[invisiblefix-bot]

Supersedes #604 (#604): it carries that PR's dependency update unchanged (pyproject.toml and uv.lock, commit e7b443b) plus one fix commit on top.

Root cause. griffelib 2.4.1 ("Stop checking attribute values", mkdocstrings/griffe#506) made find_breaking_changes stop yielding AttributeChangedValueBreakage. .github/scripts/check_plugin_api.py relies on those to flag a changed attribute value in the plugin API (a plugin group name, a class attribute, a pydantic field default), so on 2.4.1 it reports no break for them and 5 cases in tst/unit/test_check_plugin_api.py fail.

Fix. The script now finds those value changes itself, _value_changes, walking the same public members, aliases, modules and classes griffe 2.3.0 compared, and yields the same AttributeChangedValueBreakage objects into the existing loop, so _benign and _describe treat them exactly as before. One file, +30/−1. No test, test config or CI config changed, and the update isn't pinned back.

Evidence (CI unit command, uv sync --locked --extra dev, Python 3.12.16, Ubuntu 22.04.5):

Run	Commit	Collected	Passed	Failed	Skipped
base 1	329fff7 (main)	14653	14644	1 (unrelated flake¹)	8
base 2	329fff7 (main)	14653	14645	0	8
base 3	329fff7 (main)	14653	14645	0	8
base 4	329fff7 (main)	14653	14644	1 (unrelated flake¹)	8
head 1	e7b443b (#604)	14653	14640	5	8
head 2	e7b443b (#604)	14653	14640	5	8
fix 1	bc7d314	14653	14645	0	8
fix 2	bc7d314	14653	14645	0	8

Head failures (both runs): test_reports_a_break[class-attribute-changed], [group-name-changed], [field-default-changed], test_reports_a_subclass_or_construction_break[attribute-lost-its-value], [group-name-through-an-expression].

¹ base 1: tst/unit/plugin_settings_test.py::test_explain_names_the_plugin_that_reads_a_key; base 4: packages/agentenv-protocol/tests/test_computer_recording.py::test_frames_in_thread_keeps_the_latest_frames_for_a_slow_reader_and_closes_its_source_when_stopped. Different tests, neither touches griffe, both pass on re-run.

Also checked: the checker's output on all 51 edit scenarios in test_check_plugin_api.py and on 46 before/after pairs from the repo's history is identical to main's with the fix; ruff check passes; the plugin-api job's command passes against main. The skipped test IDs are the same in every run; 90 parametrized test IDs are spelled differently on head/fix because of the pytest 9.1.1 → 9.2.0 bump in this update (same tests, same count per test function).

Fix commit: bc7d314

Confidence Score: 5/5

The PR appears safe to merge; no blocking issue was established.

Summary

Updates Python dependencies and restores attribute-value checks after the griffelib upgrade.

• The plugin API check reports changes to public attribute values.
• Dependency limits and locked versions now include newer releases.

_{Reviews (1) · Last reviewed commit: "fix(ci): keep reporting attribute value ..." · Reviewed by Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​botocore@​1.43.123 ⏵ 1.43.127	+1
	pypi/​hypothesis@​6.170.14 ⏵ 6.170.15	+1
	pypi/​smolmachines@​1.27.3 ⏵ 1.32.4					-30
	pypi/​e2b@​2.46.4 ⏵ 2.63.0	+1
	pypi/​openenv@​0.10.0 ⏵ 0.12.0	+1
	pypi/​litellm@​1.106.6 ⏵ 1.108.3	+1
	pypi/​moto@​5.2.2 ⏵ 5.2.5
	pypi/​transformers@​5.21.0 ⏵ 5.22.2	+1
	pypi/​pytest@​9.1.1 ⏵ 9.2.0	+1
	pypi/​google-auth@​2.55.1 ⏵ 2.62.1	+1
	pypi/​pymongo@​4.17.0 ⏵ 4.19.0	-1	+31
	pypi/​vercel-sandbox@​0.7.0 ⏵ 0.11.0	-3
	pypi/​google-cloud-storage@​3.15.0 ⏵ 3.17.1	+1
	pypi/​click@​8.5.0 ⏵ 8.5.1	+1
	pypi/​daytona@​0.224.1 ⏵ 0.231.0
	pypi/​sail@​0.12.8 ⏵ 0.17.2	+1
	pypi/​tensorlake@​0.5.149 ⏵ 0.5.163	+1
	pypi/​griffelib@​2.3.0 ⏵ 2.4.1	+1
	pypi/​omegaconf@​2.3.1 ⏵ 2.4.0	-1
	pypi/​boto3@​1.43.123 ⏵ 1.43.126
	pypi/​google-api-core@​2.31.0 ⏵ 2.44.0
	pypi/​google-cloud-secret-manager@​2.30.0 ⏵ 2.32.0
	pypi/​python-multipart@​0.0.32 ⏵ 0.0.33	+1
	pypi/​cwsandbox@​1.19.6 ⏵ 1.27.0	+1
	pypi/​cryptography@​50.0.1 ⏵ 50.0.2
	pypi/​starlette@​1.3.1 ⏵ 1.10.0	+1
	pypi/​ruff@​0.16.10 ⏵ 0.17.4
	pypi/​boxd@​0.2.17 ⏵ 0.3.0	+1
	pypi/​httpx2@​2.13.1 ⏵ 2.16.0
	pypi/​fastapi@​0.141.1 ⏵ 0.162.2	+1
	pypi/​pytest-socket@​0.8.0 ⏵ 0.8.1	+1
	pypi/​pytest-asyncio@​1.4.0 ⏵ 1.4.1.post1	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	High CVE: Hydra logging configuration permits unsafe callable resolution in pypi hydra-core CVE: GHSA-c3wx-c55w-pxjq Hydra logging configuration permits unsafe callable resolution (HIGH) Affected versions: < 1.3.6; >= 1.4.0.dev0 < 1.4.0.dev9 Patched version: 1.3.6 From: uv.lock → pypi/nemo-gym@0.7.0 → pypi/hydra-core@1.3.0 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/hydra-core@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	High CVE: Hydra: hydra.utils.instantiate with untrusted config can lead to code execution in pypi hydra-core CVE: GHSA-2cp2-2r3c-7p7r Hydra: hydra.utils.instantiate with untrusted config can lead to code execution (HIGH) Affected versions: < 1.3.4 Patched version: 1.3.4 From: uv.lock → pypi/nemo-gym@0.7.0 → pypi/hydra-core@1.3.0 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/hydra-core@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi hydra-core with risk level "medium" Location: Package overview From: uv.lock → pypi/nemo-gym@0.7.0 → pypi/hydra-core@1.3.0 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/hydra-core@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi hydra-core with risk level "medium" Location: Package overview From: uv.lock → pypi/nemo-gym@0.7.0 → pypi/hydra-core@1.3.0 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/hydra-core@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report