fix(deps): secure Python dependencies for 0.55.6 by dependabot[bot] · Pull Request #744 · nold-ai/specfact-cli

dependabot · 2026-09-21T04:24:18Z

Upgrade the frozen Python security/build layer to GitPython 3.2.0 and Hatchling 1.32.4, synchronize declarations/backend expectations/export, and include bundle-mapper in sdists. Preserve the merged #756/#755 repairs.

Native stack #757: dev <- #744 <- #727 <- #752 <- #754 <- #753. This PR retains its number and original dependency branch; its signed final head is 936f0f2c7cfbeaff7f186f2c3cf21798b3613e54, tree 8476bc0e2336408cdceac6f5ea02c9c80c73081f. The protected root is merged prerequisite #758 at 30f98cc14e074802a9f21c6b84e69e743eee6442; organization policy #3 is merged.

All required checks pass and GitHub reports CLEAN on this exact head (verified 11 October 2026 Europe/Berlin). Ordinary CI and all three native Requirements jobs pass. The unedited exact-head/tree member grant was posted by djm81; protected Requirements authority passes. No unresolved review threads remain.

Local focused controls, offline sdist-to-wheel builds and no-resolution wheel installs/Git consumers pass on Python 3.11-3.13. The package version gate reserves 0.55.5 through merged #758, so all four sources, generated metadata and the Security/Fixed changelog now prepare one 0.55.6 release.

The complete native plan sha256:94e049b71b00de0d52b4afa8b7ce9b08729bc97ae5ae379db1682af179125461 is identical across all five final heads. Fresh authored RED 38119009577 precedes the implementation; mapped test bytes remain unchanged. Each final head independently retains passing producer/consumer JUnit, verified lifecycle, complete plan equality and original RED provenance. Historical #756 evidence is preserved.

Full assembled local smart testing: 3,291 passed, 9 existing skips, 2 warnings in 179.08 seconds; unchanged 64% coverage. Frozen parity, all three Python audits, trust/licenses/Socket, independent SAST, strict signatures, version/PyPI-ahead, Python 3.11-3.13 runtime/wheel checks and repository quality gates pass. Each head's two normalized installed inventories contain the same 180 package identities and its paired SPDX SBOMs are byte-identical; authoritative typing has zero errors with 1,522 existing warnings. The full changed-Python SpecFact review has zero errors/new regressions; its 21 unchanged fixture warnings and 3 information findings retain the narrow documented baseline exceptions in TDD_EVIDENCE.md.

Leave all five dependency PRs unmerged as requested. Broader inventory and JSON 3 migration remain deferred under open #747; #748 is a dated planning follow-up outside this stack. No tag or release is published. Exact grants expire 2026-10-13T07:03:56Z; head/tree/base changes require fresh validation and grants.

Promotion: merge the reviewed native stack normally; validate the integrated dev-to-main SHA with required Requirements/signature/quality/security gates, 0.55.6 source/artifact parity, strict live PyPI-ahead and both documentation deployment paths. Archive completed prerequisite tracking and clean worktrees after reviewed integration; retain the broader active change while accepted work remains. Rollback refs preserve original and intermediate heads; use explicit leases for unmerged branches or a normally reviewed revert for merged prerequisites. Never reset protected shared history.

Refs #747. OpenSpec: dependency-update-consolidation.

strix-security · 2026-09-21T04:24:22Z

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

So far, Strix has reviewed 48 pull requests across this workspace.

coderabbitai · 2026-09-21T04:24:22Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: nold-ai/specfact-cli/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: 7440a626-b4cb-4e86-a3a1-9b68c5e1c6a9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-10T20:53:50Z

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 19.94s
Checks: 4 total (3 passed) (1 skipped)

github-actions · 2026-10-10T20:57:23Z

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 14.02s
Checks: 4 total (3 passed) (1 skipped)

github-actions · 2026-10-10T21:09:33Z

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 20.15s
Checks: 4 total (3 passed) (1 skipped)

github-actions · 2026-10-10T21:27:08Z

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 23.12s
Checks: 4 total (3 passed) (1 skipped)

github-actions · 2026-10-10T21:28:26Z

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 15.59s
Checks: 4 total (3 passed) (1 skipped)

github-actions · 2026-10-10T21:34:45Z

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 19.55s
Checks: 4 total (3 passed) (1 skipped)

github-actions · 2026-10-10T21:37:51Z

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 25.81s
Checks: 4 total (3 passed) (1 skipped)

chatgpt-codex-connector · 2026-10-10T21:44:45Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T06:56:04.716575Z	`f8a4a4a`	New commits
🔒 Security Review	✅ Completed 2026-10-10T21:47:20.961516Z	`76a42fc`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

github-actions · 2026-10-11T06:44:33Z

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 18.87s
Checks: 4 total (3 passed) (1 skipped)

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8cd2a305f1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

socket-security · 2026-10-11T06:52:59Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/hatchling@1.32.0 ⏵ 1.32.4	⁺¹

View full report

github-actions · 2026-10-11T06:53:24Z

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 25.80s
Checks: 4 total (3 passed) (1 skipped)

djm81 · 2026-10-11T06:54:36Z

SPECFACT_TRUSTED_REQUIREMENTS_AUTHORITY_V1
{"authority_version":1,"base_ref":"dev","capability":"trusted-requirements-authority","expires_at":"2026-10-13T06:54:35Z","head_branch":"dependabot/pip/development-security-updates-e660df2248","head_commit":"f8a4a4a0963a76aa937b7efe80b3545b4c170140","head_tree":"5a9761df2855089ee22089ffa9714f45f3177e54","pull_request":744,"repository":"nold-ai/specfact-cli","signer_login":"djm81"}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f8a4a4a096

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

djm81 · 2026-10-11T07:03:57Z

SPECFACT_TRUSTED_REQUIREMENTS_AUTHORITY_V1
{"authority_version":1,"base_ref":"dev","capability":"trusted-requirements-authority","expires_at":"2026-10-13T07:03:56Z","head_branch":"dependabot/pip/development-security-updates-e660df2248","head_commit":"936f0f2c7cfbeaff7f186f2c3cf21798b3613e54","head_tree":"8476bc0e2336408cdceac6f5ea02c9c80c73081f","pull_request":744,"repository":"nold-ai/specfact-cli","signer_login":"djm81"}

github-actions · 2026-10-11T07:04:00Z

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 26.32s
Checks: 4 total (3 passed) (1 skipped)

dependabot Bot added dependencies Dependency resolution and management python Pull requests that update python code labels Sep 21, 2026

This was referenced Sep 21, 2026

[Change] Consolidate dependency updates and validate compatible package refresh #747

Open

docs: retain deferred dependency inventory follow-up #748

Closed

djm81 force-pushed the dependabot/pip/development-security-updates-e660df2248 branch from 57c6a76 to d346130 Compare October 10, 2026 20:53

djm81 changed the base branch from main to dev October 10, 2026 20:53

djm81 marked this pull request as draft October 10, 2026 21:26

djm81 force-pushed the dependabot/pip/development-security-updates-e660df2248 branch from 6ccc37a to 2ae8d4f Compare October 10, 2026 21:26

djm81 added this pull request to stack #757 October 10, 2026 21:30

djm81 force-pushed the dependabot/pip/development-security-updates-e660df2248 branch from 19a46c0 to e995038 Compare October 10, 2026 21:34

djm81 changed the title ~~chore(deps-dev): bump hatchling from 1.32.0 to 1.32.3 in the development-security-updates group~~ fix(deps): secure Python dependencies for 0.55.5 Oct 10, 2026

djm81 marked this pull request as ready for review October 10, 2026 21:44

test: reauthor complete security dependency stack

4609ac2

test: retain fresh dependency stack baseline evidence

8cd2a30

djm81 force-pushed the dependabot/pip/development-security-updates-e660df2248 branch from 76a42fc to 8cd2a30 Compare October 11, 2026 06:43

chatgpt-codex-connector Bot reviewed Oct 11, 2026

View reviewed changes

Comment thread tests/unit/scripts/test_reproducible_delivery.py

Comment thread tests/unit/security/test_frozen_gitpython_compatibility.py

Comment thread tests/integration/test_distribution_build.py

fix(deps): replay security updates for 0.55.6

f8a4a4a

chatgpt-codex-connector Bot reviewed Oct 11, 2026

View reviewed changes

Comment thread openspec/CHANGE_ORDER.md Outdated

docs: align active stack release references

936f0f2

djm81 changed the title ~~fix(deps): secure Python dependencies for 0.55.5~~ fix(deps): secure Python dependencies for 0.55.6 Oct 11, 2026

djm81 merged commit 4e7c38c into dev Oct 11, 2026
59 of 60 checks passed

dependabot Bot deleted the dependabot/pip/development-security-updates-e660df2248 branch October 11, 2026 20:14

Conversation

dependabot Bot commented on behalf of github Sep 21, 2026 • edited by djm81 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

strix-security Bot commented Sep 21, 2026

Uh oh!

coderabbitai Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Oct 10, 2026

SpecFact CLI Validation Report

Uh oh!

github-actions Bot commented Oct 10, 2026

SpecFact CLI Validation Report

Uh oh!

github-actions Bot commented Oct 10, 2026

SpecFact CLI Validation Report

Uh oh!

github-actions Bot commented Oct 10, 2026

SpecFact CLI Validation Report

Uh oh!

github-actions Bot commented Oct 10, 2026

SpecFact CLI Validation Report

Uh oh!

github-actions Bot commented Oct 10, 2026

SpecFact CLI Validation Report

Uh oh!

github-actions Bot commented Oct 10, 2026

SpecFact CLI Validation Report

Uh oh!

chatgpt-codex-connector Bot commented Oct 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

github-actions Bot commented Oct 11, 2026

SpecFact CLI Validation Report

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

socket-security Bot commented Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 11, 2026

SpecFact CLI Validation Report

Uh oh!

djm81 commented Oct 11, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

djm81 commented Oct 11, 2026

Uh oh!

github-actions Bot commented Oct 11, 2026

SpecFact CLI Validation Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Sep 21, 2026 •

edited by djm81

Loading

coderabbitai Bot commented Sep 21, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 10, 2026 •

edited

Loading

socket-security Bot commented Oct 11, 2026 •

edited

Loading