[aravhawk]

Summary

Lockfile-only security update (uv.lock); no pyproject.toml changes. All affected packages are transitive.

Package	Before	After	Advisory	Severity
multidict	6.7.1	6.9.1	GHSA-54p9-h82j-f925 (fixed 6.9.1)	MODERATE
opentelemetry-api	1.42.1	1.45.2	GHSA-xcq7-p3pf-p88h (fixed 1.45.1)	MODERATE

• multidict comes in via aiohttp/yarl from daytona (dev extra). It stays on the 6.x line instead of moving to 7.x.
• opentelemetry-api comes in via daytona (dev extra). Its otel siblings move with it because they pin the api version exactly: sdk, proto, and exporter-otlp-proto-{common,http} go to 1.45.2; semantic-conventions, instrumentation, instrumentation-aiohttp-client, and util-http go to 0.66b2. exporter-http-transport and exporter-otlp-common 0.66b2 are new, required deps of exporter-otlp-proto-http 1.45.2.
• Consensus/numerics untouched: torch 2.12.0, numpy 2.4.6, setuptools 81.0.0, virtualenv 21.14.9, and libp2p 0.6.0 are unchanged.
• CI (pip): pip install -e ".[dev]" doesn't use uv.lock and already installs fixed multidict/otel versions. This PR brings the uv lock in line with that.

Not fixed: zeroconf (blocked by libp2p)

zeroconf 0.147.4 has five MODERATE advisories: GHSA-9663-mqmp-p9mm (fixed 0.149.12), GHSA-9pgc-3ccv-5297 (0.149.5), GHSA-phvx-9mgw-67r5 (0.149.6), GHSA-qc2x-6f54-m6h9 (0.149.16), and GHSA-rfg2-pjw2-56x2 (0.149.7). libp2p 0.6.0 requires zeroconf>=0.147.0,<0.148.0; the first libp2p that allows a fixed zeroconf is 0.7.0 (zeroconf>=0.149.16,<0.151.0). Fixing zeroconf therefore needs a libp2p upgrade, which is out of scope here.

Watch items

• libp2p 0.6.0: GHSA-hmj8-5xmh-5573 (HIGH). Affects libp2p <= 0.7.0 and has no fixed release yet. When a fixed libp2p ships, upgrade it (deliberately, with determinism checks) and bump zeroconf to >= 0.149.16 in the same change.

Verification

In the locked env (uv sync --locked --extra dev):

• ruff check: pass
• ruff format --check: pass (118 files)
• mypy src scripts: pass (63 files)
• pytest tests: 343 passed
• pip-audit on uv export --all-extras: multidict and opentelemetry-api findings cleared, no new findings. Remaining findings are pre-existing and out of scope (zeroconf, libp2p, setuptools, torch, virtualenv).

All advisories verified on GitHub Advisory DB and OSV. Signed commit 2fecf6f. Separate from #5.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• uv.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 8fb7a441-9b8c-4690-bd99-4919d658ecdc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T20:56:24.027933Z	5a075dc	New commits
🔒 Security Review	✅ Completed 2026-10-30T14:35:40.679649Z	2fecf6f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.