build(deps): bump hypothesis from 6.156.6 to 6.164.0

[dependabot]

Summary

Update the hash-locked property-testing dependency from Hypothesis 6.156.6 to 6.164.0.

Scope

• fuzz/requirements-property.txt only relative to the exact PR fix(security): pin provider egress and repair the Atheris lock #96 base
• generated Hypothesis hashes and compatible property-test closure
• no production code, workflow permission, runtime dependency, API, schema, or persistence change

Stack and exact identity

PR #96 supersedes closed-unmerged PR #76 and remains this PR's stacked base. The dependency update was refreshed on 2026-08-12 through a normal two-parent merge with no conflict.

• Contributor head: b5780716c07fc16391e3a525917786ead065dc60
• Exact stacked base: PR fix(security): pin provider egress and repair the Atheris lock #96 at 3703d0da9823b8258a0be94f1801aa5d61bfad9f
• Protected main tip independently observed through fix(security): pin provider egress and repair the Atheris lock #96: 6841b71935e0b7cb98fb52bcb4709cc5100c8d87
• Tree: 987655a04d99d5fa4bce88495e9ca431b3d0a96c
• Unique diff: fuzz/requirements-property.txt only
• State: Draft / mergeable

If #96 moves again, all current-base evidence becomes historical and this branch must be reconciled again. No predecessor-head result or review transfers.

Local verification

The exact published tree was verified before branch publication:

• the refreshed hash lock installed successfully under --require-hashes;
• dependency-lock and repository-security contracts: 10 passed;
• full suite: 566 passed;
• owned production coverage: 3,667 statements and 934 branches, 100%;
• public docstrings: 100%;
• git diff --check: passed.

Hosted exact-head evidence

Every repository-local job below explicitly fetched and checked out exact contributor head b5780716c07fc16391e3a525917786ead065dc60 with checkout credentials disabled.

• Tests run 31551570467, job 93975174291: success, 566 passed, 100% production statement and branch coverage (3,667 statements / 934 branches, zero misses/partials), and 100% public-docstring coverage.
• Security run 31551570443: success.
  • Python supply-chain job 93975174355 found no known vulnerabilities and published CycloneDX SBOM artifact 9124499202 with archive digest sha256:513839bec9c9a594523269ca9a071c67e1f1d451334661a7aed599c2924375b3.
  • CodeQL job 93975174333 completed successfully on the exact head.
• Fuzz run 31551570457: success.
  • Hypothesis job 93975174454 installed the exact 6.164.0 hash lock and passed 8 property tests.
  • Atheris job 93975174479 completed the four bounded targets with 8,289,951 / 9,957,075 / 601,811 / 3,505 runs and no crash artifact.
• CodeRabbit commit status: success, classified as status-only evidence rather than independent approval.
• The two formal review submissions apply only to predecessor fa3a30bda3b3209025d55c5526a037f3086f0f07: one OpenCode CHANGES_REQUESTED and one repository-author approval. Neither transfers to the current head or qualifies as current-head independent approval.
• Current valid unresolved inline review threads: zero.
• Qualifying independent non-author approval on the unchanged current head: absent.

These exact-head runs establish repository-local Tests, Security, Fuzz, coverage, public-docstring, vulnerability-audit, CodeQL, SBOM, hash-lock, and bounded-fuzz evidence. They do not substitute for protected integration of #96 or qualifying independent approval, so the PR remains Draft.

Acceptance

Keep this PR Draft until #96 reaches protected main, every required exact-head check and current automated verdict is complete, zero valid unresolved findings remain, and a qualifying independent non-author approval applies to the unchanged head. Queued, skipped-required, predecessor-head, stale-base, synthetic-merge, status-only, author-only, absent, failed, or infrastructure-only evidence is not success.

[coderabbitai]

📝 Walkthrough

Walkthrough

fuzz/requirements-property.txt의 hypothesis 버전을 6.156.6에서 6.164.0으로 업데이트했습니다. 새 버전에 맞는 패키지 무결성 해시를 적용했습니다.

Changes

Hypothesis 의존성 업데이트

Layer / File(s)	Summary
Hypothesis 요구사항 및 해시 업데이트 fuzz/requirements-property.txt	hypothesis 버전을 6.164.0으로 변경하고 새 릴리스의 무결성 해시 목록으로 교체했습니다.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: seonghobae

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 Hypothesis 의존성 버전을 6.156.6에서 6.164.0으로 업데이트하는 변경 사항을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/pip/hypothesis-6.164.0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head fa3a30bda3b3209025d55c5526a037f3086f0f07.

• Head SHA: fa3a30bda3b3209025d55c5526a037f3086f0f07

• Workflow run: 30771081881

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: requirements-property.txt"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: requirements-property.txt"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: fa3a30bda3b3209025d55c5526a037f3086f0f07
• Workflow run: 30771081881
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head fa3a30bda3b3209025d55c5526a037f3086f0f07.

• Head SHA: fa3a30bda3b3209025d55c5526a037f3086f0f07

• Workflow run: 30771081881

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: requirements-property.txt"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: requirements-property.txt"]
  R1 --> V1["required checks"]

Loading

[seonghobae]

Reviewed the exact Dependabot head. The change is confined to the generated property-testing lock and updates Hypothesis from 6.156.6 to 6.164.0 with its published hashes; no production code, workflow permission, or runtime dependency changes are included. Tests, Fuzz, Security, and Security Scan pass. The remaining Semgrep failure is the pre-existing base finding set repaired by #76, so auto-merge must wait for a rebased green current head.

[seonghobae]

@dependabot rebase

Rebase onto the integrated security/Atheris prerequisite base fix/atheris-interpreter-lock (cfd42f309ea39a189635ff8ba573c5d3b0e332ba). Treat all earlier checks and approvals as stale; rerun exact-head validation and require a fresh independent approval before merge.

[dependabot]

The base commit for this pull request has not changed.

[seonghobae]

@opencode-agent @cwl-noema-review

Review exact current contributor head b5780716c07fc16391e3a525917786ead065dc60 against exact live base 3703d0da9823b8258a0be94f1801aa5d61bfad9f. All repository-local Tests, Security, and Fuzz workflows are terminal-success on this exact head. Treat predecessor-head reviews, approvals, requested changes, and checks as historical. Report only current-head actionable findings; model evidence is not qualifying independent approval.

[seonghobae]

Closed by autonomous commercial loop: draft dependency/tooling PR with CHANGES_REQUESTED or stack base risk. Prefer Dependabot re-open against current main after #111–#114 land, rather than carrying long-lived draft dep branches. (build(deps): bump hypothesis from 6.156.6 to 6.164.0)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.