Skip to content

VLN-1341: remediate missing-dependency-cooldown#1551

Merged
tconley1428 merged 2 commits into
mainfrom
camper/missing-dependency-cooldown-finding-cooldown-sdk-python
May 22, 2026
Merged

VLN-1341: remediate missing-dependency-cooldown#1551
tconley1428 merged 2 commits into
mainfrom
camper/missing-dependency-cooldown-finding-cooldown-sdk-python

Conversation

@picatz
Copy link
Copy Markdown
Contributor

@picatz picatz commented May 21, 2026

🏕️ This pull request was created by camper, an automated security campaign tool.

Finding

Rulemissing-dependency-cooldown
SeverityHIGH
Repositorytemporalio/sdk-python
TicketVLN-1341

Summary

  • pyproject.toml: Updated [tool.uv] to change exclude-newer from "1 week" to "2 weeks" and left all other settings in that section unchanged.
  • .github/dependabot.yml: Added Dependabot configuration with uv and github-actions ecosystems, each set to weekly schedule, cooldown.default-days: 14, and open-pull-requests-limit: 0.

Instructions

  • Approve to merge this fix
  • Request changes to trigger a new remediation attempt
  • /camper rebase — rebase onto the base branch
  • /camper close — close this PR without merging
  • /camper retry — close and retry with a new fix

@picatz picatz requested a review from a team as a code owner May 21, 2026 17:07
openai-agents>=0.17.1 is newer than the 2-week exclude-newer cooldown
window, causing uv resolution to fail.
@tconley1428 tconley1428 merged commit 4d6348e into main May 22, 2026
42 of 45 checks passed
@tconley1428 tconley1428 deleted the camper/missing-dependency-cooldown-finding-cooldown-sdk-python branch May 22, 2026 17:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants