Skip to content

Merge dev into main - #132

Merged
JE-Chen merged 22 commits into
mainfrom
dev
Nov 1, 2026
Merged

JE-Chen merged 22 commits into
mainfrom
dev

Conversation

@JE-Chen

@JE-Chen JE-Chen commented Nov 1, 2026

Copy link
Copy Markdown
Member

Merges dev into main, including the Dependabot security fixes.

Pull requests in this merge

Commits

  • 05b44f6 fix(deps): patch the dependencies named in Dependabot security alerts
  • 769529e docs: add a security policy
  • eb012d7 docs: add the current code review record
  • 0ffaa12 fix(ci): preserve conditional dependencies and build tools in locks
  • 6ec7fd2 fix(ci): preserve conditional dependencies and build tools in locks
  • 8c64b02 fix(ci): preserve conditional dependencies and build tools in locks
  • d7678fc build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2
  • 6db4132 build(deps): bump boxsdk in /.github/requirements
  • b83e1ca build(deps): bump boto3 in /.github/requirements
  • dfc33da build(deps): update boxsdk requirement
  • 5e4ae2a build(deps): bump opentelemetry-sdk in /.github/requirements
  • 3d6c0a3 build(deps): update opentelemetry-sdk requirement
  • 879e476 build(deps): update opentelemetry-api requirement

dependabot Bot and others added 22 commits October 14, 2026 11:18
Updates the requirements on [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python) to permit the latest version.
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.45.0...v1.45.1)

---
updated-dependencies:
- dependency-name: opentelemetry-api
  dependency-version: 1.45.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Updates the requirements on [opentelemetry-sdk](https://github.com/open-telemetry/opentelemetry-python) to permit the latest version.
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.45.0...v1.45.1)

---
updated-dependencies:
- dependency-name: opentelemetry-sdk
  dependency-version: 1.45.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [opentelemetry-sdk](https://github.com/open-telemetry/opentelemetry-python) from 1.45.0 to 1.45.1.
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.45.0...v1.45.1)

---
updated-dependencies:
- dependency-name: opentelemetry-sdk
  dependency-version: 1.45.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Updates the requirements on [boxsdk](https://github.com/box/box-python-sdk) to permit the latest version.
- [Release notes](https://github.com/box/box-python-sdk/releases)
- [Changelog](https://github.com/box/box-python-sdk/blob/main/CHANGELOG.md)
- [Commits](box/box-python-sdk@v10.17.0...v10.17.1)

---
updated-dependencies:
- dependency-name: boxsdk
  dependency-version: 10.17.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [boto3](https://github.com/boto/boto3) from 1.43.108 to 1.43.109.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.108...1.43.109)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.109
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [boxsdk](https://github.com/box/box-python-sdk) from 10.17.0 to 10.17.1.
- [Release notes](https://github.com/box/box-python-sdk/releases)
- [Changelog](https://github.com/box/box-python-sdk/blob/main/CHANGELOG.md)
- [Commits](box/box-python-sdk@v10.17.0...v10.17.1)

---
updated-dependencies:
- dependency-name: boxsdk
  dependency-version: 10.17.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.1 to 7.0.2.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@043fb46...cf430e0)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
…_actions/dev/actions/upload-artifact-7.0.2

build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2
…v/boxsdk-gte-10.17.1-and-lt-11

build(deps): update boxsdk requirement from <11,>=10.17.0 to >=10.17.1,<11
…v/opentelemetry-sdk-gte-1.45.1

build(deps): update opentelemetry-sdk requirement from >=1.45.0 to >=1.45.1
…t-github/requirements/dev/boxsdk-10.17.1

Update dependency pins and preserve supported CI environments
Record the reviewer, the review standard, and the hotspot findings for this tree.
Record how to report a vulnerability and the operator trust boundary. Point the code review at the shared workspace standard, and link the policy from each README language.
integration.txt: setuptools 84.2.1, certifi 2026.10.23, pyasn1 0.6.5;
integration.in raises the setuptools and opentelemetry-api floors to the
first fixed releases. publish.txt: setuptools 84.2.1, certifi 2026.10.23.
Cut-off moved to 2026-10-25; pyasn1 0.6.5 is exempt from it.
…lnerabilities

fix(deps): patch the dependencies named in Dependabot security alerts
@codacy-production

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results
Complexity 0
Duplication 0

View in Codacy

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

@sonarqubecloud

sonarqubecloud Bot commented Nov 1, 2026

Copy link
Copy Markdown

@JE-Chen
JE-Chen merged commit a69a711 into main Nov 1, 2026
67 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant