chore(deps): bump pydantic-settings from 2.13.1 to 2.14.2 in /envs/qed_math_env#915
Conversation
Bumps [pydantic-settings](https://github.com/pydantic/pydantic-settings) from 2.13.1 to 2.14.2. - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](pydantic/pydantic-settings@v2.13.1...v2.14.2) --- updated-dependencies: - dependency-name: pydantic-settings dependency-version: 2.14.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Scope: native Dependabot lockfile bump — pydantic-settings 2.13.1 → 2.14.2. Transitive dep (pulled in by mcp 1.26.0), lock-only change to envs/qed_math_env/uv.lock (+3/-3). No source, docs, config, or pyproject.toml changes.
Automated Checks
- Lint: PASS (for this PR).
.claude/hooks/lint.shexits non-zero, but only on ~20 pre-existingenvs/**files (chat_env, opencode_env, repl_env, …); none isqed_math_env, and.lock/TOML files aren't linted at all. Not introduced by this PR. - Debug code: CLEAN (for this PR).
check-debug.shfindings are all pre-existingsrc/items (docker test prints, CLI TODOs); nothing in this diff.
Dependency-bump verification
- ✅ Security fix (positive signal). 2.13.1 carries
GHSA-4xgf-cpjx-pc3j(symlink out-of-tree file read +secrets_dir_max_sizebypass inNestedSecretsSettingsSourcewithsecrets_nested_subdir=True),fixed_in: ['2.14.2']; 2.14.2 has no known vulns. (This env doesn't use that source, so exposure was low — but the upgrade is still net-positive.) - ✅ Hashes verified against PyPI (match). wheel
a20c97b3…9440(61 715 B), sdistc19dd64b…4a5f(237 700 B); bothyanked: false. - ✅ Lock consistent.
uv lock --check --project envs/qed_math_env→ resolved 143 packages, exit 0.revision = 3unchanged. - ✅ Clean single-package bump. Full package-set diff: 142 → 142 packages, no adds/removes; only
pydantic-settingsversion changed. - ✅ Transitive → lock-only is correct. Not a direct dep in
pyproject.toml, so Dependabot correctly leftpyproject.tomluntouched. - ✅ Constraints satisfied. env
requires-python >=3.10OK; depspydantic>=2.7.0(locked 2.12.5),python-dotenv>=0.21.0(1.2.2),typing-inspection>=0.4.0(0.4.2) all satisfied; no new deps introduced. - ✅ No index-source flip. Unlike most native Dependabot env-lock PRs, this env's lock was already fully on
pypi.org/simple(149/149, 0 HF-mirror) at base — no provenance/reproducibility concern this time.
Open RFCs Context
RFCs 000/001/002/003/005 = In Review, 010 = Draft, 004 = rubrics/rewards. None govern Python packaging / dependency management / lockfiles → no RFC surface touched.
Tier 1: Fixes Required
None. No mechanical/lint/debug/type/security issues introduced.
Tier 2: Alignment Discussion
Principle Conflicts: None identified. A transitive lockfile bump touches no principle/invariant (Gymnasium API signatures, rewards-in-env, client-server separation, MCP/WebSocket boundaries all untouched).
RFC Conflicts: None identified.
Process note (recurring, not a blocker):
ALIGNMENT FLAG: Dependabot exclude-paths: ["envs/**"] isn't scoping out native uv PRs under envs/
- Principle/RFC at stake: none (repo dependency-management policy, not a design principle/invariant)
- The concern:
.github/dependabot.ymlconfigures theuvupdater withdirectory: "/"+exclude-paths: ["envs/**"], whose clear intent is to keep Dependabot from opening PRs forenvs/**.exclude-pathsis a valid, supported key (GitHub, Aug 2025) that "applies before manifest parsing," andenvs/**relative to/should matchenvs/qed_math_env/uv.lock. Yet this nativedependabot/uv/envs/qed_math_env/…PR still edits that lockfile — so the exclusion isn't taking effect for theuvecosystem (limitation or glob mismatch). The intended path for env bumps is the aggregatecodex/dependabot-envs-*roll-ups. Seen on prior native env-lock PRs too, so the team may already be aware. - Suggested reviewer: @burtenshaw (authored the
uv/exclude-pathsscoping in.github/dependabot.yml, commit 5f499da)
Summary
- 0 mechanical issues to fix
- 1 process point for human review (Dependabot
exclude-pathsnot scopinguvenv PRs; @burtenshaw) - 0 RFC conflicts
Technically the bump is clean, verified, and a net security improvement — safe to merge on its merits.
Sent by Cursor Automation: Pre-review
| [[package]] | ||
| name = "pydantic-settings" | ||
| version = "2.13.1" | ||
| version = "2.14.2" |
There was a problem hiding this comment.
Verified against PyPI: wheel a20c97b3…9440 (61 715 B) and sdist c19dd64b…4a5f (237 700 B) match the locked hashes; both yanked: false. This is a security fix — 2.13.1 carries GHSA-4xgf-cpjx-pc3j (symlink out-of-tree read + secrets_dir_max_size bypass in NestedSecretsSettingsSource), fixed in 2.14.2 (no known vulns). uv lock --check passes and the dep is transitive (via mcp 1.26.0), so this lock-only change with no pyproject.toml edit is correct.
|
Closed in favor of aggregate Dependabot PR #921. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps pydantic-settings from 2.13.1 to 2.14.2.
Release notes
Sourced from pydantic-settings's releases.
... (truncated)
Commits
d703bd7Prepare release 2.14.2 (#890)e95c30bPrepare release 2.14.1 (#859)0c87345Fix field namedclsconflicting with classmethod parameter (#858)7bd0072Bump the python-packages group with 2 updates (#856)b03e573Bump the github-actions group with 3 updates (#853)eaa3b43Bump the python-packages group with 5 updates (#854)9f95615Bump the python-packages group with 4 updates (#850)8916beePrepare release 2.14.0 (#848)39e551cFix CLI descriptions lost underpython -OOby falling back to `json_schema_...9ed7f48Bump the python-packages group with 4 updates (#847)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Lockfile-only transitive dependency upgrade with no code changes; it applies a targeted security fix rather than altering app behavior.
Overview
Updates
pydantic-settingsinenvs/qed_math_env/uv.lockfrom 2.13.1 to 2.14.2 (sdist/wheel URLs and hashes only). No application source changes.2.14.2 is a security patch: it stops
NestedSecretsSettingsSourcewithsecrets_nested_subdir=Truefrom following symlinks outsidesecrets_dir(GHSA-4xgf-cpjx-pc3j). In this env the package is a transitive dependency (e.g. viamcp), and the repo does not reference nested-secrets settings APIs directly.Reviewed by Cursor Bugbot for commit d5e572b. Bugbot is set up for automated code reviews on this repo. Configure here.