fix(security): refresh shared PyJWT and PyO3 locks - #2531

Draft

seonghobae wants to merge 31 commits into

mainfrom

codex/security-baseline-final-20260930

Commits on Sep 30, 2026

test(security): require patched Strix and Rust fixture locks
seonghobae
committed
cd84d88
fix(security): refresh shared PyJWT and PyO3 locks
seonghobae
committed
1ca4b94
test(security): reject duplicate vulnerable dependency locks
seonghobae
committed
02c70d5
test(security): normalize requirement extras
seonghobae
committed
d1aa365
fix(security): pin patched urllib3 for pip audit
seonghobae
committed
5e807bd
fix(security): pin patched urllib3 for Strix
seonghobae
committed
bb3bcad
build(security): regenerate pip audit lock
seonghobae
committed
109b542
build(security): regenerate Strix lock
seonghobae
committed
8dba299
test(security): bind patched urllib3 locks
seonghobae
committed
165b6fe
docs(security): record urllib3 lock repair
seonghobae
committed
0d5a2c3
docs(doctoring): trace urllib3 CVE repair
seonghobae
committed
e65f595
docs(gap): track shared urllib3 closure
seonghobae
committed
dde3ea7
fix(security): advance PyJWT beyond parser DoS
seonghobae
committed
9b4258d
fix(security): advance shared PyJWT lock to 2.15.0
seonghobae
committed
e5359ba
merge: integrate concurrent PyJWT security repair
seonghobae
committed
516471f
fix(security): patch document reader transitives
seonghobae
committed
08d8506
test(security): require Noema transitive source owner
seonghobae
committed
29ebc1e
fix(security): own Noema transitive overrides
seonghobae
committed
91f20d2
merge(security): integrate shared dependency prerequisite
seonghobae
committed
93433af
fix(security): narrow transitive floor and scan nested locks
seonghobae
committed
9a4af5e

Commits on Oct 1, 2026

fix(security): patch shared Strix LiteLLM lock
seonghobae
committed
fe879f7
fix(security): replace suppressed maturin URL opener
seonghobae
committed
eb05a35
docs(security): bind Gap baseline to exact-head evidence
seonghobae
committed
94c48f9
docs(security): record exact-head admission state
seonghobae
committed
8f7a674
merge(security): integrate bounded maturin downloader
seonghobae
committed
e33d97d
fix(security): replace audited HTTPSConnection downloader
seonghobae
committed
eede925
docs(security): bind Maturin SAST RCA to exact evidence
seonghobae
committed
a5ddcfc
fix(docs): restore complete gap baseline after binary corruption
seonghobae
committed
f42da78
docs(security): record bounded Maturin SAST closure
seonghobae
committed
c48981d
fix(security): disable ambient release proxies
seonghobae
committed
21467ef
merge(security): integrate proxy-free downloader with live evidence
seonghobae
committed
7900ba4

Navigation Menu

fix(security): refresh shared PyJWT and PyO3 locks - #2531

fix(security): refresh shared PyJWT and PyO3 locks#2531
seonghobae wants to merge 31 commits into
mainfrom
codex/security-baseline-final-20260930

Commits on Sep 30, 2026

test(security): require patched Strix and Rust fixture locks

fix(security): refresh shared PyJWT and PyO3 locks

test(security): reject duplicate vulnerable dependency locks

test(security): normalize requirement extras

fix(security): pin patched urllib3 for pip audit

fix(security): pin patched urllib3 for Strix

build(security): regenerate pip audit lock

build(security): regenerate Strix lock

test(security): bind patched urllib3 locks

docs(security): record urllib3 lock repair

docs(doctoring): trace urllib3 CVE repair

docs(gap): track shared urllib3 closure

fix(security): advance PyJWT beyond parser DoS

fix(security): advance shared PyJWT lock to 2.15.0

merge: integrate concurrent PyJWT security repair

fix(security): patch document reader transitives

test(security): require Noema transitive source owner

fix(security): own Noema transitive overrides

merge(security): integrate shared dependency prerequisite

fix(security): narrow transitive floor and scan nested locks

Commits on Oct 1, 2026

fix(security): patch shared Strix LiteLLM lock

fix(security): replace suppressed maturin URL opener

docs(security): bind Gap baseline to exact-head evidence

docs(security): record exact-head admission state

merge(security): integrate bounded maturin downloader

fix(security): replace audited HTTPSConnection downloader

docs(security): bind Maturin SAST RCA to exact evidence

fix(docs): restore complete gap baseline after binary corruption

docs(security): record bounded Maturin SAST closure

fix(security): disable ambient release proxies

merge(security): integrate proxy-free downloader with live evidence