Skip to content

chore(deps): bump multidict in agno lockfile - #5348

Merged
cdbartholomew merged 1 commit into
mainfrom
chore/security-daily-20261006-uv-agno
Oct 6, 2026
Merged

cdbartholomew merged 1 commit into
mainfrom
chore/security-daily-20261006-uv-agno

Conversation

@cdbartholomew

Copy link
Copy Markdown
Contributor

Routine dependency maintenance for hindsight-integrations/agno/uv.lock.

Closes Dependabot alert #1782

  • multidict 6.7.1 → 6.9.1

The lock was regenerated with uv lock --upgrade-package <pkg> for the packages above only, and nothing else was re-resolved. Most of the diff is multidict's per-platform wheel list.
The lockfile's entry for the project itself also moves (0.4.19 → 0.4.20) to match the version already in pyproject.toml. That entry had not been refreshed since the last release.

Verification (reproducing the CI job's steps)

  • uv build: OK
  • uv sync --frozen: OK
  • uv run pytest tests: 173 passed in 5.50s

Note: no CI job or path filter covers this directory, so CI does not exercise this change. The local build, sync and tests above are the evidence.

@cdbartholomew cdbartholomew added security Security / dependency vulnerability remediation p2 Medium severity - remediate within 60 days labels Oct 6, 2026
@cdbartholomew cdbartholomew self-assigned this Oct 6, 2026
@cdbartholomew cdbartholomew added security Security / dependency vulnerability remediation p2 Medium severity - remediate within 60 days labels Oct 6, 2026
@cdbartholomew

Copy link
Copy Markdown
Contributor Author

Merging over a known, pre-existing build-docs failure. It is unrelated to this lockfile-only change.

build-docs fails at its first step, node hindsight-docs/scripts/check-integrations.mjs, before any dependency is installed:

[integrations] ❌ Changelog pages not linked from their doc page:
  agno — add [View Changelog →](/changelog/integrations/agno)

Why this is pre-existing:

Every other check that ran on this PR passed, including the job(s) that cover the changed lockfile.

@cdbartholomew

Copy link
Copy Markdown
Contributor Author

CI does not cover this change. No job or path filter in .github/workflows/test.yml exercises hindsight-integrations/agno. The checks that ran here (detect-changes, check-integration-lockfiles where applicable) do not install or test it, so the evidence for this merge is local verification:

  • Test suite against a clean worktree of main (8830bbb): 173 passed
  • Test suite with this lockfile: 173 passed. The results are identical, and there are no failures on either side, so no pre-existing failure is being masked
  • uv build and uv sync --frozen pass. import hindsight_agno, multidict, aiohttp resolves (multidict 6.9.1 under aiohttp 3.14.3)

@cdbartholomew
cdbartholomew merged commit 1bd7220 into main Oct 6, 2026
198 of 200 checks passed
@cdbartholomew
cdbartholomew deleted the chore/security-daily-20261006-uv-agno branch October 6, 2026 15:42
@nicoloboschi nicoloboschi mentioned this pull request Nov 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

p2 Medium severity - remediate within 60 days security Security / dependency vulnerability remediation

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant