ec41f764cd
build(deps): bump langchain-core from 1.2.23 to 1.2.28 in /common ( #518 )
...
Bumps [langchain-core](https://github.com/langchain-ai/langchain ) from 1.2.23 to 1.2.28.
- [Release notes](https://github.com/langchain-ai/langchain/releases )
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-core==1.2.23...langchain-core==1.2.28 )
---
updated-dependencies:
- dependency-name: langchain-core
dependency-version: 1.2.28
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 09:06:48 +02:00
a854399a12
build(deps): bump langchain-core from 1.2.23 to 1.2.28 in /fuzzer_runner ( #517 )
...
Bumps [langchain-core](https://github.com/langchain-ai/langchain ) from 1.2.23 to 1.2.28.
- [Release notes](https://github.com/langchain-ai/langchain/releases )
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-core==1.2.23...langchain-core==1.2.28 )
---
updated-dependencies:
- dependency-name: langchain-core
dependency-version: 1.2.28
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 09:06:37 +02:00
8b36cb86ea
build(deps): bump langchain-core from 1.2.23 to 1.2.28 in /orchestrator ( #519 )
...
Bumps [langchain-core](https://github.com/langchain-ai/langchain ) from 1.2.23 to 1.2.28.
- [Release notes](https://github.com/langchain-ai/langchain/releases )
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-core==1.2.23...langchain-core==1.2.28 )
---
updated-dependencies:
- dependency-name: langchain-core
dependency-version: 1.2.28
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 09:06:28 +02:00
0276f04eb8
build(deps): bump cryptography from 46.0.6 to 46.0.7 in /common ( #515 )
...
Bumps [cryptography](https://github.com/pyca/cryptography ) from 46.0.6 to 46.0.7.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst )
- [Commits](https://github.com/pyca/cryptography/compare/46.0.6...46.0.7 )
---
updated-dependencies:
- dependency-name: cryptography
dependency-version: 46.0.7
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 09:05:43 +02:00
c8196929ee
build(deps): bump cryptography from 46.0.6 to 46.0.7 in /fuzzer ( #516 )
...
Bumps [cryptography](https://github.com/pyca/cryptography ) from 46.0.6 to 46.0.7.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst )
- [Commits](https://github.com/pyca/cryptography/compare/46.0.6...46.0.7 )
---
updated-dependencies:
- dependency-name: cryptography
dependency-version: 46.0.7
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 09:05:24 +02:00
5add488707
build(deps): bump langchain-core from 1.2.23 to 1.2.28 in /fuzzer ( #514 )
...
Bumps [langchain-core](https://github.com/langchain-ai/langchain ) from 1.2.23 to 1.2.28.
- [Release notes](https://github.com/langchain-ai/langchain/releases )
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-core==1.2.23...langchain-core==1.2.28 )
---
updated-dependencies:
- dependency-name: langchain-core
dependency-version: 1.2.28
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 09:03:33 +02:00
07386f6bc7
build(deps): bump langchain-core from 1.2.23 to 1.2.28 in /seed-gen ( #513 )
...
Bumps [langchain-core](https://github.com/langchain-ai/langchain ) from 1.2.23 to 1.2.28.
- [Release notes](https://github.com/langchain-ai/langchain/releases )
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-core==1.2.23...langchain-core==1.2.28 )
---
updated-dependencies:
- dependency-name: langchain-core
dependency-version: 1.2.28
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 09:03:13 +02:00
5239596045
build(deps): bump cryptography from 46.0.6 to 46.0.7 in /patcher ( #512 )
...
Bumps [cryptography](https://github.com/pyca/cryptography ) from 46.0.6 to 46.0.7.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst )
- [Commits](https://github.com/pyca/cryptography/compare/46.0.6...46.0.7 )
---
updated-dependencies:
- dependency-name: cryptography
dependency-version: 46.0.7
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 09:02:56 +02:00
e3c2ccc1bf
build(deps): bump cryptography from 46.0.6 to 46.0.7 in /orchestrator ( #511 )
...
Bumps [cryptography](https://github.com/pyca/cryptography ) from 46.0.6 to 46.0.7.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst )
- [Commits](https://github.com/pyca/cryptography/compare/46.0.6...46.0.7 )
---
updated-dependencies:
- dependency-name: cryptography
dependency-version: 46.0.7
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 09:02:33 +02:00
3340b93491
build(deps): bump langchain-core from 1.2.23 to 1.2.28 in /program-model ( #510 )
...
Bumps [langchain-core](https://github.com/langchain-ai/langchain ) from 1.2.23 to 1.2.28.
- [Release notes](https://github.com/langchain-ai/langchain/releases )
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-core==1.2.23...langchain-core==1.2.28 )
---
updated-dependencies:
- dependency-name: langchain-core
dependency-version: 1.2.28
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 09:02:15 +02:00
ea0a3e1cae
build(deps): bump cryptography from 46.0.6 to 46.0.7 in /program-model ( #509 )
...
Bumps [cryptography](https://github.com/pyca/cryptography ) from 46.0.6 to 46.0.7.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst )
- [Commits](https://github.com/pyca/cryptography/compare/46.0.6...46.0.7 )
---
updated-dependencies:
- dependency-name: cryptography
dependency-version: 46.0.7
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 09:01:57 +02:00
f62ba9cfad
build(deps): bump cryptography from 46.0.6 to 46.0.7 in /seed-gen ( #508 )
...
Bumps [cryptography](https://github.com/pyca/cryptography ) from 46.0.6 to 46.0.7.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst )
- [Commits](https://github.com/pyca/cryptography/compare/46.0.6...46.0.7 )
---
updated-dependencies:
- dependency-name: cryptography
dependency-version: 46.0.7
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 09:01:41 +02:00
b0b460b501
build(deps): bump cryptography from 46.0.6 to 46.0.7 in /fuzzer_runner ( #507 )
...
Bumps [cryptography](https://github.com/pyca/cryptography ) from 46.0.6 to 46.0.7.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst )
- [Commits](https://github.com/pyca/cryptography/compare/46.0.6...46.0.7 )
---
updated-dependencies:
- dependency-name: cryptography
dependency-version: 46.0.7
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 09:01:24 +02:00
db9532728d
build(deps): bump the actions group with 2 updates ( #505 )
...
Bumps the actions group with 2 updates: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv ) and [codecov/codecov-action](https://github.com/codecov/codecov-action ).
Updates `astral-sh/setup-uv` from 7.6.0 to 8.0.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases )
- [Commits](https://github.com/astral-sh/setup-uv/compare/37802adc94f370d6bfd71619e3f0bf239e1f3b78...cec208311dfd045dd5311c1add060b2062131d57 )
Updates `codecov/codecov-action` from 5.5.2 to 6.0.0
- [Release notes](https://github.com/codecov/codecov-action/releases )
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/codecov/codecov-action/compare/671740ac38dd9b0130fbe1cec585b89eea48d3de...57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 )
---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
dependency-version: 8.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: codecov/codecov-action
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 09:01:05 +02:00
d98c7a5e71
build(deps): bump aiohttp from 3.13.3 to 3.13.4 in /patcher ( #504 )
...
---
updated-dependencies:
- dependency-name: aiohttp
dependency-version: 3.13.4
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 09:00:28 +02:00
946d5ba6d9
build(deps): bump pygments from 2.19.2 to 2.20.0 in /orchestrator ( #503 )
...
Bumps [pygments](https://github.com/pygments/pygments ) from 2.19.2 to 2.20.0.
- [Release notes](https://github.com/pygments/pygments/releases )
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES )
- [Commits](https://github.com/pygments/pygments/compare/2.19.2...2.20.0 )
---
updated-dependencies:
- dependency-name: pygments
dependency-version: 2.20.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-30 23:16:09 +02:00
a20170e6c6
build(deps): bump langchain-core and cryptography for security fixes ( #502 )
...
Upgrade langchain-core ~=1.2.22 (resolves to 1.2.23) to fix high-severity
path traversal in legacy load_prompt functions (GHSA dependabot alerts).
Upgrade cryptography to 46.0.6 to fix low-severity incomplete DNS name
constraint enforcement.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-03-30 09:34:17 +02:00
54acdcef42
build(deps): bump cryptography from 46.0.5 to 46.0.6 in /patcher ( #501 )
...
Bumps [cryptography](https://github.com/pyca/cryptography ) from 46.0.5 to 46.0.6.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst )
- [Commits](https://github.com/pyca/cryptography/compare/46.0.5...46.0.6 )
---
updated-dependencies:
- dependency-name: cryptography
dependency-version: 46.0.6
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-30 08:26:11 +02:00
3519f1d729
build(deps): bump cryptography from 46.0.5 to 46.0.6 in /fuzzer ( #500 )
...
Bumps [cryptography](https://github.com/pyca/cryptography ) from 46.0.5 to 46.0.6.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst )
- [Commits](https://github.com/pyca/cryptography/compare/46.0.5...46.0.6 )
---
updated-dependencies:
- dependency-name: cryptography
dependency-version: 46.0.6
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-30 08:25:39 +02:00
6d869033b6
build(deps): bump langchain-core from 1.2.21 to 1.2.22 in /common ( #499 )
...
Bumps [langchain-core](https://github.com/langchain-ai/langchain ) from 1.2.21 to 1.2.22.
- [Release notes](https://github.com/langchain-ai/langchain/releases )
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-core==1.2.21...langchain-core==1.2.22 )
---
updated-dependencies:
- dependency-name: langchain-core
dependency-version: 1.2.22
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-30 08:24:44 +02:00
8d0048f577
build(deps): bump the actions group across 1 directory with 8 updates ( #498 )
...
Bumps the actions group with 8 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv ) | `7.3.1` | `7.6.0` |
| [actions/cache](https://github.com/actions/cache ) | `5.0.3` | `5.0.4` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action ) | `3.12.0` | `4.0.0` |
| [docker/login-action](https://github.com/docker/login-action ) | `3.7.0` | `4.0.0` |
| [docker/metadata-action](https://github.com/docker/metadata-action ) | `5.10.0` | `6.0.0` |
| [docker/build-push-action](https://github.com/docker/build-push-action ) | `6.19.2` | `7.0.0` |
| [dorny/paths-filter](https://github.com/dorny/paths-filter ) | `3.0.2` | `4.0.1` |
| [actions/download-artifact](https://github.com/actions/download-artifact ) | `8.0.0` | `8.0.1` |
Updates `astral-sh/setup-uv` from 7.3.1 to 7.6.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases )
- [Commits](https://github.com/astral-sh/setup-uv/compare/5a095e7a2014a4212f075830d4f7277575a9d098...37802adc94f370d6bfd71619e3f0bf239e1f3b78 )
Updates `actions/cache` from 5.0.3 to 5.0.4
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/cdf6c1fa76f9f475f3d7449005a359c84ca0f306...668228422ae6a00e4ad889ee87cd7109ec5666a7 )
Updates `docker/setup-buildx-action` from 3.12.0 to 4.0.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases )
- [Commits](https://github.com/docker/setup-buildx-action/compare/8d2750c68a42422c14e847fe6c8ac0403b4cbd6f...4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd )
Updates `docker/login-action` from 3.7.0 to 4.0.0
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...b45d80f862d83dbcd57f89517bcf500b2ab88fb2 )
Updates `docker/metadata-action` from 5.10.0 to 6.0.0
- [Release notes](https://github.com/docker/metadata-action/releases )
- [Commits](https://github.com/docker/metadata-action/compare/c299e40c65443455700f0fdfc63efafe5b349051...030e881283bb7a6894de51c315a6bfe6a94e05cf )
Updates `docker/build-push-action` from 6.19.2 to 7.0.0
- [Release notes](https://github.com/docker/build-push-action/releases )
- [Commits](https://github.com/docker/build-push-action/compare/10e90e3645eae34f1e60eeb005ba3a3d33f178e8...d08e5c354a6adb9ed34480a06d141179aa583294 )
Updates `dorny/paths-filter` from 3.0.2 to 4.0.1
- [Release notes](https://github.com/dorny/paths-filter/releases )
- [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md )
- [Commits](https://github.com/dorny/paths-filter/compare/de90cc6fb38fc0963ad72b210f1f284cd68cea36...fbd0ab8f3e69293af611ebaee6363fc25e6d187d )
Updates `actions/download-artifact` from 8.0.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c )
---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
dependency-version: 7.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: actions/cache
dependency-version: 5.0.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: docker/setup-buildx-action
dependency-version: 4.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: docker/login-action
dependency-version: 4.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: docker/metadata-action
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: docker/build-push-action
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: dorny/paths-filter
dependency-version: 4.0.1
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: actions/download-artifact
dependency-version: 8.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-27 10:28:42 +01:00
04469d6a53
build(deps): bump requests from 2.32.5 to 2.33.0 across all components ( #497 )
...
Consolidates Dependabot PRs #491-#496 into a single update.
Updates lock files for common, fuzzer, fuzzer_runner, orchestrator,
patcher, program-model, and seed-gen. Also bumps the orchestrator
pyproject.toml constraint from ~=2.32.3 to ~=2.33.0.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-03-27 10:00:04 +01:00
385ea5ce93
Update langchain ecosystem and transitive dependencies ( #490 )
...
* build(deps): update langchain ecosystem and transitive dependencies
Upgrade dependencies across all components:
- langchain-core: 0.3.x -> 1.2.21
- langgraph: 0.6.x -> 1.0.10+
- langgraph-checkpoint: 3.x -> 4.0.1
- langchain: 0.3.x -> 1.2.x, langchain-openai: 0.3.x -> 1.1.x,
langchain-community: 0.3.x -> 0.4.x (ecosystem alignment)
- langfuse: 2.59.x -> 4.0.1 (compat with langchain 1.x)
- openlit: 1.36.x -> 1.38.x (remove langgraph ToolNode workaround)
- pydantic-settings: 2.7.x -> 2.10.x (langchain-community requirement)
- openai: 1.100.x -> 1.109.x (langchain-openai requirement)
- orjson: 3.11.5 -> 3.11.7
- PyJWT: 2.10.1 -> 2.12.1
- pyasn1: 0.6.2 -> 0.6.3
Code changes for langchain 1.x compatibility:
- common/llm.py: update imports for langchain-core and langfuse 4.x
- seed-gen/task.py: update langchain.prompts -> langchain_core.prompts
- Move langfuse to common[full] optional deps to avoid protobuf
conflict with clusterfuzz in fuzzer_runner
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
* fix(ci): fix import sorting and ignore unfixed pygments CVE
- Sort imports in seed-gen/task.py to satisfy ruff I001
- Add CVE-2026-4539 (pygments ReDoS, no fix available) to pip-audit
ignore list in CI workflow
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
* fix(ci): remove stale pip-audit ignores for orjson and protobuf
CVE-2025-67221 (orjson) and CVE-2026-0994 (protobuf) are fixed in the
versions now pinned in our lockfiles (orjson 3.11.7, protobuf 6.33.5).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
* refactor: move langfuse import to top level in llm.py
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-03-27 09:33:50 +01:00
55a4c64a19
build(deps): bump the actions group with 3 updates ( #478 )
...
Bumps the actions group with 3 updates: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv ), [actions/upload-artifact](https://github.com/actions/upload-artifact ) and [actions/download-artifact](https://github.com/actions/download-artifact ).
Updates `astral-sh/setup-uv` from 7.3.0 to 7.3.1
- [Release notes](https://github.com/astral-sh/setup-uv/releases )
- [Commits](https://github.com/astral-sh/setup-uv/compare/eac588ad8def6316056a12d4907a9d4d84ff7a3b...5a095e7a2014a4212f075830d4f7277575a9d098 )
Updates `actions/upload-artifact` from 6.0.0 to 7.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f )
Updates `actions/download-artifact` from 7.0.0 to 8.0.0
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/37930b1c2abaa49bbe596cd826c3c89aef350131...70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 )
---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
dependency-version: 7.3.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: actions/upload-artifact
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: actions/download-artifact
dependency-version: 8.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-09 09:48:36 +01:00
d9e7d0b60b
build(deps): bump docker/build-push-action in the actions group ( #476 )
...
Bumps the actions group with 1 update: [docker/build-push-action](https://github.com/docker/build-push-action ).
Updates `docker/build-push-action` from 6.18.0 to 6.19.2
- [Release notes](https://github.com/docker/build-push-action/releases )
- [Commits](https://github.com/docker/build-push-action/compare/263435318d21b8e681c14492fe198d362a7d2c83...10e90e3645eae34f1e60eeb005ba3a3d33f178e8 )
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 6.19.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-02 08:53:41 +01:00
1adc774d33
docs: add Colima and docker-buildx setup instructions for macOS ( #474 )
...
macOS users using Colima instead of Docker Desktop were hitting
missing buildx errors and had no documentation to guide them.
Add Colima as a supported Docker runtime, document buildx
installation, and ensure setup-local installs buildx automatically.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-23 09:15:34 -08:00
ed723f40de
build(deps): bump astral-sh/setup-uv in the actions group ( #473 )
...
Bumps the actions group with 1 update: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv ).
Updates `astral-sh/setup-uv` from 7.2.0 to 7.3.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases )
- [Commits](https://github.com/astral-sh/setup-uv/compare/61cb8a9741eeb8a550a1b8544337180c0fc8476b...eac588ad8def6316056a12d4907a9d4d84ff7a3b )
---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
dependency-version: 7.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-16 09:55:09 +01:00
77a3e77936
Create minikube config for a large machine (16 CPU, 128 GB) ( #469 )
...
* Create minikube config for a large machine (16 CPU, 128 GB)
* Address PR feedback and scale services
- Increase redis memory
- Disable redis in-memory backups to conserve memory
- Increase build bot replicas
- Increase dind CPU/Memory given build bot scaling
- Set reasonable limits for merger-bot and pov-reproducer
- increase coverage bot memory
* Configure /dev/shm size for corpus tmpfs
2026-02-12 08:32:55 -05:00
fb9a40cfc9
docs: add Redis testing guidance to CLAUDE.md ( #472 )
...
Many component test suites require a running Redis instance.
Document how to start a temporary Redis container via Docker
so these tests are not skipped or left failing.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-11 10:53:44 +01:00
b5aa20d0b4
build(deps): bump cryptography from 46.0.3 to 46.0.5 in remaining components ( #471 )
...
Bump cryptography to 46.0.5 in common, orchestrator, patcher,
program-model, seed-gen, and fuzzer_runner lock files to match
the fuzzer component which was already updated in #470 .
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-11 10:53:29 +01:00
e6aa09c831
build(deps): bump cryptography from 46.0.3 to 46.0.5 in /fuzzer ( #470 )
...
Bumps [cryptography](https://github.com/pyca/cryptography ) from 46.0.3 to 46.0.5.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst )
- [Commits](https://github.com/pyca/cryptography/compare/46.0.3...46.0.5 )
---
updated-dependencies:
- dependency-name: cryptography
dependency-version: 46.0.5
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-11 08:58:31 +01:00
7f10615d76
build(deps): bump the actions group with 2 updates ( #466 )
...
Bumps the actions group with 2 updates: [actions/cache](https://github.com/actions/cache ) and [docker/login-action](https://github.com/docker/login-action ).
Updates `actions/cache` from 5.0.2 to 5.0.3
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/8b402f58fbc84540c8b491a91e594a4576fec3d7...cdf6c1fa76f9f475f3d7449005a359c84ca0f306 )
Updates `docker/login-action` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/5e57cd118135c172c3672efd75eb46360885c0ef...c94ce9fb468520275223c153574b00df6fe4bcc9 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 5.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: docker/login-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-09 09:12:28 +01:00
09f2980ff9
Add optional tmpfs storage for fuzzing corpus ( #461 )
...
* Add optional tmpfs storage for fuzzing corpus
Add support for storing the node-local fuzzing corpus in tmpfs (RAM-based
filesystem) for improved I/O performance during fuzzing operations.
Key changes:
- Add CORPUS_TMPFS_PATH environment variable to configure tmpfs location
- Add cross-filesystem safe operations (copy+delete fallback for EXDEV)
- Update Corpus class to use tmpfs path when enabled while maintaining
correct remote path calculation for rsync synchronization
- Add Helm chart configuration using /dev/shm (requires no host setup)
- Update fuzzer-bot, coverage-bot, merger-bot, seed-gen deployments
The feature is disabled by default. Enable by setting
global.volumes.corpusTmpfs.enabled=true in values.yaml.
Uses hostPath to /dev/shm/buttercup-corpus which is available on
Linux systems without requiring any Kubernetes host configuration.
2026-02-06 20:10:45 +01:00
22cebd4897
Fix starlette security vulnerabilities (CVE-2025-62727, CVE-2025-54121) ( #465 )
...
Upgrade FastAPI from ~0.115.6 to ~0.128.0 in orchestrator to allow
starlette >= 0.49.1, fixing:
- CVE-2025-62727 (High): O(n^2) DoS via Range header in FileResponse
- CVE-2025-54121 (Medium): DoS via large multipart file parsing
The orchestrator uses FileResponse and StaticFiles (the affected
components) in the competition API UI.
Resolves: Dependabot alerts #33 , #34
2026-02-04 20:32:07 +01:00
0268403c44
Update protobuf to 6.33.5 to fix high severity security vulnerability ( #463 )
...
Resolves Dependabot alerts #62 , #71 , #81 by updating protobuf from
6.33.4 to 6.33.5 across all components.
2026-02-04 20:28:24 +01:00
240112f2a6
Only copy generated seeds to node-local corpus ( #460 )
2026-01-27 17:19:59 -05:00
3c3ae36a11
Fix fuzzer-runner missing transitive dependency and add tests ( #459 )
...
* Use openlit <1.36.6
Openlit >=1.36.6 has a bug with langgraph instrumentation.
Also add a test to seed-gen for when openlit is enabled
* Link to issue
* Fix CoverageBot.run_task and add test cases
* Add setuptools as an explicit dependency
This is because a transitive dependency via clusterfuzz depends on it
* Appease ruff
2026-01-27 23:13:53 +01:00
e826b53530
Fix CoverageBot.run_task and add test cases ( #458 )
...
* Use openlit <1.36.6
Openlit >=1.36.6 has a bug with langgraph instrumentation.
Also add a test to seed-gen for when openlit is enabled
* Link to issue
* Fix CoverageBot.run_task and add test cases
---------
Co-authored-by: Henrik Brodin <90325907+hbrodin@users.noreply.github.com >
2026-01-27 23:13:34 +01:00
a31b670a2e
Fix: Use Openlit <1.36.6 to avoid bug with langgraph instrumentation ( #457 )
...
* Use openlit <1.36.6
Openlit >=1.36.6 has a bug with langgraph instrumentation.
Also add a test to seed-gen for when openlit is enabled
* Link to issue
2026-01-27 16:28:41 -05:00
42fb0c126d
build(deps): pin protobuf to 3.20.3 in fuzzer_runner for OSS-Fuzz compatibility ( #456 )
...
Add uv constraint-dependencies to prevent protobuf from being updated
beyond 3.20.3, which is required for compatibility with OSS-Fuzz
infrastructure.
This prevents dependabot from creating PRs like #453 that would break
the fuzzer runner.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-27 22:25:04 +01:00
594748aec1
Use claude 4.5 ( #437 )
...
* Replace Claude 4 with Claude 4.5
Also remove Claude 3.5 and replace usage with Claude 4
* Use claude 4.5 as the Anthropic fallback model for patcher
2026-01-27 09:35:30 -05:00
b94a23eedb
build(deps): update openlit and pydantic to unblock mcp upgrade ( #455 )
...
Update dependency constraints to allow mcp 1.26.0:
- common: openlit ==1.35.0 -> ~=1.36.0
- orchestrator: pydantic ~=2.10.5 -> ~=2.11.0
The mcp upgrade was blocked because:
1. openlit 1.35.0 constrained openai-agents to older versions
2. pydantic <2.11.0 blocked mcp 1.23.0+ (requires pydantic>=2.11.0)
Resulting upgrades:
- mcp: 1.12.4 -> 1.26.0
- openlit: 1.35.0 -> 1.36.7
- pydantic: 2.10.6 -> 2.11.10
- openai-agents: 0.2.8 -> 0.3.3
Closes #450
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-27 14:15:53 +01:00
ddb25601a9
build(deps): add fuzzer_runner dependency updates ( #451 )
...
Updates pyasn1 0.6.1 → 0.6.2 and urllib3 2.5.0 → 2.6.3 in fuzzer_runner.
These updates are from Dependabot PRs #448 and #449 .
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-27 13:31:22 +01:00
f89ba22dce
build(deps): consolidate dependabot updates ( #447 )
...
Update multiple dependencies across components:
patcher:
- langgraph-checkpoint 2.1.1 → 3.0.1 (major version, drops Python 3.9 support)
- langgraph 0.6.6 → 0.6.11
- marshmallow 3.26.1 → 3.26.2 (CVE-2025-68480 fix)
- mcp 1.13.0 → 1.26.0
- starlette 0.47.2 → 0.52.1 (security fix for Range header parsing)
program-model:
- mcp 1.13.0 → 1.26.0
- starlette 0.47.2 → 0.52.1 (security fix for Range header parsing)
seed-gen:
- langgraph-checkpoint 2.1.0 → 3.0.1
- langgraph 0.6.6 → 0.6.11
This consolidates the following Dependabot PRs: #430 , #433 , #434 , #443 , #444 , #445 , #446
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-27 12:10:31 +01:00
e57b4117d8
build(deps): bump aiohttp from 3.12.13 to 3.13.3 in /patcher ( #435 )
...
---
updated-dependencies:
- dependency-name: aiohttp
dependency-version: 3.13.3
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Henrik Brodin <90325907+hbrodin@users.noreply.github.com >
2026-01-27 11:30:26 +01:00
678b6657f3
build(deps): bump python-multipart from 0.0.20 to 0.0.22 in /fuzzer
...
Bumps [python-multipart](https://github.com/Kludex/python-multipart ) from 0.0.20 to 0.0.22.
- [Release notes](https://github.com/Kludex/python-multipart/releases )
- [Changelog](https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Kludex/python-multipart/compare/0.0.20...0.0.22 )
---
updated-dependencies:
- dependency-name: python-multipart
dependency-version: 0.0.22
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-27 11:11:22 +01:00
14b7106cb7
build(deps): bump python-multipart from 0.0.20 to 0.0.22 in /seed-gen
...
Bumps [python-multipart](https://github.com/Kludex/python-multipart ) from 0.0.20 to 0.0.22.
- [Release notes](https://github.com/Kludex/python-multipart/releases )
- [Changelog](https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Kludex/python-multipart/compare/0.0.20...0.0.22 )
---
updated-dependencies:
- dependency-name: python-multipart
dependency-version: 0.0.22
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Henrik Brodin <90325907+hbrodin@users.noreply.github.com >
2026-01-27 10:54:15 +01:00
775d150cc0
build(deps): bump python-multipart from 0.0.20 to 0.0.22 in /program-model
...
Bumps [python-multipart](https://github.com/Kludex/python-multipart ) from 0.0.20 to 0.0.22.
- [Release notes](https://github.com/Kludex/python-multipart/releases )
- [Changelog](https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Kludex/python-multipart/compare/0.0.20...0.0.22 )
---
updated-dependencies:
- dependency-name: python-multipart
dependency-version: 0.0.22
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Henrik Brodin <90325907+hbrodin@users.noreply.github.com >
2026-01-27 10:53:47 +01:00
683aee96b7
build(deps): bump python-multipart from 0.0.20 to 0.0.22 in /patcher
...
Bumps [python-multipart](https://github.com/Kludex/python-multipart ) from 0.0.20 to 0.0.22.
- [Release notes](https://github.com/Kludex/python-multipart/releases )
- [Changelog](https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Kludex/python-multipart/compare/0.0.20...0.0.22 )
---
updated-dependencies:
- dependency-name: python-multipart
dependency-version: 0.0.22
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-27 10:29:41 +01:00
44958ee84f
build(deps): bump python-multipart from 0.0.20 to 0.0.22 in /orchestrator
...
Bumps [python-multipart](https://github.com/Kludex/python-multipart ) from 0.0.20 to 0.0.22.
- [Release notes](https://github.com/Kludex/python-multipart/releases )
- [Changelog](https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Kludex/python-multipart/compare/0.0.20...0.0.22 )
---
updated-dependencies:
- dependency-name: python-multipart
dependency-version: 0.0.22
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-27 10:19:01 +01:00
dependabot[bot]