Repository navigation
Bump authlib from 1.6.9 to 1.6.11 in /envs/connect4_env - #555
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
Dependencies
python:uv
|
No reviewable files after applying ignore patterns. |
meta-cla
Bot
added
the
CLA Signed
Darktex
left a comment
Darktex
left a comment
There was a problem hiding this comment.
Note: This is an automated review by Claude Code, not a human review.
Dep-only bump; diff is confined to envs/connect4_env/uv.lock.
Two security fixes included:
- 1.6.10: unvalidated
redirect_uriopen-redirect onUnsupportedResponseTypeError - 1.6.11: CSRF in Starlette OAuth client when
cacheis configured
All hashes present in the lock file. No source, no Dockerfile, no API surface changes. Lint clean, no debug artifacts introduced.
No invariant or principle concerns. Safe to merge.
Automated review by Claude Code | Learn more
Darktex
left a comment
Darktex
left a comment
There was a problem hiding this comment.
Note: This is an automated review by Claude Code, not a human review.
Patch bump: authlib 1.6.9 → 1.6.11 in envs/connect4_env/uv.lock. Both intermediate releases are security fixes (1.6.11 CSRF in Starlette OAuth client; 1.6.10 open-redirect on UnsupportedResponseTypeError), worth taking.
Flag for reviewer awareness (not blocking): the diff is larger than a typical patch bump. Beyond the authlib entry, the lock file adds ~20 new package entries — gradio, gradio-client, brotli, pydub, pandas, orjson, jinja2, safehttpx, etc.
I verified the root cause: these are not new direct dependencies, they are transitive deps of openenv-core (which has gradio>=4.0.0 in its base dependencies). connect4_env requires openenv-core[core]>=0.2.2, so openenv-core's base deps — including gradio — are in scope. The prior lock (revision 2) simply hadn't resolved them; this PR bumps the lock to revision 3 with expanded platform markers, and uv now materializes the full transitive graph.
Tier 1: authlib sdist/wheel hashes are consistent. No pyproject.toml change. Large transitive addition is explained by the lock-format upgrade, not a concealed direct-dep addition.
Tier 2: No alignment concerns. However, if the team would prefer dependabot PRs to be scoped more tightly (so security bumps don't bundle large lock-format rewrites), consider regenerating each env's lock file in a dedicated PR to separate signal from noise.
Automated review by Claude Code | Learn more
Darktex
left a comment
Darktex
left a comment
There was a problem hiding this comment.
Note: This is an automated review by Claude Code, not a human review.
Only envs/connect4_env/uv.lock is touched. The authlib bump is from 1.6.9 to 1.6.11; hashes match the canonical PyPI release. Extra lock churn (revision bump, expanded resolution markers, audioop-lts) is uv solver re-resolution noise — no new direct dependencies introduced.
Automated review by Claude Code | Learn more
0b4c238 to
2be70eb
Compare
Bumps [authlib](https://github.com/authlib/authlib) from 1.6.9 to 1.6.11. - [Release notes](https://github.com/authlib/authlib/releases) - [Changelog](https://github.com/authlib/authlib/blob/v1.6.11/docs/changelog.rst) - [Commits](authlib/authlib@v1.6.9...v1.6.11) --- updated-dependencies: - dependency-name: authlib dependency-version: 1.6.11 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
2be70eb to
d84c3cf
Compare
Darktex
left a comment
Darktex
left a comment
There was a problem hiding this comment.
Automated dependency bump review: patch-level version bump of authlib (1.6.9 -> 1.6.11) in /envs/connect4_env. Diff is confined to envs/connect4_env/uv.lock only — no source, config, or Dockerfile changes. The additional lock-file churn is normal output of uv lock regeneration. Approving.
Darktex
left a comment
Darktex
left a comment
There was a problem hiding this comment.
Patch/minor bump of authlib (1.6.9 → 1.6.11) — includes CSRF fix in Starlette OAuth client. Diff scope limited to uv.lock for the env. LGTM.
Darktex
left a comment
Darktex
left a comment
There was a problem hiding this comment.
Note: This is an automated review by Claude Code, not a human review.
Bumps authlib from 1.6.9 to 1.6.11 in envs/connect4_env/uv.lock.
- Only
envs/connect4_env/uv.lockis modified — no source code touched. - 1.6.11 is a patch release containing bugfixes and minor security hardening; no breaking API changes in the 1.6.x line.
- All 6 CI checks (build, tests, lint) are green.
- authlib is a transitive/test-time dep in this env; no direct usage in
connect4_envsource.
Automated review by Claude Code | Learn more
|
Superseded by merged rollup PR #562, which includes this dependency update along with the rest of the current Dependabot environment queue. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Bumps authlib from 1.6.9 to 1.6.11.
Release notes
Sourced from authlib's releases.
Changelog
Sourced from authlib's changelog.
Commits
0dc0e5bchore: bump to 1.6.11aa7b8e4Merge commit from fork401a770fix: CSRF issue with starlette clientef09aebchore: release 1.6.103be0846fix: redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError