You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
security(strix): regenerate CI lock for AnyIO 4.14.2 #2321
Fresh owner sweep after this issue was opened found that the complete AnyIO security delta already has a canonical open owner: #2278chore(deps): bump anyio from 4.14.0 to 4.14.2, exact head 8a5251bf409fe84b3dd0cba1e48992f5b8d9eda5.
#2278 already carries exactly the same verified finding and fix scope:
protected base main@e6334e229581a918e2f22de18733b76fa65d7e71;
one effective changed path: requirements-strix-ci-hashes.txt;
AnyIO 4.14.0 -> 4.14.2, +3/-3;
the same three CVEs: CVE-2026-63374, CVE-2026-64847, CVE-2026-63349;
exact acceptance requires current-head Python Security/SAST/Security/CodeQL GREEN plus qualifying independent approval before protected integration.
The new hosted failure on #2291 (Python Security run 35512696949, pip-audit job 106155330569) is additional reproduction evidence for #2278, not a second ownership lane. No delta, test, fixture, contract, or evidence belongs uniquely to this issue.
Closing this issue as a verified duplicate/full-successor case is therefore consistent with the single-writer rule. #2278 remains open and authoritative; do not create a second lock-repair implementation here.
Activity