Skip to content

security(strix): regenerate CI lock for AnyIO 4.14.2 #2321

Closed as duplicate

Description

@seonghobae

Superseded by existing canonical owner

Fresh owner sweep after this issue was opened found that the complete AnyIO security delta already has a canonical open owner: #2278 chore(deps): bump anyio from 4.14.0 to 4.14.2, exact head 8a5251bf409fe84b3dd0cba1e48992f5b8d9eda5.

#2278 already carries exactly the same verified finding and fix scope:

  • protected base main@e6334e229581a918e2f22de18733b76fa65d7e71;
  • one effective changed path: requirements-strix-ci-hashes.txt;
  • AnyIO 4.14.0 -> 4.14.2, +3/-3;
  • the same three CVEs: CVE-2026-63374, CVE-2026-64847, CVE-2026-63349;
  • exact acceptance requires current-head Python Security/SAST/Security/CodeQL GREEN plus qualifying independent approval before protected integration.

The new hosted failure on #2291 (Python Security run 35512696949, pip-audit job 106155330569) is additional reproduction evidence for #2278, not a second ownership lane. No delta, test, fixture, contract, or evidence belongs uniquely to this issue.

Closing this issue as a verified duplicate/full-successor case is therefore consistent with the single-writer rule. #2278 remains open and authoritative; do not create a second lock-repair implementation here.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions