER/DER 解码器 DoS (google-auth → pyasn1-modules 传递) - "pyjwt>=2.13.0", # PYSEC-2026-175/177/178/179 + CVE-2026-32597: unknown crit header extensions + "pyjwt>=2.15.1", # CVE-2026-102268 (critical 9.1, GHSA-ffc3-869f-jxw9) 等 15 个 advisory; 一步到 2.15.1: 2.14.0 紧凑 base64url 校验曾误杀尾部 '=' 填充 token (#1209), 2.15.1 放宽 "cryptography>=50.0.0", # GHSA-g6cj-pr64-35w5: PKCS#7 EnvelopedData 解密暴露 Bleichenbacher oracle (high); 兼容 wheel 内 OpenSSL 与 46.0.7 的 buffer overflow/subgroup/DNS constraint 防御 "setuptools>=83.0.0", # CVE-2026-59890: MANIFEST.in 排除规则在 macOS APFS/HFS+ 被 Unicode 归一化绕过 (spacy/thinc 传递) "pygments>=2.20.0", # CVE-2026-4539: ReDoS via GUID regex @@ -179,11 +179,13 @@ constraint-dependencies = [ "pyopenssl>=26.0.0", # DTLS cookie callback 缓冲区溢出 (high) "starlette>=1.3.1", # 11 个 high/medium CVE (form DoS / SSRF / Host header bypass 等; 0.x 无回溯补丁, 需 google-adk>=2.2.0 解锁 1.x) "protobuf>=5.29.6", # JSON recursion depth bypass (high) - "urllib3>=2.7.0", # GHSA-mf9v-mfxr-j63j + GHSA-qccp-gfcp-xxvc: 解压缩炸弹 + 无限链解压缩 (high) + "urllib3>=2.8.0", # GHSA-mf9v-mfxr-j63j + GHSA-qccp-gfcp-xxvc 等 3 个: 解压缩炸弹 + 无限链解压缩 (high) "idna>=3.15", # GHSA-65pc-fj4g-8rjx: idna.encode() 特殊构造输入绕过 CVE-2024-3651 修复 (medium) "filelock>=3.20.3", # TOCTOU symlink 竞争 (medium) "orjson>=3.11.6", # 无限递归 DoS (high) "google-cloud-aiplatform>=1.133.0", # 可预测 bucket 命名 (high) - "mako>=1.3.12", # GHSA-2h4p-vjrc-8xpq / CVE-2026-44307: Windows 反斜杠 URI TemplateLookup 路径穿越 (high, alembic 传递; 兼容 GHSA-v92g-xgxw-vvmm) + "mako>=1.4.2", # GHSA-2h4p-vjrc-8xpq / CVE-2026-44307: Windows 反斜杠 URI TemplateLookup 路径穿越 (high, alembic 传递; 兼容 GHSA-v92g-xgxw-vvmm) + "anyio>=4.14.2", # CVE-2026-63374 (critical, GHSA-82r6-8w77-94w6): connect_tcp/TLSStream IDNA 2003 编码 TLS 证书欺骗 + CVE-2026-64847 + "mcp>=1.30.0,<2.0.0", # 1.29.x 多 advisory, 1.30.0 修复; 上界 <2.0.0: mcp 2.0.0 已发布且移除部分 SDK 表面, logged_stdio_client 依赖 1.x 符号 "python-multipart>=0.0.31", # GHSA-pp6c-gr5w-3c5g / CVE-2026-42561 + 后续 part headers DoS (high, mcp/starlette 传递; 兼容 GHSA-mj87-hwqh-73pj) ] diff --git a/apps/negentropy/uv.lock b/apps/negentropy/uv.lock index 54943c46b..53da2b4d9 100644 --- a/apps/negentropy/uv.lock +++ b/apps/negentropy/uv.lock @@ -5,6 +5,7 @@ requires-python = "==3.13.*" [manifest] constraints = [ { name = "aiomysql", specifier = ">=0.3.0" }, + { name = "anyio", specifier = ">=4.14.2" }, { name = "authlib", specifier = ">=1.7.1" }, { name = "azure-core", specifier = ">=1.38.0" }, { name = "brotli", specifier = ">=1.2.0" }, @@ -17,17 +18,18 @@ constraints = [ { name = "h2", specifier = ">=4.3.0" }, { name = "idna", specifier = ">=3.15" }, { name = "joserfc", specifier = ">=1.6.7" }, - { name = "mako", specifier = ">=1.3.12" }, + { name = "mako", specifier = ">=1.4.2" }, { name = "markdown", specifier = ">=3.8.1" }, { name = "markdownify", specifier = ">=0.14.1" }, { name = "marshmallow", specifier = ">=3.26.2" }, + { name = "mcp", specifier = ">=1.30.0,<2.0.0" }, { name = "nltk", specifier = ">=3.9.4" }, { name = "orjson", specifier = ">=3.11.6" }, { name = "pillow", specifier = ">=12.2.0" }, { name = "protobuf", specifier = ">=5.29.6" }, { name = "pyasn1", specifier = ">=0.6.4" }, { name = "pygments", specifier = ">=2.20.0" }, - { name = "pyjwt", specifier = ">=2.13.0" }, + { name = "pyjwt", specifier = ">=2.15.1" }, { name = "pyopenssl", specifier = ">=26.0.0" }, { name = "pypdf", specifier = ">=6.13.0" }, { name = "python-multipart", specifier = ">=0.0.31" }, @@ -38,10 +40,10 @@ constraints = [ { name = "transformers", specifier = ">=4.53.0" }, { name = "ujson", specifier = ">=5.12.0" }, { name = "unstructured", specifier = ">=0.18.18" }, - { name = "urllib3", specifier = ">=2.7.0" }, + { name = "urllib3", specifier = ">=2.8.0" }, { name = "werkzeug", specifier = ">=3.1.6" }, ] -overrides = [{ name = "aiohttp", specifier = ">=3.14.3" }] +overrides = [{ name = "aiohttp", specifier = ">=3.14.4" }] [[package]] name = "aiohappyeyeballs" @@ -54,7 +56,7 @@ wheels = [ [[package]] name = "aiohttp" -version = "3.14.3" +version = "3.14.5" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "aiohappyeyeballs" }, @@ -65,31 +67,32 @@ dependencies = [ { name = "propcache" }, { name = "yarl" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/58/d9/22ce5786ac0c1653ae8b6c23bded02c1686d11f0dbb45b31ce128e0df985/aiohttp-3.14.3.tar.gz", hash = "sha256:9491196535a88924a60afd5b5f434b5b203b6cc616250878dbdb223a8f7844bc", size = 7971213, upload-time = "2026-07-23T01:57:27.037Z" } -wheels = [ - { url = "https://files.pythonhosted.org/packages/57/be/5afd201cc0ab139029aadb75392efe85a293403d9dd3a3226161c21ce00c/aiohttp-3.14.3-cp313-cp313-android_21_arm64_v8a.whl", hash = "sha256:2e9878ae68e4a5f1c0abe4dd497dbc3d51946f5837b56759e2a02e78fa90ef86", size = 506269, upload-time = "2026-07-23T01:54:49.075Z" }, - { url = "https://files.pythonhosted.org/packages/22/09/dec8189d62b45ade009f6792a2264b942a90cb88aeaf181239933cd72c3c/aiohttp-3.14.3-cp313-cp313-android_21_x86_64.whl", hash = "sha256:f3d2669fe7dec7fc359ecdb5984b29b50d85d5d00f8c1cb61de4f4a24ee42627", size = 515166, upload-time = "2026-07-23T01:54:51.894Z" }, - { url = "https://files.pythonhosted.org/packages/28/24/2854869d29ed8a8b19d74f9ec6629515f7e04d02dd329d9d179201e58e47/aiohttp-3.14.3-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:cc7cb243a68167172f48c1fd43cee91ec4b1d40cefd190edd43369d1a6bc9c82", size = 486263, upload-time = "2026-07-23T01:54:54.223Z" }, - { url = "https://files.pythonhosted.org/packages/d4/dd/57187c8be2a35aea65eaee3bd2c3dcbbcf0204f5106c89637e3610380cd1/aiohttp-3.14.3-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:78253b573e6ffab5028924fc98bc281aae05445969982a10864bc360dea2016c", size = 492299, upload-time = "2026-07-23T01:54:56.236Z" }, - { url = "https://files.pythonhosted.org/packages/b9/11/06ae6ed8f0d414edf4068861e233d8fe23ee699bfd4b3ceb8663db948a62/aiohttp-3.14.3-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:7041d52c3a7fa20c9e8c182b534704abb19502c8bdcbde7ab23bfda6f642394f", size = 502235, upload-time = "2026-07-23T01:54:58.377Z" }, - { url = "https://files.pythonhosted.org/packages/7e/a3/559639c34a345d2cf7c52dff6838119f2eaf29eb508227b5b83f573af813/aiohttp-3.14.3-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:ac74facc01463f138b0da5580329cfcc82818dea5656e83ddcd11268fc12ff80", size = 750883, upload-time = "2026-07-23T01:55:00.65Z" }, - { url = "https://files.pythonhosted.org/packages/91/cd/41e131f13afd1e7b0172a9d9eda085ef90eb8439f41f0d279db81ed3ae60/aiohttp-3.14.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:d6218d92e450824e9b4881f44e8c09f1853b490f9a64130801024a4793b1b3b0", size = 508473, upload-time = "2026-07-23T01:55:02.945Z" }, - { url = "https://files.pythonhosted.org/packages/bc/6b/e7f13410d391c6e55b4c007a8de024355389d7d459e3d64c42b2d33617e5/aiohttp-3.14.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:11fb37ef075669eee52ab1928fbf6e1741fada40409fa309ebde9607a962aebf", size = 509190, upload-time = "2026-07-23T01:55:05.173Z" }, - { url = "https://files.pythonhosted.org/packages/97/21/6464573e53d69672cc1eada3e5c5cb2d2efa82701e8305a0f2047a576967/aiohttp-3.14.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:55bdcc472aafe2de4a253045cc128007a64f1e0264fb675791e132ea5edaa3bd", size = 1761478, upload-time = "2026-07-23T01:55:07.383Z" }, - { url = "https://files.pythonhosted.org/packages/1a/81/d217043a4c17fbce360905e3b2bdd20139ebc9a2de836d035d179c4da006/aiohttp-3.14.3-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:c39846c3aad97a8530c89d7a3869a8f8e9e3762c6ac0504481e5c80948f7e807", size = 1735092, upload-time = "2026-07-23T01:55:09.803Z" }, - { url = "https://files.pythonhosted.org/packages/a1/66/e13a02d0eeb1a9a502402a977abb4e4abff9fe4051c26f80558c57a7c975/aiohttp-3.14.3-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:5895ef58c4620afe02fa16044f023dc4dafec08158f9d08874a46a7dbc0341b8", size = 1800546, upload-time = "2026-07-23T01:55:12.012Z" }, - { url = "https://files.pythonhosted.org/packages/26/5e/57d42fca1d18cb5acc1cad945d017fabc5d6ae71d8a08ad66be8dc3ee544/aiohttp-3.14.3-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:fa9467a8113aa69d3d7c55a70ef0b7c636010a40993f3df9d9d0d73b3eb7ef24", size = 1895250, upload-time = "2026-07-23T01:55:14.357Z" }, - { url = "https://files.pythonhosted.org/packages/ca/1c/7da8d08e74d56f00070822f9638ff3f1c563f8ad87d1efa996c87bfc8644/aiohttp-3.14.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:d7d2deec16eeedf55f2c7cf75b521ea3856a5177e123844f8fd0f114ce252cb5", size = 1789289, upload-time = "2026-07-23T01:55:16.668Z" }, - { url = "https://files.pythonhosted.org/packages/cd/0f/cf16bcf56896981c1a0319f5d5db9337994b5165730c48a8fa07e9b34be6/aiohttp-3.14.3-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:dd54d0e8717de95939766febac482ac0474d8ac3b048115f9f2b1d23a16e7db4", size = 1586706, upload-time = "2026-07-23T01:55:18.913Z" }, - { url = "https://files.pythonhosted.org/packages/fe/6f/76eac12a7f2480e1e304f842efdb07db33256b0d9165b866b6ef0806c202/aiohttp-3.14.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:df82f3787c940c94986b34222d59c9e38843fba85139f36e85255a82ad5355a9", size = 1724652, upload-time = "2026-07-23T01:55:21.296Z" }, - { url = "https://files.pythonhosted.org/packages/39/b6/19c8c592baeeb94b75f966547d40c02ac7590902306ec5863d5c027cf506/aiohttp-3.14.3-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:42a67efc36300d052fb4508a53e8b6901b9284b599ae63945c377569c5fcc1e1", size = 1756239, upload-time = "2026-07-23T01:55:23.705Z" }, - { url = "https://files.pythonhosted.org/packages/dc/c9/4e9383150296f97f873b680c4de8fb2cd88608fb9f48c79edcb111611abc/aiohttp-3.14.3-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:7a75aa63cbf9b21cfaf60dc2657e19df2c2867d91707d653fee171ffeedd1371", size = 1769161, upload-time = "2026-07-23T01:55:26.082Z" }, - { url = "https://files.pythonhosted.org/packages/aa/1e/147bdc6cc5de5f3ab011be8bf5d6e786633249f22c20bae06f85e45f5387/aiohttp-3.14.3-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:e92eb8acc45eb6a9f4935071a77edf5b85cc6f8dfad5cd99e97653c26593cdde", size = 1578759, upload-time = "2026-07-23T01:55:28.846Z" }, - { url = "https://files.pythonhosted.org/packages/fd/31/78388a9d6040ece2e11df62ea229a822cf5e52d238374b220ae9975b2623/aiohttp-3.14.3-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:b014a6ed7cf912e787149fdc529166d3ceabac23f26efeea3158c9aba2354e7e", size = 1792025, upload-time = "2026-07-23T01:55:31.457Z" }, - { url = "https://files.pythonhosted.org/packages/03/51/a3d29fdf2c25d796746af8ad6fe56a45d6256c38b0a8a2ed752e1160b3a2/aiohttp-3.14.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:3d4f72af88ac2474bb5bca640030320e3d38a0163a1d7533500e87be458eef71", size = 1768477, upload-time = "2026-07-23T01:55:33.87Z" }, - { url = "https://files.pythonhosted.org/packages/29/a6/442e18b5afeade534d877a2dc3c3e392aff8d49787890b0cf84790410267/aiohttp-3.14.3-cp313-cp313-win32.whl", hash = "sha256:5f08ec777f35ee70720233b8b9811d3bb5d728137f30ac91b7457709c3261ac0", size = 451069, upload-time = "2026-07-23T01:55:36.121Z" }, - { url = "https://files.pythonhosted.org/packages/9d/69/3d876ac02659f271cf7f6769f14a8e3de5b6e888ed8b5a7e998086a4cec8/aiohttp-3.14.3-cp313-cp313-win_amd64.whl", hash = "sha256:dff9461ec275f22135650d5ba4b4931a11f3958df7dfbb8db630000d4dee0883", size = 476518, upload-time = "2026-07-23T01:55:38.303Z" }, - { url = "https://files.pythonhosted.org/packages/b2/0e/50d6e6471cd31edce8b282bdec59375a3a69124d8a989a0b1313355cae52/aiohttp-3.14.3-cp313-cp313-win_arm64.whl", hash = "sha256:ddcac3c6b382e81f1dd0499199d4136b877beb4cb5ef770bbbfba56c4b8f55d2", size = 447676, upload-time = "2026-07-23T01:55:40.451Z" }, +sdist = { url = "https://files.pythonhosted.org/packages/6c/4c/bdccd81e9ee225b69c60e7766c9a5b05364f118f4d383713b89a682d772d/aiohttp-3.14.5.tar.gz", hash = "sha256:5558a7f5a05af9ecf744af91e5baefc436f93c9333e656c27ec253f9a6bbe178", size = 8078052, upload-time = "2026-10-11T01:05:12.408Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/d3/e1/2841e020ebb7aefae5513586193e011e06313d9a6bdbd296622afbbce204/aiohttp-3.14.5-cp313-cp313-android_24_arm64_v8a.whl", hash = "sha256:9ad7e6aa38c20da1be697874349c4c273c8a03b7887169665081706398d0439a", size = 538932, upload-time = "2026-10-11T01:00:54.3Z" }, + { url = "https://files.pythonhosted.org/packages/f7/a6/7fb8ea8fe96bcc7b7c7a36d10f021d99d01a8dc8a4b3f0ddacecfad9a80e/aiohttp-3.14.5-cp313-cp313-android_24_x86_64.whl", hash = "sha256:f59c7673465908cbe506117176156c127f29f917677afceada34957179221d91", size = 553329, upload-time = "2026-10-11T01:00:56.442Z" }, + { url = "https://files.pythonhosted.org/packages/de/64/d056e3c27647dc25af1a592cf356245382ea7c808171b9dac7677afedfc8/aiohttp-3.14.5-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:1b5416552740edf07234cc9437d0706f2acb67b93c198670b1a68e1b2b587dec", size = 521367, upload-time = "2026-10-11T01:00:58.345Z" }, + { url = "https://files.pythonhosted.org/packages/3e/e4/95226147e11d4db916fd1d495dcf85af8e3816e38333e42718241196e848/aiohttp-3.14.5-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:43351bdb5e4c3cb7d1772368e988534e869a74db7778079a83782c11c69535c7", size = 528322, upload-time = "2026-10-11T01:01:00.211Z" }, + { url = "https://files.pythonhosted.org/packages/17/cd/1d3c9192cafdb51cad62b2d3ded96cff9cc8af51893210aadd448a325389/aiohttp-3.14.5-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:c8c4478bef6d57fcfda15dae461ea3c9f06aa7b257c58df3f2300174ccbb185a", size = 539874, upload-time = "2026-10-11T01:01:02.06Z" }, + { url = "https://files.pythonhosted.org/packages/f6/0c/dfa33aecc7d4d1dc75e05248f5eac5a0edf4d09e7b44d93ab62529b0c1db/aiohttp-3.14.5-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:c2c30484dd1417ef98b51021ffa2cc0d7f3c78918adaaaab7e70817335ab3e02", size = 813836, upload-time = "2026-10-11T01:01:04.01Z" }, + { url = "https://files.pythonhosted.org/packages/33/17/4a63738052d20567d55529d6daa1b9480d906fd52930fbcf6d3fbed618f0/aiohttp-3.14.5-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:dab9ac5a67c8d1f070c00fa8fccb7cbd1b8dcc1a8d6b42f37540df9b3d4cc603", size = 548070, upload-time = "2026-10-11T01:01:06.035Z" }, + { url = "https://files.pythonhosted.org/packages/15/e5/b57e58695a757fd4c02497c033fced96a69c631b13866c43d336530c9670/aiohttp-3.14.5-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:e1cc2bfaee8c214f06080a7c7d5772419b8a1108e8e5349236189811823fb02a", size = 545786, upload-time = "2026-10-11T01:01:07.817Z" }, + { url = "https://files.pythonhosted.org/packages/9a/68/8c2c67a3aedf46e00f3c42f04fbc6983de80d4ed5786151e33681ba45883/aiohttp-3.14.5-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:74efb69332b85675b1eabd760a8cfc2e2cf42c60607c66f88014c1bdfb40942d", size = 1886492, upload-time = "2026-10-11T01:01:09.834Z" }, + { url = "https://files.pythonhosted.org/packages/ab/4b/74aab5e8d28c62e8f795b4fe8f38cf5586fd264a9a27bd2141ef6490333d/aiohttp-3.14.5-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:42b5e616946dbaf505e2bff18c9af2cd4ef9e7ef300ee58a6e951a5b7cf147ae", size = 1870057, upload-time = "2026-10-11T01:01:12.045Z" }, + { url = "https://files.pythonhosted.org/packages/a8/f7/eafc3b1988302b1815d9fd4a21071be5c360d616c0a430d02fd92dc97688/aiohttp-3.14.5-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f9033b43f511f27547c557dcaba0177649e10a3725336ccd2cce0fdc1dc4850d", size = 1925119, upload-time = "2026-10-11T01:01:14.09Z" }, + { url = "https://files.pythonhosted.org/packages/a1/04/78d8f294f74dd570f3898ff20402349fce524176045df98ba727d6846a68/aiohttp-3.14.5-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:15a310d3c71398e3d7bfc93a1a73fbe664315cd9e9016b8efc1cff85eeab7155", size = 2053137, upload-time = "2026-10-11T01:01:16.344Z" }, + { url = "https://files.pythonhosted.org/packages/32/51/395d225ef36f5a50d8e548dcd3141bfdbcd31fb6eed859022c573d2c4d66/aiohttp-3.14.5-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:1ffa3a523a36d8628f98c06492ae16a31a23d14c0b4ec721757b477319f656d6", size = 1911038, upload-time = "2026-10-11T01:01:18.653Z" }, + { url = "https://files.pythonhosted.org/packages/ff/a4/2aec1aa06d82e8a244843b5dae31d78061e5e76744270a86dd0ee051c889/aiohttp-3.14.5-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:5fb6a6e919bfb703227bc1ce6579281b84b1a2ba57deb9794dfdbec7dcd1e40c", size = 1702205, upload-time = "2026-10-11T01:01:20.904Z" }, + { url = "https://files.pythonhosted.org/packages/16/27/6051bfde7b6f418f70edd60d655fa426abb3355fa0981764739d87ecf160/aiohttp-3.14.5-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:43e1b7994a8b038125f722bff07492ef501110722c2727c408995d9fb864c421", size = 1848588, upload-time = "2026-10-11T01:01:22.918Z" }, + { url = "https://files.pythonhosted.org/packages/9e/44/55efc06fc26c4e6e1c095f231b4c222bf2d86d64a8eebbc24b2bb5958ea8/aiohttp-3.14.5-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:5f3e96071686755d9cd3600c3880183eb94b012178e92746d68101800f0ed8a3", size = 1887540, upload-time = "2026-10-11T01:01:25.278Z" }, + { url = "https://files.pythonhosted.org/packages/48/dc/1502bfdc2a65760d386ac6a00090b0addaa8a3c9c60b3f8127fad3a9afb2/aiohttp-3.14.5-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:cd88b01f3d37b7a2a34f91d98f14720206f1ea3d540843fab2d649dd5fb91fec", size = 1895030, upload-time = "2026-10-11T01:01:27.316Z" }, + { url = "https://files.pythonhosted.org/packages/93/7e/44174bb6288264418c9eec07a5e35180969c0d5a796c7af544db3cb8a33a/aiohttp-3.14.5-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:f2ed8b64dc0c651c0f5a9c926777719770021251b8f336d97c4b80b660836ce1", size = 1693244, upload-time = "2026-10-11T01:01:29.39Z" }, + { url = "https://files.pythonhosted.org/packages/47/dd/b507d64e50db23888582fff08eda13998b12f9dea70c072edaac19218380/aiohttp-3.14.5-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:a9918e58faf62ba2c7147927d06057aec78f42475aff5048047ec47e7265a600", size = 1926308, upload-time = "2026-10-11T01:01:31.634Z" }, + { url = "https://files.pythonhosted.org/packages/98/4b/5b51b4f63e3f2793151f4aea49c48fe1e00baeb7cec9c7a206de499f8de0/aiohttp-3.14.5-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:42f320d4a5b00b9af0bddcfec5407dc6f2d9816f006b2f79ebbaa31f16895df3", size = 1888406, upload-time = "2026-10-11T01:01:33.715Z" }, + { url = "https://files.pythonhosted.org/packages/ff/13/d5e818a5eaba9f822016727299f41c0e1075799f82a6433ec508a93ab867/aiohttp-3.14.5-cp313-cp313-win32.whl", hash = "sha256:3ae800a20947e2c2e53088047d021e6bf7d51560cc49f6a0737a1f79d2e3a13c", size = 479970, upload-time = "2026-10-11T01:01:35.677Z" }, + { url = "https://files.pythonhosted.org/packages/8d/d0/8eca2c65aa467320990d78fb2005f38ed3588944280c39ff9deb6423fef1/aiohttp-3.14.5-cp313-cp313-win_amd64.whl", hash = "sha256:d05e94cdfe0d15d0206f970722d2554780ce562787b21b218b275447f8751319", size = 505985, upload-time = "2026-10-11T01:01:37.574Z" }, + { url = "https://files.pythonhosted.org/packages/7a/f8/4cdd65305d2fca14b886bea9ed2abb1fe726287872524e56e3d26692b47d/aiohttp-3.14.5-cp313-cp313-win_arm64.whl", hash = "sha256:f001b571ead90ca1770f1e616db255351a1703317f20374c361ef22f12c06d09", size = 487629, upload-time = "2026-10-11T01:01:39.477Z" }, + { url = "https://files.pythonhosted.org/packages/68/30/173960c42b05a6c59f7558e4b12a4b0d9ba376cf6aa9bde7f9e08a30ca8d/aiohttp-3.14.5-py3-none-any.whl", hash = "sha256:efc21a454892828368b11c2c780de0ff8bc991f73f6b99c6b66e56205470929b", size = 279517, upload-time = "2026-10-11T01:05:08.523Z" }, ] [[package]] @@ -147,14 +150,14 @@ wheels = [ [[package]] name = "anyio" -version = "4.12.1" +version = "4.14.2" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "idna" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/96/f0/5eb65b2bb0d09ac6776f2eb54adee6abe8228ea05b20a5ad0e4945de8aac/anyio-4.12.1.tar.gz", hash = "sha256:41cfcc3a4c85d3f05c932da7c26d0201ac36f72abd4435ba90d0464a3ffed703", size = 228685, upload-time = "2026-01-06T11:45:21.246Z" } +sdist = { url = "https://files.pythonhosted.org/packages/61/cc/a381afa6efea9f496eff839d4a6a1aed3bfafc7b3ab4b0d1b243a12573dd/anyio-4.14.2.tar.gz", hash = "sha256:cfa139f3ed1a23ee8f88a145ddb5ac7605b8bbfd8592baacd7ce3d8bb4313c7f", size = 260176, upload-time = "2026-07-12T20:29:07.082Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/38/0e/27be9fdef66e72d64c0cdc3cc2823101b80585f8119b5c112c2e8f5f7dab/anyio-4.12.1-py3-none-any.whl", hash = "sha256:d405828884fc140aa80a3c667b8beed277f1dfedec42ba031bd6ac3db606ab6c", size = 113592, upload-time = "2026-01-06T11:45:19.497Z" }, + { url = "https://files.pythonhosted.org/packages/da/35/f2287558c17e29fafc8ef3daf819bb9834061cfa43bff8014f7df7f63bdc/anyio-4.14.2-py3-none-any.whl", hash = "sha256:9f505dda5ac9f0c8309b5e8bd445a8c2bf7246f3ce950121e45ea15bc41d1494", size = 125813, upload-time = "2026-07-12T20:29:05.763Z" }, ] [[package]] @@ -239,6 +242,34 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/31/07/4cdc81a47bf862c0b06d91f1bc6782064e8b69ac9b5d4ff51d97e4ff03da/blis-1.3.3-cp313-cp313-win_amd64.whl", hash = "sha256:7a0fc4b237a3a453bdc3c7ab48d91439fcd2d013b665c46948d9eaf9c3e45a97", size = 6192624, upload-time = "2025-11-17T12:28:14.197Z" }, ] +[[package]] +name = "boto3" +version = "1.43.120" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "botocore" }, + { name = "jmespath" }, + { name = "s3transfer" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/0f/d3/9426f7c627719bd0f8ab3827a91362805b72fc721dcddd61a3daef555d4a/boto3-1.43.120.tar.gz", hash = "sha256:9d85840e721869f8202ab5f6b4ec3e697ac46343116cc8d1d0804ec58f90c503", size = 112687, upload-time = "2026-10-27T19:20:31.944Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/7a/42/04025133386d7881ca2235044c2ed9ffa33c8f80c91453b2114567463b9c/boto3-1.43.120-py3-none-any.whl", hash = "sha256:86978245a7b911549a44df3f805ae4ce94a8154f4ebe4a166631b8a6d7af2697", size = 140041, upload-time = "2026-10-27T19:20:27.812Z" }, +] + +[[package]] +name = "botocore" +version = "1.43.120" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "jmespath" }, + { name = "python-dateutil" }, + { name = "urllib3" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/dd/81/f45d4be966d44d01d9e342fecaacdd95909034c096b56cc8c209ede1f9d7/botocore-1.43.120.tar.gz", hash = "sha256:f479cbb7273b9c0ea589a91a7abe38badda6353fb7c237a22c7461a06d279ee2", size = 16465596, upload-time = "2026-10-27T19:20:24.461Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/a1/d4/ea06db5d3dd35b5782faaa7a4ef68b8e7f51e35e62bd4f92758dc73ca01e/botocore-1.43.120-py3-none-any.whl", hash = "sha256:7f54674f26f0d9a500bf44a1f858e88b70b03c82b2aca385ddf51f6e968bfd01", size = 16164042, upload-time = "2026-10-27T19:20:19.875Z" }, +] + [[package]] name = "catalogue" version = "2.0.10" @@ -560,11 +591,11 @@ wheels = [ [[package]] name = "fsspec" -version = "2026.1.0" +version = "2026.9.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/d5/7d/5df2650c57d47c57232af5ef4b4fdbff182070421e405e0d62c6cdbfaa87/fsspec-2026.1.0.tar.gz", hash = "sha256:e987cb0496a0d81bba3a9d1cee62922fb395e7d4c3b575e57f547953334fe07b", size = 310496, upload-time = "2026-01-09T15:21:35.562Z" } +sdist = { url = "https://files.pythonhosted.org/packages/77/cd/9be253869fc42e764de7f3dedd6969af7d44ff9c3375214a3442a6f3fc08/fsspec-2026.9.0.tar.gz", hash = "sha256:0f08147951c8cb31d844c3547d631053b127863b60be04cf06e121333ee0e2fe", size = 333545, upload-time = "2026-09-18T17:50:42.825Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/01/c9/97cc5aae1648dcb851958a3ddf73ccd7dbe5650d95203ecb4d7720b4cdbf/fsspec-2026.1.0-py3-none-any.whl", hash = "sha256:cb76aa913c2285a3b49bdd5fc55b1d7c708d7208126b60f2eb8194fe1b4cbdcc", size = 201838, upload-time = "2026-01-09T15:21:34.041Z" }, + { url = "https://files.pythonhosted.org/packages/6c/c0/a98505f18594f1bce828bb159cec0fcf9860562f1a2c85913409fc8f3d9e/fsspec-2026.9.0-py3-none-any.whl", hash = "sha256:8dd6e646e99ea382bd85f97a45e6b526a442d79423a7dc673f1e2756d05fcb5f", size = 221738, upload-time = "2026-09-18T17:50:41.341Z" }, ] [[package]] @@ -997,6 +1028,15 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/d9/32/63cb1d9f1c5c6632a783c0052cde9ef7ba82688f7065e2f0d5f10a7e3edb/jiter-0.12.0-cp313-cp313t-win_arm64.whl", hash = "sha256:88ef757017e78d2860f96250f9393b7b577b06a956ad102c29c8237554380db3", size = 185628, upload-time = "2025-11-09T20:48:09.572Z" }, ] +[[package]] +name = "jmespath" +version = "1.1.0" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/d3/59/322338183ecda247fb5d1763a6cbe46eff7222eaeebafd9fa65d4bf5cb11/jmespath-1.1.0.tar.gz", hash = "sha256:472c87d80f36026ae83c6ddd0f1d05d4e510134ed462851fd5f754c8c3cbb88d", size = 27377, upload-time = "2026-01-22T16:35:26.279Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/14/2f/967ba146e6d58cf6a652da73885f52fc68001525b4197effc174321d70b4/jmespath-1.1.0-py3-none-any.whl", hash = "sha256:a5663118de4908c91729bea0acadca56526eb2698e83de10cd116ae0f4e97c64", size = 20419, upload-time = "2026-01-22T16:35:24.919Z" }, +] + [[package]] name = "joserfc" version = "1.7.2" @@ -1058,10 +1098,11 @@ wheels = [ [[package]] name = "litellm" -version = "1.89.2" +version = "1.100.5" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "aiohttp" }, + { name = "boto3" }, { name = "click" }, { name = "fastuuid" }, { name = "httpx" }, @@ -1070,25 +1111,32 @@ dependencies = [ { name = "jsonschema" }, { name = "openai" }, { name = "pydantic" }, + { name = "pydantic-settings" }, { name = "python-dotenv" }, { name = "tiktoken" }, { name = "tokenizers" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/c1/29/865d38325f9c424daf0bcc7ab61908cf51a87862b3a0dfebd059b60dac97/litellm-1.89.2.tar.gz", hash = "sha256:b2534d69568eed026310f4e006407db2d46494eb629bd1e71eb9603ec146540d", size = 14079449, upload-time = "2026-06-18T02:26:03.64Z" } +sdist = { url = "https://files.pythonhosted.org/packages/4f/c3/7a7b5aa004b3a476590c213520474dfb634f51e8b8a8821d9b099308564d/litellm-1.100.5.tar.gz", hash = "sha256:57dd977b82f182f7f821f90d3bf87a48b8469f2269cbe489857983524dadeee4", size = 16893387, upload-time = "2026-10-07T18:41:10.185Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/32/c8/51c93e8d017e7af02600171b5b6cc3805b07507acb2b94de7235ce764015/litellm-1.89.2-py3-none-any.whl", hash = "sha256:07e8e43b1a70fe919021376742897d18ffe7577ccfbb84632c949670f9abdc03", size = 15492797, upload-time = "2026-06-18T02:25:59.863Z" }, + { url = "https://files.pythonhosted.org/packages/87/b0/58d0d9435d010e2dea9e353278544e97102b5091ab6572074153ee85fa0c/litellm-1.100.5-cp310-abi3-macosx_10_12_x86_64.whl", hash = "sha256:4fcf7295d658405c93887cdf08f68932b5cfedd295116804385df3a24bbdac8e", size = 23346309, upload-time = "2026-10-07T18:40:48.819Z" }, + { url = "https://files.pythonhosted.org/packages/8e/54/0b83785afe480f799678ad46097cd48ef181bdab9dc4b4090cdfcc4885df/litellm-1.100.5-cp310-abi3-macosx_11_0_arm64.whl", hash = "sha256:ab7751c339803b58ae05ddaa8a212872c221fe10d0a2547637d3285ded51c2a0", size = 22997232, upload-time = "2026-10-07T18:40:51.691Z" }, + { url = "https://files.pythonhosted.org/packages/29/93/e017ec1c307f7c026a14915f831b7145b0b3f4f1c833d9a5afa402420cf2/litellm-1.100.5-cp310-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:5511a6af70b009754e8fafc2f8ae134667d90cb10def5f7bcb10c656c602ec77", size = 23129893, upload-time = "2026-10-07T18:40:55.283Z" }, + { url = "https://files.pythonhosted.org/packages/5e/3a/08baa2b0d2757627c4257a317026df11bdb06a881db67edb575d665ca643/litellm-1.100.5-cp310-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:dd41ce5d99c42ca3bd6cb5748e6a76de37d1673206f461ef2dfabb5d3129c040", size = 23507755, upload-time = "2026-10-07T18:40:58.671Z" }, + { url = "https://files.pythonhosted.org/packages/f8/f5/ae29fc6bb420e177b3d5510c3dc51fb54da730523f3a9870fd630341d18e/litellm-1.100.5-cp310-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:5e05b6b6046311e61a099eb9f2e018a33f11c15fb9b4822a9d30e35151a76bae", size = 23203141, upload-time = "2026-10-07T18:41:02.087Z" }, + { url = "https://files.pythonhosted.org/packages/0d/04/1ee9d3cb88816331d5929e71afdde5e0e30df2f4cf46fba90aa0e5f223f3/litellm-1.100.5-cp310-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:0d449ac20cbea8ddf0866a518352b08802d15a1e423e80df7a9a4bb60a46fdda", size = 23607663, upload-time = "2026-10-07T18:41:04.502Z" }, + { url = "https://files.pythonhosted.org/packages/6f/33/5c931a149ae3a150584d4d1a0c3917fdb121398c3d5d146fe35c84288c65/litellm-1.100.5-cp310-abi3-win_amd64.whl", hash = "sha256:8197c2bff14d9ba99314dd52fb45654e9b6b5c83ed9923fce000fa42d32d2bf1", size = 23425436, upload-time = "2026-10-07T18:41:07.472Z" }, ] [[package]] name = "mako" -version = "1.3.12" +version = "1.4.3" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "markupsafe" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/00/62/791b31e69ae182791ec67f04850f2f062716bbd205483d63a215f3e062d3/mako-1.3.12.tar.gz", hash = "sha256:9f778e93289bd410bb35daadeb4fc66d95a746f0b75777b942088b7fd7af550a", size = 400219, upload-time = "2026-04-28T19:01:08.512Z" } +sdist = { url = "https://files.pythonhosted.org/packages/5a/09/e07c4b5579a79f4b16f8d4f29f6c54514ac787c4ad506b8c4f28a0e6b0bf/mako-1.4.3.tar.gz", hash = "sha256:cd6537fe88d5fec315c55c2f8529bc4ce7a9a352ad7db3eeaa6a66e2dd4ec37a", size = 412799, upload-time = "2026-09-22T20:54:31.509Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/bc/b1/a0ec7a5a9db730a08daef1fdfb8090435b82465abbf758a596f0ea88727e/mako-1.3.12-py3-none-any.whl", hash = "sha256:8f61569480282dbf557145ce441e4ba888be453c30989f879f0d652e39f53ea9", size = 78521, upload-time = "2026-04-28T19:01:10.393Z" }, + { url = "https://files.pythonhosted.org/packages/6d/a0/053d6af3e8f871e0073b4a36732d9e65be77a72e5434c31b94f6af78a6bb/mako-1.4.3-py3-none-any.whl", hash = "sha256:723296007c870bfd6b3f0c3230dba7198096e5269297ebf5e4eff9e7ffa39d4f", size = 80164, upload-time = "2026-09-22T20:54:33.128Z" }, ] [[package]] @@ -1135,7 +1183,7 @@ wheels = [ [[package]] name = "mcp" -version = "1.29.1" +version = "1.30.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "anyio" }, @@ -1153,9 +1201,9 @@ dependencies = [ { name = "typing-inspection" }, { name = "uvicorn", marker = "sys_platform != 'emscripten'" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/b5/48/0bb26fdfe7ac16875f534a101ce2405eae192bdef37e7451f2f4507c13ec/mcp-1.29.1.tar.gz", hash = "sha256:1967ba4c315f7a375146209949f45950d18b0efd2f913d7cf3400bc723ee5f04", size = 646823, upload-time = "2026-08-24T18:30:41.161Z" } +sdist = { url = "https://files.pythonhosted.org/packages/ba/93/0142dc84a666daf8ad51a34268f34c12fd6fda4f3810c4be2504eecc8212/mcp-1.30.0.tar.gz", hash = "sha256:445414625fce5c295faa505bb11bacece661ab6f4028d57c935db57820b7a3e4", size = 680511, upload-time = "2026-09-07T14:34:15.845Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/0b/04/d6b4fb82eefe9e81807aabca1ac98f460ae0883974b83a997aaa20c52545/mcp-1.29.1-py3-none-any.whl", hash = "sha256:b6310eeb59153300c4ab8b9aec4c52f4819a2d6a8e429eb43d908bed7c783648", size = 224653, upload-time = "2026-08-24T18:30:39.573Z" }, + { url = "https://files.pythonhosted.org/packages/f5/f4/e58bc33317c92a0203664daaf00bf6f41166cc0149e5d6870a03f7cd004a/mcp-1.30.0-py3-none-any.whl", hash = "sha256:666edb5009503e1047c9d60346a756f94b261f05cc2625f23d41c728ffc484d0", size = 234581, upload-time = "2026-09-07T14:34:14.266Z" }, ] [[package]] @@ -1183,47 +1231,34 @@ wheels = [ [[package]] name = "multidict" -version = "6.7.1" -source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/1a/c2/c2d94cbe6ac1753f3fc980da97b3d930efe1da3af3c9f5125354436c073d/multidict-6.7.1.tar.gz", hash = "sha256:ec6652a1bee61c53a3e5776b6049172c53b6aaba34f18c9ad04f82712bac623d", size = 102010, upload-time = "2026-01-26T02:46:45.979Z" } -wheels = [ - { url = "https://files.pythonhosted.org/packages/f2/22/929c141d6c0dba87d3e1d38fbdf1ba8baba86b7776469f2bc2d3227a1e67/multidict-6.7.1-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:2b41f5fed0ed563624f1c17630cb9941cf2309d4df00e494b551b5f3e3d67a23", size = 76174, upload-time = "2026-01-26T02:44:18.509Z" }, - { url = "https://files.pythonhosted.org/packages/c7/75/bc704ae15fee974f8fccd871305e254754167dce5f9e42d88a2def741a1d/multidict-6.7.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:84e61e3af5463c19b67ced91f6c634effb89ef8bfc5ca0267f954451ed4bb6a2", size = 45116, upload-time = "2026-01-26T02:44:19.745Z" }, - { url = "https://files.pythonhosted.org/packages/79/76/55cd7186f498ed080a18440c9013011eb548f77ae1b297206d030eb1180a/multidict-6.7.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:935434b9853c7c112eee7ac891bc4cb86455aa631269ae35442cb316790c1445", size = 43524, upload-time = "2026-01-26T02:44:21.571Z" }, - { url = "https://files.pythonhosted.org/packages/e9/3c/414842ef8d5a1628d68edee29ba0e5bcf235dbfb3ccd3ea303a7fe8c72ff/multidict-6.7.1-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:432feb25a1cb67fe82a9680b4d65fb542e4635cb3166cd9c01560651ad60f177", size = 249368, upload-time = "2026-01-26T02:44:22.803Z" }, - { url = "https://files.pythonhosted.org/packages/f6/32/befed7f74c458b4a525e60519fe8d87eef72bb1e99924fa2b0f9d97a221e/multidict-6.7.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e82d14e3c948952a1a85503817e038cba5905a3352de76b9a465075d072fba23", size = 256952, upload-time = "2026-01-26T02:44:24.306Z" }, - { url = "https://files.pythonhosted.org/packages/03/d6/c878a44ba877f366630c860fdf74bfb203c33778f12b6ac274936853c451/multidict-6.7.1-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:4cfb48c6ea66c83bcaaf7e4dfa7ec1b6bbcf751b7db85a328902796dfde4c060", size = 240317, upload-time = "2026-01-26T02:44:25.772Z" }, - { url = "https://files.pythonhosted.org/packages/68/49/57421b4d7ad2e9e60e25922b08ceb37e077b90444bde6ead629095327a6f/multidict-6.7.1-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:1d540e51b7e8e170174555edecddbd5538105443754539193e3e1061864d444d", size = 267132, upload-time = "2026-01-26T02:44:27.648Z" }, - { url = "https://files.pythonhosted.org/packages/b7/fe/ec0edd52ddbcea2a2e89e174f0206444a61440b40f39704e64dc807a70bd/multidict-6.7.1-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:273d23f4b40f3dce4d6c8a821c741a86dec62cded82e1175ba3d99be128147ed", size = 268140, upload-time = "2026-01-26T02:44:29.588Z" }, - { url = "https://files.pythonhosted.org/packages/b0/73/6e1b01cbeb458807aa0831742232dbdd1fa92bfa33f52a3f176b4ff3dc11/multidict-6.7.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9d624335fd4fa1c08a53f8b4be7676ebde19cd092b3895c421045ca87895b429", size = 254277, upload-time = "2026-01-26T02:44:30.902Z" }, - { url = "https://files.pythonhosted.org/packages/6a/b2/5fb8c124d7561a4974c342bc8c778b471ebbeb3cc17df696f034a7e9afe7/multidict-6.7.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:12fad252f8b267cc75b66e8fc51b3079604e8d43a75428ffe193cd9e2195dfd6", size = 252291, upload-time = "2026-01-26T02:44:32.31Z" }, - { url = "https://files.pythonhosted.org/packages/5a/96/51d4e4e06bcce92577fcd488e22600bd38e4fd59c20cb49434d054903bd2/multidict-6.7.1-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:03ede2a6ffbe8ef936b92cb4529f27f42be7f56afcdab5ab739cd5f27fb1cbf9", size = 250156, upload-time = "2026-01-26T02:44:33.734Z" }, - { url = "https://files.pythonhosted.org/packages/db/6b/420e173eec5fba721a50e2a9f89eda89d9c98fded1124f8d5c675f7a0c0f/multidict-6.7.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:90efbcf47dbe33dcf643a1e400d67d59abeac5db07dc3f27d6bdeae497a2198c", size = 249742, upload-time = "2026-01-26T02:44:35.222Z" }, - { url = "https://files.pythonhosted.org/packages/44/a3/ec5b5bd98f306bc2aa297b8c6f11a46714a56b1e6ef5ebda50a4f5d7c5fb/multidict-6.7.1-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:5c4b9bfc148f5a91be9244d6264c53035c8a0dcd2f51f1c3c6e30e30ebaa1c84", size = 262221, upload-time = "2026-01-26T02:44:36.604Z" }, - { url = "https://files.pythonhosted.org/packages/cd/f7/e8c0d0da0cd1e28d10e624604e1a36bcc3353aaebdfdc3a43c72bc683a12/multidict-6.7.1-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:401c5a650f3add2472d1d288c26deebc540f99e2fb83e9525007a74cd2116f1d", size = 258664, upload-time = "2026-01-26T02:44:38.008Z" }, - { url = "https://files.pythonhosted.org/packages/52/da/151a44e8016dd33feed44f730bd856a66257c1ee7aed4f44b649fb7edeb3/multidict-6.7.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:97891f3b1b3ffbded884e2916cacf3c6fc87b66bb0dde46f7357404750559f33", size = 249490, upload-time = "2026-01-26T02:44:39.386Z" }, - { url = "https://files.pythonhosted.org/packages/87/af/a3b86bf9630b732897f6fc3f4c4714b90aa4361983ccbdcd6c0339b21b0c/multidict-6.7.1-cp313-cp313-win32.whl", hash = "sha256:e1c5988359516095535c4301af38d8a8838534158f649c05dd1050222321bcb3", size = 41695, upload-time = "2026-01-26T02:44:41.318Z" }, - { url = "https://files.pythonhosted.org/packages/b2/35/e994121b0e90e46134673422dd564623f93304614f5d11886b1b3e06f503/multidict-6.7.1-cp313-cp313-win_amd64.whl", hash = "sha256:960c83bf01a95b12b08fd54324a4eb1d5b52c88932b5cba5d6e712bb3ed12eb5", size = 45884, upload-time = "2026-01-26T02:44:42.488Z" }, - { url = "https://files.pythonhosted.org/packages/ca/61/42d3e5dbf661242a69c97ea363f2d7b46c567da8eadef8890022be6e2ab0/multidict-6.7.1-cp313-cp313-win_arm64.whl", hash = "sha256:563fe25c678aaba333d5399408f5ec3c383ca5b663e7f774dd179a520b8144df", size = 43122, upload-time = "2026-01-26T02:44:43.664Z" }, - { url = "https://files.pythonhosted.org/packages/6d/b3/e6b21c6c4f314bb956016b0b3ef2162590a529b84cb831c257519e7fde44/multidict-6.7.1-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:c76c4bec1538375dad9d452d246ca5368ad6e1c9039dadcf007ae59c70619ea1", size = 83175, upload-time = "2026-01-26T02:44:44.894Z" }, - { url = "https://files.pythonhosted.org/packages/fb/76/23ecd2abfe0957b234f6c960f4ade497f55f2c16aeb684d4ecdbf1c95791/multidict-6.7.1-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:57b46b24b5d5ebcc978da4ec23a819a9402b4228b8a90d9c656422b4bdd8a963", size = 48460, upload-time = "2026-01-26T02:44:46.106Z" }, - { url = "https://files.pythonhosted.org/packages/c4/57/a0ed92b23f3a042c36bc4227b72b97eca803f5f1801c1ab77c8a212d455e/multidict-6.7.1-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:e954b24433c768ce78ab7929e84ccf3422e46deb45a4dc9f93438f8217fa2d34", size = 46930, upload-time = "2026-01-26T02:44:47.278Z" }, - { url = "https://files.pythonhosted.org/packages/b5/66/02ec7ace29162e447f6382c495dc95826bf931d3818799bbef11e8f7df1a/multidict-6.7.1-cp313-cp313t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:3bd231490fa7217cc832528e1cd8752a96f0125ddd2b5749390f7c3ec8721b65", size = 242582, upload-time = "2026-01-26T02:44:48.604Z" }, - { url = "https://files.pythonhosted.org/packages/58/18/64f5a795e7677670e872673aca234162514696274597b3708b2c0d276cce/multidict-6.7.1-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:253282d70d67885a15c8a7716f3a73edf2d635793ceda8173b9ecc21f2fb8292", size = 250031, upload-time = "2026-01-26T02:44:50.544Z" }, - { url = "https://files.pythonhosted.org/packages/c8/ed/e192291dbbe51a8290c5686f482084d31bcd9d09af24f63358c3d42fd284/multidict-6.7.1-cp313-cp313t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:0b4c48648d7649c9335cf1927a8b87fa692de3dcb15faa676c6a6f1f1aabda43", size = 228596, upload-time = "2026-01-26T02:44:51.951Z" }, - { url = "https://files.pythonhosted.org/packages/1e/7e/3562a15a60cf747397e7f2180b0a11dc0c38d9175a650e75fa1b4d325e15/multidict-6.7.1-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:98bc624954ec4d2c7cb074b8eefc2b5d0ce7d482e410df446414355d158fe4ca", size = 257492, upload-time = "2026-01-26T02:44:53.902Z" }, - { url = "https://files.pythonhosted.org/packages/24/02/7d0f9eae92b5249bb50ac1595b295f10e263dd0078ebb55115c31e0eaccd/multidict-6.7.1-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:1b99af4d9eec0b49927b4402bcbb58dea89d3e0db8806a4086117019939ad3dd", size = 255899, upload-time = "2026-01-26T02:44:55.316Z" }, - { url = "https://files.pythonhosted.org/packages/00/e3/9b60ed9e23e64c73a5cde95269ef1330678e9c6e34dd4eb6b431b85b5a10/multidict-6.7.1-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6aac4f16b472d5b7dc6f66a0d49dd57b0e0902090be16594dc9ebfd3d17c47e7", size = 247970, upload-time = "2026-01-26T02:44:56.783Z" }, - { url = "https://files.pythonhosted.org/packages/3e/06/538e58a63ed5cfb0bd4517e346b91da32fde409d839720f664e9a4ae4f9d/multidict-6.7.1-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:21f830fe223215dffd51f538e78c172ed7c7f60c9b96a2bf05c4848ad49921c3", size = 245060, upload-time = "2026-01-26T02:44:58.195Z" }, - { url = "https://files.pythonhosted.org/packages/b2/2f/d743a3045a97c895d401e9bd29aaa09b94f5cbdf1bd561609e5a6c431c70/multidict-6.7.1-cp313-cp313t-musllinux_1_2_armv7l.whl", hash = "sha256:f5dd81c45b05518b9aa4da4aa74e1c93d715efa234fd3e8a179df611cc85e5f4", size = 235888, upload-time = "2026-01-26T02:44:59.57Z" }, - { url = "https://files.pythonhosted.org/packages/38/83/5a325cac191ab28b63c52f14f1131f3b0a55ba3b9aa65a6d0bf2a9b921a0/multidict-6.7.1-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:eb304767bca2bb92fb9c5bd33cedc95baee5bb5f6c88e63706533a1c06ad08c8", size = 243554, upload-time = "2026-01-26T02:45:01.054Z" }, - { url = "https://files.pythonhosted.org/packages/20/1f/9d2327086bd15da2725ef6aae624208e2ef828ed99892b17f60c344e57ed/multidict-6.7.1-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:c9035dde0f916702850ef66460bc4239d89d08df4d02023a5926e7446724212c", size = 252341, upload-time = "2026-01-26T02:45:02.484Z" }, - { url = "https://files.pythonhosted.org/packages/e8/2c/2a1aa0280cf579d0f6eed8ee5211c4f1730bd7e06c636ba2ee6aafda302e/multidict-6.7.1-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:af959b9beeb66c822380f222f0e0a1889331597e81f1ded7f374f3ecb0fd6c52", size = 246391, upload-time = "2026-01-26T02:45:03.862Z" }, - { url = "https://files.pythonhosted.org/packages/e5/03/7ca022ffc36c5a3f6e03b179a5ceb829be9da5783e6fe395f347c0794680/multidict-6.7.1-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:41f2952231456154ee479651491e94118229844dd7226541788be783be2b5108", size = 243422, upload-time = "2026-01-26T02:45:05.296Z" }, - { url = "https://files.pythonhosted.org/packages/dc/1d/b31650eab6c5778aceed46ba735bd97f7c7d2f54b319fa916c0f96e7805b/multidict-6.7.1-cp313-cp313t-win32.whl", hash = "sha256:df9f19c28adcb40b6aae30bbaa1478c389efd50c28d541d76760199fc1037c32", size = 47770, upload-time = "2026-01-26T02:45:06.754Z" }, - { url = "https://files.pythonhosted.org/packages/ac/5b/2d2d1d522e51285bd61b1e20df8f47ae1a9d80839db0b24ea783b3832832/multidict-6.7.1-cp313-cp313t-win_amd64.whl", hash = "sha256:d54ecf9f301853f2c5e802da559604b3e95bb7a3b01a9c295c6ee591b9882de8", size = 53109, upload-time = "2026-01-26T02:45:08.044Z" }, - { url = "https://files.pythonhosted.org/packages/3d/a3/cc409ba012c83ca024a308516703cf339bdc4b696195644a7215a5164a24/multidict-6.7.1-cp313-cp313t-win_arm64.whl", hash = "sha256:5a37ca18e360377cfda1d62f5f382ff41f2b8c4ccb329ed974cc2e1643440118", size = 45573, upload-time = "2026-01-26T02:45:09.349Z" }, - { url = "https://files.pythonhosted.org/packages/81/08/7036c080d7117f28a4af526d794aab6a84463126db031b007717c1a6676e/multidict-6.7.1-py3-none-any.whl", hash = "sha256:55d97cc6dae627efa6a6e548885712d4864b81110ac76fa4e534c03819fa4a56", size = 12319, upload-time = "2026-01-26T02:46:44.004Z" }, +version = "6.9.1" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/d6/99/1d4d69c3512d0ddbfa3a1b69cfd9a151012ab2eb4eabbb096201b1f0b7d8/multidict-6.9.1.tar.gz", hash = "sha256:0f06e60fa190aa7abd0914c2a766736fdc8e9f34878c4346338534b73d1b20e2", size = 182404, upload-time = "2026-09-21T17:59:05.362Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/eb/45/ddf7c76860f5f553a23ad3ca38463ccf5247081618977742c8dc4625355e/multidict-6.9.1-cp313-cp313-android_24_x86_64.whl", hash = "sha256:d7bf9e43282d69561618e8a0ea33368d532ebef42f15c096f427090521dd74f3", size = 63266, upload-time = "2026-09-21T17:55:42.676Z" }, + { url = "https://files.pythonhosted.org/packages/6d/d3/f4ae5945ea2de597eaeb4eca3a74c59783ace54482c9b49435442b63efa8/multidict-6.9.1-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:03d47df72f084f757c1cb771188d5f4e3a805e4abc4d67e32509272343ae9382", size = 55771, upload-time = "2026-09-21T17:55:44.016Z" }, + { url = "https://files.pythonhosted.org/packages/93/7d/15468239920040d01c686e5ae669e6382f7bf31fc3e5e0a6b8f1c3b32d3b/multidict-6.9.1-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:6bc94fe17c3c56e5418f79515b786b101845f70609b0d19d0c1ba13448e5633a", size = 57116, upload-time = "2026-09-21T17:55:45.315Z" }, + { url = "https://files.pythonhosted.org/packages/17/1b/b958f06aac2d8b1e485eb1c105b1b159cbf3868249e5142142451577dad2/multidict-6.9.1-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:8f2973bbd2bebd9d2e0cd6394c1292a1a19ccd56bdcbe1e174059f1a39be5b40", size = 97692, upload-time = "2026-09-21T17:55:46.674Z" }, + { url = "https://files.pythonhosted.org/packages/93/6c/d6cfe18e61010166d7237d7527c775eb9843e7078feadea45b7628751b60/multidict-6.9.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:de7738b8c0bb74c4cc16bbd7fb49fc2bcf6430dba11b3432cd52768ae40933e8", size = 59556, upload-time = "2026-09-21T17:55:48.22Z" }, + { url = "https://files.pythonhosted.org/packages/46/46/9b4c1127cece0289fb207d04aae5116382ddfcb2a4dc8e0cb49a33f3c7b3/multidict-6.9.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:e5ccad4b7bac125722f48d6f862bed3b514d8526deea06316bb72f152cd30a7c", size = 57357, upload-time = "2026-09-21T17:55:49.998Z" }, + { url = "https://files.pythonhosted.org/packages/bc/fc/c18b07100a6064573e49e538d13d47eb2b5221f48080512df78aef54ab04/multidict-6.9.1-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:a49ff5cdb33654cb7d6a3c377aa2a83ddefaa1db31eb10bcf3c180aa84f9af8a", size = 330433, upload-time = "2026-09-21T17:55:51.435Z" }, + { url = "https://files.pythonhosted.org/packages/62/ff/52a0082adeb69656b634609d4fb0ae65456deaae4cca3d5a12656626dc50/multidict-6.9.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b22ff30006a2f28f8bff878fb93413cbe3a4d1fd517c28081d848c90e9cfd2c8", size = 332487, upload-time = "2026-09-21T17:55:52.937Z" }, + { url = "https://files.pythonhosted.org/packages/39/3e/80bd4729635a7af371ff4dcc312594cf96e73f98854491be8740792de430/multidict-6.9.1-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:3adf06c66041aa21eeb8a71e82379b74773298c8e6d3d839b151aae441a99b94", size = 316911, upload-time = "2026-09-21T17:55:54.751Z" }, + { url = "https://files.pythonhosted.org/packages/15/f4/7ea4a907e053e924e2e1694d90560f79f72056504bfd5e8483695f9527d2/multidict-6.9.1-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:963a8d8f97057082679523d0fd4c53a38f86bc58cabe4556faef682ae53fa2fa", size = 344950, upload-time = "2026-09-21T17:55:56.5Z" }, + { url = "https://files.pythonhosted.org/packages/0d/16/9642ae41fbfbdc546aa481c2b07ae1bc087a94ab5f5020b4d9ab77da401f/multidict-6.9.1-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:b66ccc5c2cdd26e74fa5d4c29ffae424cc6148bf93ce574821783fb3b6d452c5", size = 350264, upload-time = "2026-09-21T17:55:58.073Z" }, + { url = "https://files.pythonhosted.org/packages/93/f2/e06c8e42074d0a4b8419bfe92afbd1d262190b69549ecbcd2dffa4f103c2/multidict-6.9.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:7fd79c521f6290c69125fa2b85fa65d9e657e6a8ffaf722dc881b926bef4aa5c", size = 336213, upload-time = "2026-09-21T17:55:59.723Z" }, + { url = "https://files.pythonhosted.org/packages/98/43/d7cf9ef4700e7c25244590d1b4f20cf12cbed86beba6c17be4d9e48c1099/multidict-6.9.1-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:1d804e4caf5d5da37d6dac1325da5629ebef1e27a294c2b568b295814aa36c7b", size = 302555, upload-time = "2026-09-21T17:56:01.666Z" }, + { url = "https://files.pythonhosted.org/packages/7d/3a/54209920324bc3928f5f2ba28b01a6dd957a9d48c3aaff77e38faaf5668d/multidict-6.9.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:bb0d664505f4b112f384cffeee82e91e3f6448d8e574989479db4439b68cba05", size = 322247, upload-time = "2026-09-21T17:56:03.265Z" }, + { url = "https://files.pythonhosted.org/packages/33/50/df96f961b178b621ab0adbf9221d4fd21534e1064fd9f5e85c1fa27fea55/multidict-6.9.1-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:9e14d17773b1b3c758ff153659a1824608a0cb562c45f484b5ed8a433428444a", size = 321787, upload-time = "2026-09-21T17:56:04.894Z" }, + { url = "https://files.pythonhosted.org/packages/a7/9b/37f354562a8f82f9c1f63d3a94300fc82126d50320175f0702bbd544f87c/multidict-6.9.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:083735b7f395894e43adb278d5dae901448883a835ff8f1977e285fefdb10418", size = 335498, upload-time = "2026-09-21T17:56:06.783Z" }, + { url = "https://files.pythonhosted.org/packages/1e/44/78e366efc6c004185295cc9eb9711c10f13eadf3b547603b9c5526329976/multidict-6.9.1-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:b65121091567847a8cb520d364ab22ba90e00d3cc55fa9eb34bb439f0684bcd1", size = 338244, upload-time = "2026-09-21T17:56:09.162Z" }, + { url = "https://files.pythonhosted.org/packages/ad/2b/ab5bd3964691abe4d14b43bdbdb8a621b77cea2ca352dc93159ec0a4575b/multidict-6.9.1-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:ea999ae6e80e66ad5eea287860951b033d0104ca34d6d87c7b5125ebe0e12721", size = 301641, upload-time = "2026-09-21T17:56:11.227Z" }, + { url = "https://files.pythonhosted.org/packages/ea/a8/f6bc899f5aafaba755edc8e4bb934bc00b1e405f8d3fbc1dd10283738074/multidict-6.9.1-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:095d900c242e00fbe5f321ee072e7278b4153e78c5ce9c1efde167d62c1e4771", size = 340162, upload-time = "2026-09-21T17:56:13.076Z" }, + { url = "https://files.pythonhosted.org/packages/eb/03/a8fc809ef364b8c231c065ea2ea2f97ae86d4f9a0e36b5721759fd606778/multidict-6.9.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6441cc837aea58be7d9baef1b2383eb8311ab9303f500f99ac90b584cd78bb14", size = 332826, upload-time = "2026-09-21T17:56:15.175Z" }, + { url = "https://files.pythonhosted.org/packages/f2/27/32dde80245e2024e9bb7a6ca3c2fb7c695dc74014cba557cc35be6f91e24/multidict-6.9.1-cp313-cp313-win32.whl", hash = "sha256:9c4880d017555d70dea367dd49271830842d48e3891c2da97da7ce8c4abcee40", size = 52378, upload-time = "2026-09-21T17:56:16.959Z" }, + { url = "https://files.pythonhosted.org/packages/be/78/1bac2987edac273a6b27fa50e9204bc3466c94a7b4f6a44828d730f8810f/multidict-6.9.1-cp313-cp313-win_amd64.whl", hash = "sha256:ac51cd64bae51c462ea58ad2492c9b8209667a4ef60c45c4a304518b67598d5d", size = 59449, upload-time = "2026-09-21T17:56:18.336Z" }, + { url = "https://files.pythonhosted.org/packages/e1/32/2a77ce19eea48cb9b3521a202b513ba3349aafa702c8317be0b645ffb74b/multidict-6.9.1-cp313-cp313-win_arm64.whl", hash = "sha256:37a9ebe00c698279213d56e6c64e1962ab1e092918270649b397cac3dc196ca4", size = 54713, upload-time = "2026-09-21T17:56:19.774Z" }, + { url = "https://files.pythonhosted.org/packages/be/59/e26cb779be4c591d1a910f59d29aca9fba4de70349840a833beba2652371/multidict-6.9.1-py3-none-any.whl", hash = "sha256:7bf6478188f4e47bf5686e8a33da4ae28bf43b1b2528d9ee144d28492bfac60b", size = 19176, upload-time = "2026-09-21T17:59:03.501Z" }, ] [[package]] @@ -1308,7 +1343,7 @@ requires-dist = [ { name = "igraph", specifier = ">=0.11" }, { name = "jinja2", specifier = ">=3.1.4" }, { name = "leidenalg", specifier = ">=0.10" }, - { name = "litellm", specifier = ">=1.84.0" }, + { name = "litellm", specifier = ">=1.95.0" }, { name = "mcp", specifier = ">=1.28.1,<2.0.0" }, { name = "microsandbox", specifier = ">=0.1.8" }, { name = "networkx", specifier = ">=3.0" }, @@ -1816,11 +1851,11 @@ wheels = [ [[package]] name = "pyjwt" -version = "2.13.0" +version = "2.15.1" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" } +sdist = { url = "https://files.pythonhosted.org/packages/43/ea/5194e52748b0da83d71e082d75496eaec6e58f419f5e184786ded517e6a9/pyjwt-2.15.1.tar.gz", hash = "sha256:4f259e80cdfb6b3fc18a7de51fd1ef9ec79652f25019bae68975ca2468a34df8", size = 121252, upload-time = "2026-09-28T18:40:42.598Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" }, + { url = "https://files.pythonhosted.org/packages/50/ca/44de4e75f8aadc457f0634be3b542815078ded46dca30efb960edeecad6e/pyjwt-2.15.1-py3-none-any.whl", hash = "sha256:42d59d631f7768a1028a64c7ff581a9bf7519804daf91fc5b6c56e30eec5e193", size = 33860, upload-time = "2026-09-28T18:40:41.429Z" }, ] [package.optional-dependencies] @@ -2096,6 +2131,18 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/9e/6a/40fee331a52339926a92e17ae748827270b288a35ef4a15c9c8f2ec54715/ruff-0.14.14-py3-none-win_arm64.whl", hash = "sha256:56e6981a98b13a32236a72a8da421d7839221fa308b223b9283312312e5ac76c", size = 10920448, upload-time = "2026-01-22T22:30:15.417Z" }, ] +[[package]] +name = "s3transfer" +version = "0.19.3" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "botocore" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/49/c5/0a5ce655109cb96b8dfad36908a4e108d15f5dc2eff8fbc3146c4312e704/s3transfer-0.19.3.tar.gz", hash = "sha256:8326acc3d056d7f7b8a37110c7d2aea41f67e83f6ae79cd3b5fbcca34c726406", size = 166087, upload-time = "2026-10-19T19:19:49.751Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/e2/a4/88f9e10498759121060b8050a1554753dfc04df39bbbcc7aad9ecc8d9440/s3transfer-0.19.3-py3-none-any.whl", hash = "sha256:24eb7535804306355e31c952a90022bf5b2f9d760f9a11062c7493a217c08553", size = 90252, upload-time = "2026-10-19T19:19:48.309Z" }, +] + [[package]] name = "setuptools" version = "84.0.0" @@ -2152,11 +2199,11 @@ wheels = [ [[package]] name = "soupsieve" -version = "2.8.4" +version = "2.10" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/47/2c/0a5f6f8ee0d5589e48c7640213ed5175d52cf540a06725b628cc1a45d6ce/soupsieve-2.8.4.tar.gz", hash = "sha256:e121fd02e975c695e4e9e8774a5ee35d74714b59307868dcc5319ad2d9e3328e", size = 121110, upload-time = "2026-05-24T13:55:57.154Z" } +sdist = { url = "https://files.pythonhosted.org/packages/71/c3/1b817965ac12dc002d7c9cd7dfffdd7d4fbf9b45763ef2ffe7b86ee94670/soupsieve-2.10.tar.gz", hash = "sha256:49e9380d7d2905463583bafe285e818c7366a9ed7b3aee221c1ac79c905d8bc0", size = 124337, upload-time = "2026-09-24T02:36:35.048Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/5e/f5/0c41cb68dcae6b7de4fac4188a3a9589e21fb31df21ea3a2e888db95e6c9/soupsieve-2.8.4-py3-none-any.whl", hash = "sha256:e7e6b0769c8f51ed59acab6e994b00621096cfb1c640a7509295987388fbaf65", size = 37304, upload-time = "2026-05-24T13:55:55.406Z" }, + { url = "https://files.pythonhosted.org/packages/66/87/5ed59e1d0290564e2027ed066c52b059892c4637741337fc0967183c8d4d/soupsieve-2.10-py3-none-any.whl", hash = "sha256:8596eb8967d744174820280fa62b4542a2e955bfaccca73ed8a13c6eb8e9b502", size = 38019, upload-time = "2026-09-24T02:36:33.709Z" }, ] [[package]] @@ -2493,11 +2540,11 @@ wheels = [ [[package]] name = "urllib3" -version = "2.7.0" +version = "2.8.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" } +sdist = { url = "https://files.pythonhosted.org/packages/e3/05/b17359e1cefb4f909b5e40b1b90a496d987258916dbbf88e842c729f510e/urllib3-2.8.0.tar.gz", hash = "sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63", size = 458972, upload-time = "2026-09-15T19:29:36.253Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" }, + { url = "https://files.pythonhosted.org/packages/92/9d/c4e665119135114480843e7ab388fa94d8480650450e6f8e26b70d323a4c/urllib3-2.8.0-py3-none-any.whl", hash = "sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3", size = 135717, upload-time = "2026-09-15T19:29:34.577Z" }, ] [[package]] @@ -2607,48 +2654,33 @@ wheels = [ [[package]] name = "yarl" -version = "1.22.0" +version = "1.25.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "idna" }, { name = "multidict" }, { name = "propcache" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/57/63/0c6ebca57330cd313f6102b16dd57ffaf3ec4c83403dcb45dbd15c6f3ea1/yarl-1.22.0.tar.gz", hash = "sha256:bebf8557577d4401ba8bd9ff33906f1376c877aa78d1fe216ad01b4d6745af71", size = 187169, upload-time = "2025-10-06T14:12:55.963Z" } -wheels = [ - { url = "https://files.pythonhosted.org/packages/ea/f3/d67de7260456ee105dc1d162d43a019ecad6b91e2f51809d6cddaa56690e/yarl-1.22.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:8dee9c25c74997f6a750cd317b8ca63545169c098faee42c84aa5e506c819b53", size = 139980, upload-time = "2025-10-06T14:10:14.601Z" }, - { url = "https://files.pythonhosted.org/packages/01/88/04d98af0b47e0ef42597b9b28863b9060bb515524da0a65d5f4db160b2d5/yarl-1.22.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:01e73b85a5434f89fc4fe27dcda2aff08ddf35e4d47bbbea3bdcd25321af538a", size = 93424, upload-time = "2025-10-06T14:10:16.115Z" }, - { url = "https://files.pythonhosted.org/packages/18/91/3274b215fd8442a03975ce6bee5fe6aa57a8326b29b9d3d56234a1dca244/yarl-1.22.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:22965c2af250d20c873cdbee8ff958fb809940aeb2e74ba5f20aaf6b7ac8c70c", size = 93821, upload-time = "2025-10-06T14:10:17.993Z" }, - { url = "https://files.pythonhosted.org/packages/61/3a/caf4e25036db0f2da4ca22a353dfeb3c9d3c95d2761ebe9b14df8fc16eb0/yarl-1.22.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b4f15793aa49793ec8d1c708ab7f9eded1aa72edc5174cae703651555ed1b601", size = 373243, upload-time = "2025-10-06T14:10:19.44Z" }, - { url = "https://files.pythonhosted.org/packages/6e/9e/51a77ac7516e8e7803b06e01f74e78649c24ee1021eca3d6a739cb6ea49c/yarl-1.22.0-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:e5542339dcf2747135c5c85f68680353d5cb9ffd741c0f2e8d832d054d41f35a", size = 342361, upload-time = "2025-10-06T14:10:21.124Z" }, - { url = "https://files.pythonhosted.org/packages/d4/f8/33b92454789dde8407f156c00303e9a891f1f51a0330b0fad7c909f87692/yarl-1.22.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:5c401e05ad47a75869c3ab3e35137f8468b846770587e70d71e11de797d113df", size = 387036, upload-time = "2025-10-06T14:10:22.902Z" }, - { url = "https://files.pythonhosted.org/packages/d9/9a/c5db84ea024f76838220280f732970aa4ee154015d7f5c1bfb60a267af6f/yarl-1.22.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:243dda95d901c733f5b59214d28b0120893d91777cb8aa043e6ef059d3cddfe2", size = 397671, upload-time = "2025-10-06T14:10:24.523Z" }, - { url = "https://files.pythonhosted.org/packages/11/c9/cd8538dc2e7727095e0c1d867bad1e40c98f37763e6d995c1939f5fdc7b1/yarl-1.22.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bec03d0d388060058f5d291a813f21c011041938a441c593374da6077fe21b1b", size = 377059, upload-time = "2025-10-06T14:10:26.406Z" }, - { url = "https://files.pythonhosted.org/packages/a1/b9/ab437b261702ced75122ed78a876a6dec0a1b0f5e17a4ac7a9a2482d8abe/yarl-1.22.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:b0748275abb8c1e1e09301ee3cf90c8a99678a4e92e4373705f2a2570d581273", size = 365356, upload-time = "2025-10-06T14:10:28.461Z" }, - { url = "https://files.pythonhosted.org/packages/b2/9d/8e1ae6d1d008a9567877b08f0ce4077a29974c04c062dabdb923ed98e6fe/yarl-1.22.0-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:47fdb18187e2a4e18fda2c25c05d8251a9e4a521edaed757fef033e7d8498d9a", size = 361331, upload-time = "2025-10-06T14:10:30.541Z" }, - { url = "https://files.pythonhosted.org/packages/ca/5a/09b7be3905962f145b73beb468cdd53db8aa171cf18c80400a54c5b82846/yarl-1.22.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:c7044802eec4524fde550afc28edda0dd5784c4c45f0be151a2d3ba017daca7d", size = 382590, upload-time = "2025-10-06T14:10:33.352Z" }, - { url = "https://files.pythonhosted.org/packages/aa/7f/59ec509abf90eda5048b0bc3e2d7b5099dffdb3e6b127019895ab9d5ef44/yarl-1.22.0-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:139718f35149ff544caba20fce6e8a2f71f1e39b92c700d8438a0b1d2a631a02", size = 385316, upload-time = "2025-10-06T14:10:35.034Z" }, - { url = "https://files.pythonhosted.org/packages/e5/84/891158426bc8036bfdfd862fabd0e0fa25df4176ec793e447f4b85cf1be4/yarl-1.22.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:e1b51bebd221006d3d2f95fbe124b22b247136647ae5dcc8c7acafba66e5ee67", size = 374431, upload-time = "2025-10-06T14:10:37.76Z" }, - { url = "https://files.pythonhosted.org/packages/bb/49/03da1580665baa8bef5e8ed34c6df2c2aca0a2f28bf397ed238cc1bbc6f2/yarl-1.22.0-cp313-cp313-win32.whl", hash = "sha256:d3e32536234a95f513bd374e93d717cf6b2231a791758de6c509e3653f234c95", size = 81555, upload-time = "2025-10-06T14:10:39.649Z" }, - { url = "https://files.pythonhosted.org/packages/9a/ee/450914ae11b419eadd067c6183ae08381cfdfcb9798b90b2b713bbebddda/yarl-1.22.0-cp313-cp313-win_amd64.whl", hash = "sha256:47743b82b76d89a1d20b83e60d5c20314cbd5ba2befc9cda8f28300c4a08ed4d", size = 86965, upload-time = "2025-10-06T14:10:41.313Z" }, - { url = "https://files.pythonhosted.org/packages/98/4d/264a01eae03b6cf629ad69bae94e3b0e5344741e929073678e84bf7a3e3b/yarl-1.22.0-cp313-cp313-win_arm64.whl", hash = "sha256:5d0fcda9608875f7d052eff120c7a5da474a6796fe4d83e152e0e4d42f6d1a9b", size = 81205, upload-time = "2025-10-06T14:10:43.167Z" }, - { url = "https://files.pythonhosted.org/packages/88/fc/6908f062a2f77b5f9f6d69cecb1747260831ff206adcbc5b510aff88df91/yarl-1.22.0-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:719ae08b6972befcba4310e49edb1161a88cdd331e3a694b84466bd938a6ab10", size = 146209, upload-time = "2025-10-06T14:10:44.643Z" }, - { url = "https://files.pythonhosted.org/packages/65/47/76594ae8eab26210b4867be6f49129861ad33da1f1ebdf7051e98492bf62/yarl-1.22.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:47d8a5c446df1c4db9d21b49619ffdba90e77c89ec6e283f453856c74b50b9e3", size = 95966, upload-time = "2025-10-06T14:10:46.554Z" }, - { url = "https://files.pythonhosted.org/packages/ab/ce/05e9828a49271ba6b5b038b15b3934e996980dd78abdfeb52a04cfb9467e/yarl-1.22.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:cfebc0ac8333520d2d0423cbbe43ae43c8838862ddb898f5ca68565e395516e9", size = 97312, upload-time = "2025-10-06T14:10:48.007Z" }, - { url = "https://files.pythonhosted.org/packages/d1/c5/7dffad5e4f2265b29c9d7ec869c369e4223166e4f9206fc2243ee9eea727/yarl-1.22.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4398557cbf484207df000309235979c79c4356518fd5c99158c7d38203c4da4f", size = 361967, upload-time = "2025-10-06T14:10:49.997Z" }, - { url = "https://files.pythonhosted.org/packages/50/b2/375b933c93a54bff7fc041e1a6ad2c0f6f733ffb0c6e642ce56ee3b39970/yarl-1.22.0-cp313-cp313t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:2ca6fd72a8cd803be290d42f2dec5cdcd5299eeb93c2d929bf060ad9efaf5de0", size = 323949, upload-time = "2025-10-06T14:10:52.004Z" }, - { url = "https://files.pythonhosted.org/packages/66/50/bfc2a29a1d78644c5a7220ce2f304f38248dc94124a326794e677634b6cf/yarl-1.22.0-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:ca1f59c4e1ab6e72f0a23c13fca5430f889634166be85dbf1013683e49e3278e", size = 361818, upload-time = "2025-10-06T14:10:54.078Z" }, - { url = "https://files.pythonhosted.org/packages/46/96/f3941a46af7d5d0f0498f86d71275696800ddcdd20426298e572b19b91ff/yarl-1.22.0-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:6c5010a52015e7c70f86eb967db0f37f3c8bd503a695a49f8d45700144667708", size = 372626, upload-time = "2025-10-06T14:10:55.767Z" }, - { url = "https://files.pythonhosted.org/packages/c1/42/8b27c83bb875cd89448e42cd627e0fb971fa1675c9ec546393d18826cb50/yarl-1.22.0-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9d7672ecf7557476642c88497c2f8d8542f8e36596e928e9bcba0e42e1e7d71f", size = 341129, upload-time = "2025-10-06T14:10:57.985Z" }, - { url = "https://files.pythonhosted.org/packages/49/36/99ca3122201b382a3cf7cc937b95235b0ac944f7e9f2d5331d50821ed352/yarl-1.22.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:3b7c88eeef021579d600e50363e0b6ee4f7f6f728cd3486b9d0f3ee7b946398d", size = 346776, upload-time = "2025-10-06T14:10:59.633Z" }, - { url = "https://files.pythonhosted.org/packages/85/b4/47328bf996acd01a4c16ef9dcd2f59c969f495073616586f78cd5f2efb99/yarl-1.22.0-cp313-cp313t-musllinux_1_2_armv7l.whl", hash = "sha256:f4afb5c34f2c6fecdcc182dfcfc6af6cccf1aa923eed4d6a12e9d96904e1a0d8", size = 334879, upload-time = "2025-10-06T14:11:01.454Z" }, - { url = "https://files.pythonhosted.org/packages/c2/ad/b77d7b3f14a4283bffb8e92c6026496f6de49751c2f97d4352242bba3990/yarl-1.22.0-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:59c189e3e99a59cf8d83cbb31d4db02d66cda5a1a4374e8a012b51255341abf5", size = 350996, upload-time = "2025-10-06T14:11:03.452Z" }, - { url = "https://files.pythonhosted.org/packages/81/c8/06e1d69295792ba54d556f06686cbd6a7ce39c22307100e3fb4a2c0b0a1d/yarl-1.22.0-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:5a3bf7f62a289fa90f1990422dc8dff5a458469ea71d1624585ec3a4c8d6960f", size = 356047, upload-time = "2025-10-06T14:11:05.115Z" }, - { url = "https://files.pythonhosted.org/packages/4b/b8/4c0e9e9f597074b208d18cef227d83aac36184bfbc6eab204ea55783dbc5/yarl-1.22.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:de6b9a04c606978fdfe72666fa216ffcf2d1a9f6a381058d4378f8d7b1e5de62", size = 342947, upload-time = "2025-10-06T14:11:08.137Z" }, - { url = "https://files.pythonhosted.org/packages/e0/e5/11f140a58bf4c6ad7aca69a892bff0ee638c31bea4206748fc0df4ebcb3a/yarl-1.22.0-cp313-cp313t-win32.whl", hash = "sha256:1834bb90991cc2999f10f97f5f01317f99b143284766d197e43cd5b45eb18d03", size = 86943, upload-time = "2025-10-06T14:11:10.284Z" }, - { url = "https://files.pythonhosted.org/packages/31/74/8b74bae38ed7fe6793d0c15a0c8207bbb819cf287788459e5ed230996cdd/yarl-1.22.0-cp313-cp313t-win_amd64.whl", hash = "sha256:ff86011bd159a9d2dfc89c34cfd8aff12875980e3bd6a39ff097887520e60249", size = 93715, upload-time = "2025-10-06T14:11:11.739Z" }, - { url = "https://files.pythonhosted.org/packages/69/66/991858aa4b5892d57aef7ee1ba6b4d01ec3b7eb3060795d34090a3ca3278/yarl-1.22.0-cp313-cp313t-win_arm64.whl", hash = "sha256:7861058d0582b847bc4e3a4a4c46828a410bca738673f35a29ba3ca5db0b473b", size = 83857, upload-time = "2025-10-06T14:11:13.586Z" }, - { url = "https://files.pythonhosted.org/packages/73/ae/b48f95715333080afb75a4504487cbe142cae1268afc482d06692d605ae6/yarl-1.22.0-py3-none-any.whl", hash = "sha256:1380560bdba02b6b6c90de54133c81c9f2a453dee9912fe58c1dcced1edb7cff", size = 46814, upload-time = "2025-10-06T14:12:53.872Z" }, +sdist = { url = "https://files.pythonhosted.org/packages/75/16/e8be8e2fb175bbf41a0680381a319f1199fae256588241a2ac8677eafb49/yarl-1.25.1.tar.gz", hash = "sha256:03dd38de09bc213e9a8b29761eec33ee1d5318dac0e49d8af36e4d27830e23a7", size = 246245, upload-time = "2026-09-15T19:35:02.264Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/7b/ed/2f3129bbcc9a5c8ba12cc2b29d8060a3bab9c8043c456cfd4b5ca3188890/yarl-1.25.1-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:25868beca8b6765f8f7d0e11fe6dd7c66dd4b0793b9500286d20cc92352126a5", size = 143623, upload-time = "2026-09-15T19:31:37.966Z" }, + { url = "https://files.pythonhosted.org/packages/17/e1/f1bc3390fdca352826676b531d0712736f156919090206700421d46b2c37/yarl-1.25.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:10b2fd95332f0d716d5eee3c9fb2ce8eada19082de7fee83d32e37992fd75c26", size = 104011, upload-time = "2026-09-15T19:31:40.25Z" }, + { url = "https://files.pythonhosted.org/packages/a8/aa/50acc5c3e5da04172ae3c281c75405af4d2ca911e16120ab0563f4dffb66/yarl-1.25.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:0f12afda4eea8c8994a76d4df1875c765194f5fbe8a9d197929ea303caee29ec", size = 103677, upload-time = "2026-09-15T19:31:42.46Z" }, + { url = "https://files.pythonhosted.org/packages/30/d2/7d1e0ab9f8390e1fbcede5a6dbf70d23c96ad09b8c5567f3a514d1ddb0e2/yarl-1.25.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:14b79a30a93a3ce2e8832603fd0ab780ada281b0ba5110b519a634f2d7d7d1fc", size = 115392, upload-time = "2026-09-15T19:31:44.371Z" }, + { url = "https://files.pythonhosted.org/packages/71/e1/5ba1e3a2a22139213655e760919038e8ed7e2d4a99826d0bbddb3beb96e5/yarl-1.25.1-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:4bd6340d20ae2c7ca719b87b426e808e90743b676d05d4c26c4fb5ca71f41184", size = 107493, upload-time = "2026-09-15T19:31:46.273Z" }, + { url = "https://files.pythonhosted.org/packages/f5/53/780653d5e0f73831f467cf13548912e5eec97f21dc49fc8daf21da027df4/yarl-1.25.1-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:126a2533570c554719ca40a1288fdee1700b6bc82e7131aa69fa85252d92e651", size = 122537, upload-time = "2026-09-15T19:31:48.654Z" }, + { url = "https://files.pythonhosted.org/packages/03/92/d54fa70236c6036271c9c9c09fd978df5cbe3ef49ef6c46e9b833476d215/yarl-1.25.1-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a3faadac7d812ddac258feb57b9846b60c1b437c4f4b9ad42595c6f6fe4390df", size = 126170, upload-time = "2026-09-15T19:31:50.872Z" }, + { url = "https://files.pythonhosted.org/packages/0e/b7/a82a49bf88340b837ef6972b508a1604ae377b9e6904b46b10cf5f1cf925/yarl-1.25.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:be80550d9bfe83d9b62398a37081a90434e6df2d978ec345c3d2820de6beddab", size = 117012, upload-time = "2026-09-15T19:31:53.189Z" }, + { url = "https://files.pythonhosted.org/packages/ef/78/5d684b411e3f3602464ee9b538db48205038f8605872985f61efb809ced0/yarl-1.25.1-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:e07595c7d6f4db270ceede356a1bd1c07a34f1c26f958d1ed0cd7b48e0d2bba3", size = 114950, upload-time = "2026-09-15T19:31:55.694Z" }, + { url = "https://files.pythonhosted.org/packages/2f/11/51d82b852c64f7fad0fc7a7ff3031517204887e874c722bbca839c0b23ac/yarl-1.25.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:eb96ed1ae6c7d072d60840c0434aef07a2df611812810807fbc54263a6053e9a", size = 115428, upload-time = "2026-09-15T19:31:57.966Z" }, + { url = "https://files.pythonhosted.org/packages/e4/49/9d1978049bf646b9ea918313926453c6901b71c92f097467777d47d36a88/yarl-1.25.1-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:3feb99222553a8cbedfa52c2f59dd84c3f50d5b582c728d522caf8d72769a54b", size = 108428, upload-time = "2026-09-15T19:32:00.048Z" }, + { url = "https://files.pythonhosted.org/packages/43/35/7b8f1ebb45d7ec3dda7d1909bf44f458de41ef91e2937f107733582a5166/yarl-1.25.1-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:a2ed0ba415ccdf08f14bf544cb78346d0f76086707ffee24921a2c84dbf1305a", size = 121961, upload-time = "2026-09-15T19:32:02.436Z" }, + { url = "https://files.pythonhosted.org/packages/63/d6/d8b689ab7ca26edeb85f6ff28812aac7a25376eefc1780e303a7bfbaceff/yarl-1.25.1-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:2b49375d22299b0a834c2bca72f39aaecc270d96fb24c30424899676f487b22a", size = 114961, upload-time = "2026-09-15T19:32:04.456Z" }, + { url = "https://files.pythonhosted.org/packages/cf/d5/1a1798ea4dc6b7ee3260010a27907ebc697c95dae99817d817ed446d24aa/yarl-1.25.1-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:ef74070ac553c59eb4f04258722066d6c6135b7baa03b2e9f2da65c096e96d98", size = 120036, upload-time = "2026-09-15T19:32:06.5Z" }, + { url = "https://files.pythonhosted.org/packages/91/8d/b1b35ed7903da6669b1d367cb2c09436acd4ff508029b4f39a0c0c2058fc/yarl-1.25.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:0a66db89ea473abeac4b70523cafd94db3772380e565f9d28af7a179b7af71fa", size = 117276, upload-time = "2026-09-15T19:32:09.401Z" }, + { url = "https://files.pythonhosted.org/packages/3a/8f/4db01cef62caff0d7a4593ed694fb8a41a27a11158cab80d290221f13e57/yarl-1.25.1-cp313-cp313-win_amd64.whl", hash = "sha256:1f51020b2eb8a003c84925638ec63c21a750a4bddd3a22ec8eac6a742dadf1b9", size = 101945, upload-time = "2026-09-15T19:32:11.545Z" }, + { url = "https://files.pythonhosted.org/packages/c0/5e/3ce00497c5c0babb74d4130c10c3828ccd215b4819d12020c42429f991ac/yarl-1.25.1-cp313-cp313-win_arm64.whl", hash = "sha256:b10dd0557ba422715b5206b3743192135a6022acca8baec51aa127d0a75db8fe", size = 97270, upload-time = "2026-09-15T19:32:14.127Z" }, + { url = "https://files.pythonhosted.org/packages/54/22/318c7980066769c6bcd9221ed2248294f5698811da099013098c670565ed/yarl-1.25.1-py3-none-any.whl", hash = "sha256:681c758b0490f9e96b78e5fa8e8dc6e648e9185bb6eaebe73183c33ea0c445f3", size = 63617, upload-time = "2026-09-15T19:34:59.616Z" }, ] [[package]] diff --git a/docs/.agents/issue.md b/docs/.agents/issue.md index 31783e28b..dedfbad1b 100644 --- a/docs/.agents/issue.md +++ b/docs/.agents/issue.md @@ -245,6 +245,7 @@ | I-237 | PR #1205 双 failing check 修复：source-map-js GHSA-68fv-2mgg-jv7q 全仓 override（根 + 15 分集）+ perceives 六包安全地板（pillow 13.0.0 等 48 条新报 advisory） | ✅ 已完成 | 2026-10-23 | [详情](#I-237) | | I-238 | 014 OpenViking 精读零信源原图：五渠道普查补入 10 张原图（新建 source-figures 资产库）+ 随图更正 §7/§9.1–§9.3 七处时效与出处 | ✅ 已完成 | 2026-10-25 | [详情](#I-238) | | I-239 | agent-harness 178 DSA 精读入库：三源首读（repo@4e622643 + 站点 + 论文）+ 五机制原型 + 双 archify 图 + 信源原图 5 张（含交付后增补 4 张批次） | ✅ 已完成 | 2026-10-27 | [详情](#I-239) | +| I-240 | Dependabot 54 条批量处置：backend 11 包收敛升级（mcp 上界防 2.x）+ katex 0.18 override（rehype-katex 卡 ^0.16）+ fast-uri 全仓 override（根 + 15 分集）+ perceives 七包防 CI 红头 + dismiss 2 条有据告警 | ✅ 已完成 | 2026-10-28 | [详情](#I-240) | --- @@ -5708,3 +5709,17 @@ R7 后浏览器对照 Section 2.1 区域发现两类正交缺陷： **同类问题影响**：后续 DSA 换代再精读时按 lecture-format §7 四桶继承审计处理；archify 图按图型管线 SSOT 重走。 **处理注意事项**：67k star/fork 比例异常（fork≈0.83×star）成因材料未解释，正文已按推断标注；`docs/architecture/api_spec.json` 覆盖代码路由约 29% 且手写段滞后，引用路由契约须回代码。 + +## I-240：Dependabot 54 条告警批量处置——backend/katex/fast-uri/perceives 四线并进与 2 条有据 dismiss + +**问题描述**：Dependabot 累积 54 条 open 告警（2026-09-18 至 10-23 多批），覆盖 apps/negentropy/uv.lock 34 条（PyJWT×15 含 1 critical、aiohttp×8、anyio×2 含 1 critical 等 11 包）、perceives transformers 1 条、opentelemetry-api 1 条、katex 2 条（ui/wiki）、fast-uri 15 条（全部分集 video lock）。 + +**表因根因**：分批入库的 advisory 与无 dependabot.yml 自动升级叠加；其中三条有结构性根因——① opentelemetry-api 1.45.1 被 google-adk 全系 `opentelemetry-api<=1.42.1` 硬 pin 堵死（main 分支已抬至 <=1.44，issue google/adk-python#6421 跟踪）；② transformers CVE-2026-80047 上游无修复版（range 覆盖至 5.8.1、first_patched=null），perceives 锁 <5.0.0 根因仍是 marker-pdf/surya 的 pillow<11 冲突；③ katex 0.16 线无修复版（GHSA-238p 修复在 0.18.2），而 rehype-katex 7.0.1/micromark-extension-math 均声明 katex ^0.16.0（rehype-katex 8 无时间表）。 + +**处理方式**：先对账 master 与 feature/1.x.x manifest 完全一致（7 提交全 docs），排除「已修待发布」幻象后四线并进——① backend：pyproject 地板抬 pyjwt>=2.15.1（一步到 2.15.1：2.14.0 紧凑 base64url 校验误杀尾部 '=' 填充 token）、litellm>=1.89.7、aiohttp>=3.14.4、urllib3>=2.8.0、mako>=1.4.2，新增 anyio>=4.14.2（critical CVE-2026-63374 IDNA TLS 欺骗）与 mcp>=1.30.0,<2.0.0（mcp 2.0.0 已破坏 SDK 表面；logged_stdio_client 引用 mcp.client.stdio 七个私有符号，升级前逐一核验存活），uv lock 收敛升级 11 包（litellm 锁 1.89.7、multidict <7、soupsieve <3 防裸升 major/跨 17 minor）；② katex：根 pnpm-workspace override `katex: '>=0.18.11 <0.19.0'` 压过两处 ^0.16.0，ui/wiki package.json 同步 ^0.18.11，0.18.0 的 20 个内部 CSS 类名加 katex- 前缀唯一命中 ui globals.css 暗色适配四处选择器（.overline-line/.underline-line/.sqrt 子线类不改名），katex.min.css 路径经 exports catch-all 仍可解析、@types/katex 0.16.8 留树不冲突（0.18 起自带 types）；③ fast-uri：根 + 15 分集 pnpm-workspace override `'>=3.1.8 <4.0.0'`（I-237 同型），全仓 lockfile-only 重锁落 3.1.9；④ perceives：pip-audit 本地实跑暴露 CI 尚未见的 10-23 后新入库 advisory（authlib×7、dnspython、fastmcp、filelock×3、msgpack、setuptools——CI push paths 触发必红），升级 fastmcp 3.4.11（主段地板 3.4.10）/authlib 1.9.1/dnspython 2.9.0/filelock 4.2.4/msgpack 1.2.4/setuptools 84.2.1 并补 override 地板，litellm 1.96.2 的 CVE-2026-114612 走 ignore（EXPERIMENTAL_UI_LOGIN 条件触发、默认 false）；dismiss #769/#1013（not_used，评论记根因与解锁条件）。验证：backend 2991 passed、ui lint/typecheck×2/test:coverage 全绿、wiki lint/test 122/build 全绿、perceives pip-audit 剩余 ⊆ ignore 集 + 测试全绿、katex 0.18.11 渲染冒烟前缀类落位。 + +**后续防范**：pip-audit 的 PyPI advisory DB 滚动滞后于 GitHub Advisory（10-01 的 GHSA 至 10-23 后才进 DB），perceives CI 绿不代表无新债——动 perceives 依赖时本地裸跑一次 pip-audit 对账 ignore 集；uv 裸升会跳 major/跨多 minor（litellm 1.89→1.106、multidict 6→7），安全修复一律收敛到修复版区间再锁；katex 类前缀化破坏面是自定义 CSS 选择器与类名白名单，升级前 grep 20 个改名类。 + +**同类问题影响**：litellm GHSA-7hp6-4w63-5g45（High，range 覆盖至 <1.100.4，修复 1.100.4+）——backend 已在收尾轮升 1.100.5 清偿（Dependency Review 硬门第二次拦截后收敛至修复线，连带 boto3/botocore 4 个 Bedrock 标配传递包）；perceives 侧 1.96.2 仍在范围但不在 delta、经 pip-audit ignore（EXPERIMENTAL_UI_LOGIN 条件触发）覆盖，随 perceives 生态升级一并清偿；GHSA-g5ff-637f-6q2m 因 Dependency Review 硬门（delta 审查对版本变化的包按新版本评漏洞，fail-on-severity: high）已在收尾轮将 backend litellm 收敛目标从 1.89.7 抬至 1.95.1 清偿（1.89.2 基线同样在 <1.95.0 范围内，「升级引入」是门的行为假象）；rehype-katex 8 发布后应移除 katex override；google-adk 放开 OTel 上界后 reopen #1013 升整组 OTel。另：perceives CI 三平台曾同挂 test_error_logging_and_handling——CI runner 上 stealth 工具可用且 error-test.com 真实可解析使管线真实抓取成功、断言失效（本地过靠工具不可用的环境性通过），已 patch run_webpage_pipeline 强制降级 legacy 路径，用例与运行环境解耦。 + +**处理注意事项**：mcp 升级必须先核 `mcp.client.stdio` 私有符号存活（mcp_client.py 的 logged_stdio_client 复刻 stdio client）；katex override 期间 rehype-katex 属未声明支持配置（remarkjs/remark-math#121 社区实测通过），katex 0.19 类名与 0.18 相同、跟进成本低；fast-uri 父包 ajv 无版本封顶、override 干净解析，勿在分集 package.json 落直接依赖。本条原编号 I-239，与上游同日合入的 DSA 精读条目（#I-239）撞号后重编为 I-240——本分支 commit message 与 GitHub dismiss 评论中的「I-239」引用均指本条。 diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d0107da4f..d08b728ef 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -131,6 +131,8 @@ overrides: source-map-js: '>=1.2.2 <2.0.0' '@babel/core': '>=7.29.6 <8.0.0' esbuild: '>=0.28.1' + katex: '>=0.18.11 <0.19.0' + fast-uri: '>=3.1.8 <4.0.0' ts-deepmerge: '>=8.0.0' importers: @@ -207,8 +209,8 @@ importers: specifier: ^11.11.1 version: 11.11.1 katex: - specifier: ^0.16.33 - version: 0.16.47 + specifier: '>=0.18.11 <0.19.0' + version: 0.18.11 lucide-react: specifier: ^0.525.0 version: 0.525.0(react@19.2.3) @@ -397,8 +399,8 @@ importers: specifier: ^11.11.1 version: 11.11.1 katex: - specifier: ^0.16.47 - version: 0.16.47 + specifier: '>=0.18.11 <0.19.0' + version: 0.18.11 mdast-util-to-string: specifier: ^4.0.0 version: 4.0.0 @@ -2829,6 +2831,10 @@ packages: comma-separated-tokens@2.0.3: resolution: {integrity: sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg==} + commander@15.0.0: + resolution: {integrity: sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg==} + engines: {node: '>=22.12.0'} + commander@4.1.1: resolution: {integrity: sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==} engines: {node: '>= 6'} @@ -2837,10 +2843,6 @@ packages: resolution: {integrity: sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw==} engines: {node: '>= 10'} - commander@8.3.0: - resolution: {integrity: sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==} - engines: {node: '>= 12'} - compare-versions@6.1.1: resolution: {integrity: sha512-4hm4VPpIecmlg59CHXnRDnqGplJFrbLG4aFEl5vl6cK1u76ws3LLvX7ikFnTDl5vo39sjWD6AaDPYodJp/NNHg==} @@ -3422,8 +3424,8 @@ packages: fast-string-width@3.0.2: resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==} - fast-uri@3.1.2: - resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fast-wrap-ansi@0.2.0: resolution: {integrity: sha512-rLV8JHxTyhVmFYhBJuMujcrHqOT2cnO5Zxj37qROj23CP39GXubJRBUFF0z8KFK77Uc0SukZUf7JZhsVEQ6n8w==} @@ -4017,8 +4019,9 @@ packages: resolution: {integrity: sha512-4+5mNNf4vZDSwPhKprKwz3330iisPrb08JyMgbsdFrimBCKNHecua/WBwvVg3n7vwx0C1ARjfhwIpbrbd9n5wg==} engines: {node: '>=12'} - katex@0.16.47: - resolution: {integrity: sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==} + katex@0.18.11: + resolution: {integrity: sha512-yvyz/2VMKqoho/35Hat5w37wIEdWJ5ElVMidTAlWrxr5uW4aBGsEpveTmKh18/zw08v/7lGswCPon4OhqmqrTA==} + deprecated: Accidentally published with breaking changes. Use 0.19.0 instead. hasBin: true keyv@4.5.4: @@ -6053,7 +6056,7 @@ snapshots: '@radix-ui/react-tooltip': 1.2.8(@types/react-dom@19.0.3(@types/react@19.0.8))(@types/react@19.0.8)(react-dom@19.2.3(react@19.2.3))(react@19.2.3) class-variance-authority: 0.7.1 clsx: 2.1.1 - katex: 0.16.47 + katex: 0.18.11 lucide-react: 0.525.0(react@19.2.3) react: 19.2.3 react-dom: 19.2.3(react@19.2.3) @@ -7655,7 +7658,7 @@ snapshots: ajv@8.18.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.2 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -7929,12 +7932,12 @@ snapshots: comma-separated-tokens@2.0.3: {} + commander@15.0.0: {} + commander@4.1.1: {} commander@7.2.0: {} - commander@8.3.0: {} - compare-versions@6.1.1: {} compressible@2.0.18: @@ -8714,7 +8717,7 @@ snapshots: fast-string-truncated-width: 3.0.3 optional: true - fast-uri@3.1.2: {} + fast-uri@3.1.9: {} fast-wrap-ansi@0.2.0: dependencies: @@ -9379,9 +9382,9 @@ snapshots: dependencies: lodash-es: 4.18.1 - katex@0.16.47: + katex@0.18.11: dependencies: - commander: 8.3.0 + commander: 15.0.0 keyv@4.5.4: dependencies: @@ -9722,7 +9725,7 @@ snapshots: dayjs: 1.11.20 dompurify: 3.4.11 es-toolkit: 1.46.1 - katex: 0.16.47 + katex: 0.18.11 khroma: 2.1.0 marked: 16.4.2 roughjs: 4.6.6 @@ -9845,7 +9848,7 @@ snapshots: dependencies: '@types/katex': 0.16.8 devlop: 1.1.0 - katex: 0.16.47 + katex: 0.18.11 micromark-factory-space: 2.0.1 micromark-util-character: 2.1.1 micromark-util-symbol: 2.0.1 @@ -10560,7 +10563,7 @@ snapshots: '@types/katex': 0.16.8 hast-util-from-html-isomorphic: 2.0.0 hast-util-to-text: 4.0.2 - katex: 0.16.47 + katex: 0.18.11 unist-util-visit-parents: 6.0.2 vfile: 6.0.3 @@ -10971,7 +10974,7 @@ snapshots: hast: 1.0.0 hast-util-to-jsx-runtime: 2.3.6(supports-color@7.2.0) html-url-attributes: 3.0.1 - katex: 0.16.47 + katex: 0.18.11 lucide-react: 0.542.0(react@19.2.3) marked: 16.4.2 mermaid: 11.15.0 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 68f4d8f42..1dc478063 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -57,4 +57,13 @@ overrides: source-map-js: '>=1.2.2 <2.0.0' '@babel/core': '>=7.29.6 <8.0.0' # @vitejs/plugin-react/next/styled-jsx peer ^7.0.0; 限 <8 避免 Babel 8 大版本跳跃破坏兼容 (GHSA low) esbuild: '>=0.28.1' # vite + tsup 传递 (dev, GHSA low) + # GHSA-238p-pmpm-9mq7 (low)：katex < 0.18.2 已污染原型可绕过 trust 限制。rehype-katex 7.0.1 与 + # micromark-extension-math 均声明 katex ^0.16.0（无 0.16 线修复版），全局 override 压到 0.18 线 + # （renderToString 签名与 KatexOptions 字段集 0.16→0.18 未变，社区实测兼容 remarkjs/remark-math#121）； + # 限 <0.19 锁线。0.18.0 将 20 个内部 CSS 类名加 katex- 前缀（ui globals.css 暗色适配已同步）。 + # rehype-katex 8 发布后应移除此 override。 + katex: '>=0.18.11 <0.19.0' + # GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本封顶）， + # floor 3.1.8、限 <4 避免 major 跳跃，与各分集 video/pnpm-workspace.yaml 同口径。 + fast-uri: '>=3.1.8 <4.0.0' ts-deepmerge: '>=8.0.0' # @copilotkitnext/react@1.51.3 传递 (negentropy-ui 运行时); 8.0.0 仅改 Object.prototype 同名键处理 (DoS 修复点), 常规 merge API 不变 — GHSA-87mf-gv2c-c62c CVE-2026-12644 (medium)