Repository navigation
build(deps): bump portalocker from 2.7.0 to 3.2.0 - #315
Closed
dependabot[bot] wants to merge 143 commits into
Closed
dependabot[bot] wants to merge 143 commits into
dependabot[bot] wants to merge 143 commits into
Conversation
…urity/dependabot-fixes
Align the Python intake and PowerShell watcher on vault-root delivery, duplicate detection, and collision-safe moves. Update related docs to reflect the root pipeline and add targeted Phone Link tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Introduce tooling to resolve OpenRouter API secrets from 1Password and run OpenRouter agents. Adds resolve_openrouter_secret.py, an openrouter.env template and hygiene policy, a Python runtime helper (openrouter_runtime.py) and CLI entry scripts (start_*.py) plus PowerShell wrappers (Start-*.ps1, Use-OpenRouterEnv.ps1). Includes tests for the runtime and sparkseed, new sparkseed/source files, and several daily note updates and a large session transcript. These changes enable op-run-based execution of codex/claude with env files synthesized from 1Password references.
… tri-part structure
…to existing vault systems
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Bumps [requests](https://github.com/psf/requests) from 2.32.5 to 2.33.1. - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.1) --- updated-dependencies: - dependency-name: requests dependency-version: 2.33.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#293) Updates the requirements on [python-dotenv](https://github.com/theskumar/python-dotenv) to permit the latest version. - [Release notes](https://github.com/theskumar/python-dotenv/releases) - [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md) - [Commits](theskumar/python-dotenv@v1.0.1...v1.2.2) --- updated-dependencies: - dependency-name: python-dotenv dependency-version: 1.2.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [crewai](https://github.com/crewAIInc/crewAI) from 1.14.1 to 1.14.2. - [Release notes](https://github.com/crewAIInc/crewAI/releases) - [Commits](crewAIInc/crewAI@1.14.1...1.14.2) --- updated-dependencies: - dependency-name: crewai dependency-version: 1.14.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-Authored-By: Copilot <198982749+Copilot@users.noreply.github.com>
Reorganize GRIMOIRE entries into a caution folder and add a folder index file. Add ARISE-v0.1 (individual emergence) and update AWAKEN, ORIENT and RISE docs to reflect pairing (ARISE→AWAKEN, RISE→REPORT), persona naming, and external-agent commit conventions. Expand VAULT-CONVENTIONS with an adopted Protocol Suite table and key conventions. Add a CodeQL config file and reference it from the CodeQL workflow. Update .gitignore with local project folders, remove a .gemini MEMORY note, adjust date metadata in the daily note, and expand SECURITY.md with metadata and reporting guidance. Co-Authored-By: Copilot <198982749+Copilot@users.noreply.github.com> Signed-off-by: Logan Finney <loganfinney27@gmail.com>
Add GitBook AI insights documentation (three new markdown pages) and a .gitbook stub. Update Obsidian community plugins list and rename .Oranus/* to .uranus/*. Expand ARISE.md into a v1.0 protocol (ARISE) and integrate ARISE/ARISE v0.1 references into CONSTITUTION.md, REPORT.md, RISE.md, and VAULT-CONVENTIONS.md. VAULT-CONVENTIONS.md now documents protocol pairs (A pair: ARISE→AWAKEN, R pair: RISE→REPORT) and updates the protocol registry. Also add SBF.md metadata. Co-Authored-By: Copilot <198982749+Copilot@users.noreply.github.com> Signed-off-by: Logan Finney <loganfinney27@gmail.com>
Rolled over incomplete to-dos to 2026-04-23.
Vault ingest pipeline initialized.
Mark multiple protocols as approved and update status fields (ARISE, AWAKEN, ORIENT, REPORT, RISE, CONFERENCE, CONVENE, CONTEXT). Add full CONFERENCE v1.0 doc and CONTEXT v1.0 doc plus v0.1 drafts (CONTEXT-v0.1, CONVENE-v0.1), and promote CONVENE.md to v1.0. Add several folder-index MOC files (audio.md, docs.md, other.md, images.md, screenshots.md, PHONE-LINK, AI-CAPTURES) and perform a set of README/SIGNAL file renames/moves. Update DECISIONS with a PR Loop Audit remediation entry and adjust VAULT-CONVENTIONS to reflect new protocol statuses and a workflow masking note; remove the old context.md. Editorial fixes and organizational tidy-up across the vault. Co-Authored-By: Copilot <198982749+Copilot@users.noreply.github.com> Signed-off-by: Logan Finney <loganfinney27@gmail.com>
- Prune lifecycle vocabulary to 3 reachable states - Consolidate flat labels to namespaced (review/pending, merge/auto, etc.) - Add probe/example prefix classification (low-risk) - Comment out review triggers by default (configurable) - Document human-only lifecycle states Decision 24 in DECISIONS.md
Co-Authored-By: Copilot <198982749+Copilot@users.noreply.github.com> Signed-off-by: Logan Finney <loganfinney27@gmail.com>
Bumps [portalocker](https://github.com/wolph/portalocker) from 2.7.0 to 3.2.0. - [Release notes](https://github.com/wolph/portalocker/releases) - [Changelog](https://github.com/wolph/portalocker/blob/develop/CHANGELOG.rst) - [Commits](wolph/portalocker@v2.7.0...v3.2.0) --- updated-dependencies: - dependency-name: portalocker dependency-version: 3.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
|
Closing automatically: stale bot PR, not merge-clean, and older than the allowed age threshold. A fresh bot PR can be regenerated later if the update is still desired. |
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
|
The files' contents are under analysis for test generation. |
✅ Precogs scan complete — No security issues foundCommit
✅ Passed checks (3)
💬 Precogs.ai · Detect. Fix. Merge. |
🛡️ HAIEC Attestation Readiness: 60 → 60 (0)Frameworks Evaluated: SOC2, ISO27001, PCI-DSS HAIEC scans your repository for compliance evidence across multiple frameworks simultaneously.
|
| Category | Examples |
|---|---|
| Prompt Injection | User input reaching system prompts |
| Data Leakage | PII/secrets in AI responses |
| Access Control | Missing auth on AI endpoints |
| 82+ AI Security Rules | OWASP Top 10 for LLMs |
🤖 Automated by HAIEC — AI Compliance & Security Platform | Documentation | Support
🔍 SEO Review — 4 issues found🔴 Critical (4)
✅ 24 checks passed
Rule set |
🔍 CodeRifts — API Contract CheckNo OpenAPI schemas found in this repository. While no schema is found, this check completes neutral, which GitHub treats as non-blocking — so if CodeRifts is a required status check, it is not currently blocking anything on this branch. To get started, either:
schema:
- path/to/your/openapi.yaml📖 Documentation · 💬 Get help ☁️ You're on the Free plan. Pro features (risk scoring, governance, deprecation enforcement) are included during the beta. Lock in Pro pricing → |
|
🤖 Review skipped: Repository rate limit exceeded. Free accounts are limited to 2 reviews per 4 hours per repository. Upgrade to a paid plan for unlimited reviews. |
🛠️ What to fix
QWED Security Verification Report14 files scanned | 11 blocked | 2 warnings | 0 info | 0 suppressed | 1 verified Blocked Findings
Advisory Warnings
Engines
Verified Files
Verified by QWED — deterministic security verification. No LLM used. Verification Context v1.0{
"spec_version": "1.0",
"object": {
"formal_statement": "LAF-US/IDAHO-VAULT@3a3bb51c (PR #315) is safe to merge"
},
"context": {
"interpretation": {
"theory": "deterministic security verification",
"logic": "evidence-context-policy pipeline"
},
"proof": {
"verifier": "QWED Security",
"verifier_version": "qwed-security-ruleset/1",
"configuration": {
"repo": "LAF-US/IDAHO-VAULT",
"head_sha": "3a3bb51c56ae5ac2f9acd9bfcbecfc8c22435b74",
"files_scanned": 14
},
"theory_scope": "PR security scan against QWED deterministic rule set",
"trusted_dependencies": [
"qwed-security"
],
"outcome_treatment": "unknown/timeout/error resolve to UNVERIFIABLE or BLOCKED"
},
"evidence": {
"evidence": {
"status": "BLOCKED",
"agent_message": "PR blocked: 11 execution boundary violation(s) detected.",
"developer_fields": {
"total_blocked": 11,
"total_warnings": 1,
"boundaries_violated": [],
"advisory_checks": [
{
"name": "docker-test-context",
"advisory_only": true,
"constraint_id": "artifact_boundary_ambiguity",
"details": {
"line": 0,
"message": "Test or debug file '!/tests/test_app.py' is present in Docker build context."
}
}
]
},
"is_authoritative": false,
"scan_evidence": {
"repo": "LAF-US/IDAHO-VAULT",
"head_sha": "3a3bb51c56ae5ac2f9acd9bfcbecfc8c22435b74",
"pr_number": 315,
"files_scanned": 14,
"engine_results": 16,
"conclusion": "failure",
"rule_set": "qwed-security-ruleset/1",
"engines": [
"dependency_scan",
"entropy_scan",
"pattern_scan",
"release_boundary"
]
},
"repo": "LAF-US/IDAHO-VAULT",
"head_sha": "3a3bb51c56ae5ac2f9acd9bfcbecfc8c22435b74",
"files_scanned": 14
},
"proof_ref": null
},
"decision": {
"admission": "DENY"
}
},
"verdict": "BLOCKED"
} |
Revieko — PR review
No matching hunks for extensions: .py Full report: HTML · Markdown · JSON Details
— Generated by Revieko · Install GitHub App · Documentation Link details
|
loganfinney27
added
the
risk/—
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps portalocker from 2.7.0 to 3.2.0.
Release notes
Sourced from portalocker's releases.
Commits
7415a5dMerge branch 'release/3.2.0'cb01496Incrementing version to v3.2.0c4f2503fixed small ruff issue0b8e6e5fixed coverage issuee3340admore type error fixescdf9a4bsmall typing fixes47382ferestructured posix locks to use a similar baselock like windowsd57734cfixed small type issue58cdf75Rewrote locking classes for more flexibilityd2b49d7test: reorganize tests into multiple modules with added docstrings and fixturesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)