chore(deps): bump cpex from 0.1.1 to 0.1.3 in the python-minor-patch group

[dependabot]

Bumps the python-minor-patch group with 1 update: cpex.

Updates cpex from 0.1.1 to 0.1.3

Changelog

Sourced from cpex's changelog.

[0.1.3] - 2026-08-06

Changed

• CopyOnWriteDict / CopyOnWriteList now snapshot the wrapped container at construction instead of reading through to it lazily (#152)
  • Mutating the original after wrapping is no longer visible through the wrapper — isolation is now symmetric. The lazy implementation leaked such mutations in
  • The wrapper no longer retains a reference to the original container
  • Small construction cost: snapshotting up front measures 0.26 us vs 0.17 us (100-item list) and 0.43 us vs 0.20 us (100-key dict) against the lazy wrapper. Still ~38-45x cheaper than the copy.deepcopy() it exists to avoid, so the isolation path stays sub-microsecond per wrap
• Capped the mcp dependency below 2.0 (#148)
  • mcp 2.0.0 renamed McpError to MCPError, breaking cpex/framework/external/mcp/client.py. The 0.1.x line stays on mcp 1.x

Fixed

• CopyOnWrite containers no longer lose or duplicate data in inherited methods (#152)
  • model_dump() / model_dump_json() / json.dumps() of a CoW-isolated payload returned empty containers, silently stripping items / args / headers — this reached external (gRPC/Unix-socket) plugins, which receive payloads via model_dump()
  • copy.deepcopy() and model_copy(deep=True) duplicated every element of a CopyOnWriteList
  • CopyOnWriteList: fixed <, <=, >, >=, +, *, +=, *=, index(), count() and reversed(); += was a silent no-op
  • CopyOnWriteDict: fixed |, |=, popitem() and reversed()
• Implement __eq__ and __ne__ for CopyOnWriteList (#136)
• Execution records are now emitted for the denying plugin when a violation raises (#147)
  • With violations_as_exceptions=True, PluginViolationError carries the accumulated records via a new executions attribute — previously only plugins that ran before the denial were observable, so telemetry could not identify which control blocked the invocation
  • Covers SEQUENTIAL, TRANSFORM, AUDIT and CONCURRENT modes; concurrent denials also no longer leak sibling tasks (they are cancelled before the re-raise)

[0.1.2] - 2026-07-29

Added

• Structured control execution records for enforcement observability (#141)
  • ControlExecutionStatus enum and ControlExecutionRecord Pydantic model in cpex.framework.models
  • PluginResult.executions: list[ControlExecutionRecord] — one record per plugin evaluated, always present
  • All five execution phases instrumented: Sequential, Transform, Audit, Concurrent, Fire-and-forget
  • Identity fields (plugin_id, plugin_name, plugin_kind, mode) sourced from trusted PluginRef config — plugins cannot forge these
  • Monotonic per-plugin timing (duration_ns); fire-and-forget records use duration_ns=0 at spawn time
  • Security bounds: string fields capped at 256 bytes, config key lists capped at 64 entries, config values never stored
  • ControlExecutionRecord and ControlExecutionStatus exported from cpex.framework

Commits

• 277dfd1 chore: update lint ci job
• b920c78 chore: update lint ci job
• 186876c chore: add workflow_dispatch to ci job
• a394c00 chore: bump version for release
• 45fc269 chore: update codeowners
• f4b4e0f fix: snapshot CoW containers so inherited methods see real data (#153)
• c45bf4b fix: implement eq and ne for CopyOnWriteList (#136)
• 154c8d2 fix: violation record on exception (#148)
• 2d087fe chore: 0.1.2 release
• a636ce6 feat: add PluginResult.executions structured control execution records (#141)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[lucarlig]

LGTM