ci: add security-aware Dependabot updates for Python and GitHub Actions - #3641

Merged

HAYDEN-OAI merged 52 commits into

mainfrom

codex/openai-python-dependabot-security-20260817

Aug 27, 2026

Commits on Aug 17, 2026

Commits on Aug 18, 2026

Merge main and reconcile security dependency locks
HAYDEN-OAI
committed
05d03fc

Commits on Aug 19, 2026

Merge main and preserve uv-native dependency security
HAYDEN-OAI
committed
253692a
fix: reject untrusted uv lockfile dependency sources
HAYDEN-OAI
committed
86b9b62
fix: gate dependency installs on lock provenance
HAYDEN-OAI
committed
6af5be9
fix: validate dependency artifacts and security update floors
HAYDEN-OAI
committed
69acefe
Merge main into dependency security policy updates
HAYDEN-OAI
committed
70d1ffa
fix:enforce-strict-dependabot-security-dependency-floors
HAYDEN-OAI
committed
3e188b8
fix: validate dependency floors against patched lock releases
HAYDEN-OAI
committed
0b3f84b
fix: reject weakened security floors with unchanged locks
HAYDEN-OAI
committed
d5e8f30
fix: preserve contextual security floors and reject lock downgrades
HAYDEN-OAI
committed
05d1c29
fix: validate root build provenance and preserve security constraints
HAYDEN-OAI
committed
2a4d89e
fix: block dependency source builds and preserve marker-specific security fixes
HAYDEN-OAI
committed
dd2e769
fix(ci): permit reviewed editable roots without building dependencies
HAYDEN-OAI
committed
3860753
fix(ci): reject direct dependency removals in security updates
HAYDEN-OAI
committed
27b0b83
fix(ci): anchor fork build backends to the trusted base
HAYDEN-OAI
committed
2b16120
fix(ci): require protected floors to reach patched releases
HAYDEN-OAI
committed
4d25ed8
fix(ci): preserve marker-specific security floors and trusted source builds
HAYDEN-OAI
committed
f1f729e
fix(ci): defer source builds and support dependency marker membership
HAYDEN-OAI
committed
eb134b8
fix: preserve supported dependency security branches
HAYDEN-OAI
committed
9071f2b
fix(security): require safe published dependency branches
HAYDEN-OAI
committed
05c414f
fix(security): preserve bounds when dependency locks are unchanged
HAYDEN-OAI
committed
f012570

Commits on Aug 20, 2026

Commits on Aug 24, 2026

Commits on Aug 25, 2026

fix: remove unused dependency reachability state
HAYDEN-OAI
committed
a4091b1
Preserve semantic marker and wildcard security bounds
HAYDEN-OAI
committed
8ca4367
Validate the complete relinked Agents dependency lock
HAYDEN-OAI
committed
03dc92e
Preserve exact Python marker security semantics
HAYDEN-OAI
committed
439a5dd
Constrain Agents relinking to reviewed dependency versions
HAYDEN-OAI
committed
8ff2861
fix(ci): preserve reviewed no-build Agents dependencies
HAYDEN-OAI
committed
51f3e20
fix(ci): type reviewed Agents dependency artifacts
HAYDEN-OAI
committed
1c6dc30
fix: address dependency security review feedback
HAYDEN-OAI
committed
b34e719
fix: align dependency bounds and marker evaluation
HAYDEN-OAI
committed
232794d
fix: preserve shared extra and platform marker semantics
HAYDEN-OAI
committed
21e42f0
fix: preserve post-release floors and marker orientation
HAYDEN-OAI
committed
e883403
Merge branch 'main' into codex/openai-python-dependabot-security-20260817
HAYDEN-OAI
authored
8be8386
fix: preserve dependency audiences and PEP 440 marker versions
HAYDEN-OAI
committed
923053f
fix: preserve complete PEP 440 security marker domains
HAYDEN-OAI
committed
e2c40e5
fix: harden security dependency markers and source builds
HAYDEN-OAI
committed
2e94eda
fix: preserve security marker release and membership domains
HAYDEN-OAI
committed
210bf74
fix: preserve complete dependency security marker boundaries
HAYDEN-OAI
committed
eedfd70