release: publish Localsetup 4.3.2 - #81
Conversation
…updates Bumps the github-actions group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout) and [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv). Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) Updates `astral-sh/setup-uv` from 8.3.2 to 9.0.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@11f9893...c771a70) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: astral-sh/setup-uv dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.3 to 0.6.4. - [Release notes](https://github.com/pyasn1/pyasn1/releases) - [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst) - [Commits](pyasn1/pyasn1@v0.6.3...v0.6.4) --- updated-dependencies: - dependency-name: pyasn1 dependency-version: 0.6.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Release-Type: patch
github-actions
Bot
added
area/docs
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8d0200a890
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| return set() | ||
| try: | ||
| completed = subprocess.run( | ||
| ["git", "-C", str(repo_root), "check-ignore", "--no-index", "--stdin", "-z"], |
There was a problem hiding this comment.
When a selected domain root contains a tracked file that also matches .gitignore, this --no-index check reports it as ignored because Git's option ignores the index; this checkout already has tracked ignored docs under ls/tools/agentq_transport_client/docs, so a domain covering that tree would silently omit committed source from selected and produce an incomplete digest. Remove --no-index or separately exempt tracked files while still filtering untracked ignored/private files.
Useful? React with 👍 / 👎.
| `REVIEW.md` is the canonical base-branch contract for Localsetup Kilo Code | ||
| reviews. Maintainers must update it in the same change wave when changed review | ||
| surfaces make it stale, keeping its concise, actionable, repository-specific | ||
| regression standard intact. Kilo Code review agents must read and apply | ||
| `REVIEW.md` before reviewing a change; do not assume or invent a Kilo |
There was a problem hiding this comment.
Because the release artifact is built from public_private.public_paths and that list still omits the newly added REVIEW.md, publishing this change ships AGENTS.md with a mandatory review-contract pointer but no corresponding file in the Localsetup public archive. Reviewers or installed-source users working from that archive will hit a broken contract, so add REVIEW.md to the public package surface or keep this instruction out of packaged context.
Useful? React with 👍 / 👎.
| source_commit: 4a139eaa072287c13a7e0efb0e7c30e88511f8d3 | ||
| artifact_sha256: 8fa8629e7b1f4ed1ffdbb89897a1fc32bf3783fd0127598eced1898677fdc406 | ||
| framework_version: 4.3.2 | ||
| source_commit: c2603ff5cb44f796187c33b5e92c6245baf3bb1f |
There was a problem hiding this comment.
In this reviewed commit, the generated artifacts record c2603ff5... even though that commit is not an ancestor of cc751d7...; because the commit subject is release: publish Localsetup 4.3.2 rather than the recognized release-sync subject, a clean CI checkout will regenerate docs from HEAD and then hit the existing git diff --exit-code generated-docs gates. Regenerate the docs/version artifacts from the actual commit shape being published, or preserve the recognized release-sync commit topology.
Useful? React with 👍 / 👎.
Release-Type: patch
Release-Type: none
Release-Type: none
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 174e7c54aa
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
|
||
| _PRIVATE_COMPONENTS = frozenset( | ||
| { | ||
| ".codex", |
There was a problem hiding this comment.
When a domain root covers repo-owned adapter content such as .codex/skills, this component-level deny rule drops every path containing .codex before include rules or Git tracking are considered. That makes the compiled digest silently omit committed adapter skills/files even though adapter-shaped directories are explicitly allowed to contain repository-owned content; narrow the private filter to known runtime subtrees like .codex/runs/logs/tmp or allow explicit/tracked adapter roots through.
Useful? React with 👍 / 👎.
| if stat.S_ISDIR(mode) and _private_reason(child_relative) is None: | ||
| yield from _enumerate_tree(child_path, child_relative) |
There was a problem hiding this comment.
When a selected tree contains a Git-ignored directory such as build/ or dist/, this walks into it before _git_ignored() runs, so a domain rooted at . can fail on unreadable/generated contents or spend unbounded time scanning files that the final workset will silently discard. Probe/prune ignored directories before recursing, while still preserving the later tracked-file exemption for ignored-but-committed files.
Useful? React with 👍 / 👎.
| [[package]] | ||
| name = "pyasn1" | ||
| version = "0.6.3" | ||
| version = "0.6.4" |
There was a problem hiding this comment.
This lockfile-only bump protects uv sync --locked, but package consumers still get metadata with PGPy>=0.6.0 and no pyasn1 floor; because PGPy's recorded dependency on pyasn1 is unconstrained, a pip install into an environment that already satisfies it with 0.6.3 can keep the vulnerable version despite this release's security fix. Add an explicit pyasn1>=0.6.4 project dependency (or equivalent constraint) and regenerate the lock.
Useful? React with 👍 / 👎.
| parsed.port | ||
| except ValueError: | ||
| return False | ||
| return parsed.scheme == "https" and bool(hostname) |
There was a problem hiding this comment.
When artifact freshness metadata is committed for public review, an authoritative_sources URL like https://user:token@example.com/advisory passes this check because only the scheme and hostname are validated. That lets the new validator bless credential-bearing URLs in tracked/public metadata, so reject URLs with username or password components before accepting them.
Useful? React with 👍 / 👎.
Release-Type: patch
Release-Type: none
Release-Type: patch
Release-Type: none
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f25c13aed0
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| source_commit: 4a139eaa072287c13a7e0efb0e7c30e88511f8d3 | ||
| artifact_sha256: 8fa8629e7b1f4ed1ffdbb89897a1fc32bf3783fd0127598eced1898677fdc406 | ||
| framework_version: 4.3.2 | ||
| source_commit: 4b13df4809569858c6e723aae395fdcbfa328c75 |
There was a problem hiding this comment.
In this reviewed f9c5c006... release commit, the generated artifacts record 4b13df480956... as the source commit even though that commit is not in f9c5c006...'s ancestry; fresh evidence is that this line now names 4b13df4, not the earlier source SHA from the existing comment. Because the workflow regenerates docs from the checked-out release commit and then runs git diff --exit-code, publish/CI validation for this release shape will rewrite the provenance back to the actual checked-out commit and fail unless the artifacts are regenerated from the commit topology being published.
AGENTS.md reference: AGENTS.md:L79-L79
Useful? React with 👍 / 👎.
1 participant
Summary
prune-cache: truecompatibilitySecurity
pyasn1 0.6.3 is affected by CVE-2026-59884, CVE-2026-59885, and CVE-2026-59886. Version 0.6.4 is outside the affected ranges and passed OSV, GitHub Advisory, NVD, CISA KEV, deps.dev, and PyPI checks.
Validation
uv lock --checkcheck --ciSupersedes #77 and #80 after merge and publication.