Repository navigation
Forward-merge release/0.10 into main - #1496
Merged
willkill07 merged 2 commits intoOct 24, 2026
Merged
Conversation
#### Overview Resolve the Python, npm, and Rust dependency audit failures on `release/0.10` using the same package versions as NVIDIA#1490 and the Tokio fix already present in its base from NVIDIA#1481. - [x] I confirm this contribution is my own work, or I have the right to submit it under this project's license. - [x] I searched existing issues and open pull requests, and this does not duplicate existing work. #### Details - Update filelock to 4.2.4 and virtualenv to 21.14.13. This release branch has no LiteLLM dependency, so the filelock override from NVIDIA#1490 is unnecessary. - Update body-parser to 2.4.0, fast-uri to 3.1.9, qs to 6.16.1, undici to 8.12.2, and zod to 4.6.6; preserve the OpenClaw version with the same overrides as NVIDIA#1490. - Require Tokio 1.53.3 across all workspace consumers, preserving existing features and default-feature settings, to resolve RUSTSEC-2026-0386 for workspace builds and downstream consumers. - Regenerate the Python, Node.js, and Rust attributions with the repository workflows, using CI-pinned cargo-about 0.9.1 for Rust. Validation: - `uv audit --locked`, `npm audit --audit-level=low`, and `cargo deny --locked --all-features check` passed. - `NEMO_RELAY_LOG_STDERR_FORMAT=human just test-rust`: 5,942 passed, one skipped. - Repository pre-commit hooks passed, including targeted rechecks after attribution generation. Checks covered lockfile freshness, FFI header synchronization, benchmark fmt/clippy, license policy, documentation links, and generated attributions. - Verified the seven updated Python/npm package records match NVIDIA#1490 exactly, and all 20 Tokio dependency entries require `^1.53.3` with unchanged feature settings. - Separate Python, Node.js, and Go suites were not run; binding APIs and implementations are unchanged. #### Where should the reviewer start? Start with `package.json` and the Python/npm lockfile changes for NVIDIA#1490 parity, then `Cargo.toml` and Tokio dependency inheritance for the NVIDIA#1481 backport. #### Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to) - Relates to: none - Backports dependency updates from NVIDIA#1490 and the Tokio security fix from NVIDIA#1481 to `release/0.10`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Chores** * Updated third-party dependency versions, including Tokio and several JavaScript and Python packages. * Standardized Tokio version management across the project while preserving existing feature selections. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Will Killian <wkillian@nvidia.com>
Resolve forward-merge conflicts by retaining main, which already contains the release dependency updates. The resulting tree is identical to the first parent. Signed-off-by: Will Killian <wkillian@nvidia.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Forward-merge triggered by push to release/0.10 that creates a PR to keep main up-to-date. If this PR is unable to be immediately merged due to conflicts, it will remain open for the team to manually merge. See forward-merger docs for more info.