From 8dbd871f26e6c1f3d280d62d55fcf095e49e9fd1 Mon Sep 17 00:00:00 2001 From: cap experiment Date: Wed, 1 Jul 2026 16:49:18 +0000 Subject: [PATCH 1/2] Relax msgpack and tornado dependency caps Raise the upper bounds on msgpack (<=1.1.2 -> <=1.2.1) and tornado (<=6.5.5 -> <=6.5.7) so downstream consumers (citus regress tests) can pick up security-relevant patch releases while still pinning mitmproxy to a controlled range. Consistent with the fork's existing relaxations of urwid and cryptography. Verified: a real `pipenv lock` of the citus src/test/regress/Pipfile with mitmproxy pointed at this change resolves msgpack==1.2.1 and tornado==6.5.7 while preserving the cryptography==46.0.7 pin. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- pyproject.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index ab0583f302..5d12f2b606 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -45,14 +45,14 @@ dependencies = [ "kaitaistruct>=0.10,<=0.11", "ldap3>=2.8,<=2.9.1", "mitmproxy_rs>=0.12.6,<0.13", # relaxed upper bound here: we control this - "msgpack>=1.0.0,<=1.1.2", + "msgpack>=1.0.0,<=1.2.1", "pydivert>=2.0.3,<=2.1.0; sys_platform == 'win32'", "pyOpenSSL>=24.3,<=27.0.0", "pyparsing>=2.4.2,<=3.3.2", "pyperclip>=1.9.0,<=1.11.0", "ruamel.yaml>=0.18.10,<=0.19.1", "sortedcontainers>=2.3,<=2.4.0", - "tornado>=6.5.0,<=6.5.5", + "tornado>=6.5.0,<=6.5.7", "typing-extensions>=4.13.2,<=4.14; python_version < '3.13'", "urwid>=2.6.14,<=4.0.0", "wsproto>=1.0,<=1.3.2", From 321e6d203cf31e36d59ba8e4f9c6a3c4a5d6ddf0 Mon Sep 17 00:00:00 2001 From: cap experiment Date: Wed, 1 Jul 2026 17:13:26 +0000 Subject: [PATCH 2/2] Sync uv.lock with relaxed msgpack/tornado caps Regenerate uv.lock so uv sync --locked matches the pyproject.toml cap relaxation (msgpack<=1.2.1, tornado<=6.5.7). Only the requires-dist specifiers change; no resolved versions move (1.1.2/6.5.5 still satisfy the widened caps), keeping the fork diff minimal. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- uv.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/uv.lock b/uv.lock index b8ff15b990..ac4cac4dd3 100644 --- a/uv.lock +++ b/uv.lock @@ -1043,7 +1043,7 @@ requires-dist = [ { name = "kaitaistruct", specifier = ">=0.10,<=0.11" }, { name = "ldap3", specifier = ">=2.8,<=2.9.1" }, { name = "mitmproxy-rs", specifier = ">=0.12.6,<0.13" }, - { name = "msgpack", specifier = ">=1.0.0,<=1.1.2" }, + { name = "msgpack", specifier = ">=1.0.0,<=1.2.1" }, { name = "publicsuffix2", specifier = ">=2.20190812,<=2.20191221" }, { name = "pydivert", marker = "sys_platform == 'win32'", specifier = ">=2.0.3,<=2.1.0" }, { name = "pyopenssl", specifier = ">=24.3,<=27.0.0" }, @@ -1051,7 +1051,7 @@ requires-dist = [ { name = "pyperclip", specifier = ">=1.9.0,<=1.11.0" }, { name = "ruamel-yaml", specifier = ">=0.18.10,<=0.19.1" }, { name = "sortedcontainers", specifier = ">=2.3,<=2.4.0" }, - { name = "tornado", specifier = ">=6.5.0,<=6.5.5" }, + { name = "tornado", specifier = ">=6.5.0,<=6.5.7" }, { name = "typing-extensions", marker = "python_full_version < '3.13'", specifier = ">=4.13.2,<=4.14" }, { name = "urwid", specifier = ">=2.6.14,<=4.0.0" }, { name = "wsproto", specifier = ">=1.0,<=1.3.2" },