[ericlitman]

Summary

The October dependency update now builds a production image with the patched Python graph. Update LangGraph API/SDK and the OpenTelemetry family, align the API base image, remove its obsolete telemetry pins, and install the hash-verified lock before the generated project installer. Preserve the seven-day package cooldown with a certifi-only exception for the required security release.

The dashboard update merged separately in PR #156.

Evidence

• Before: the generated production install failed because API0.11.1 constrained grpcio below the version required by API0.16.0. Changing only the image tag still failed on vendor OpenTelemetry pins. The project-wide exclude-newer=false also disabled the configured cooldown for every package.
  After: at 43e38b99e25d884e1335275ff3269d625979a1bd, actual make production-image exits0. The final image imports the app, API, OpenTelemetry SDK, Prometheus, and OTLP HTTP trace/metric/log exporters with networking disabled. The generated later installer preserves the exact patched versions. Dev tools are absent.
• Final-image version checks pass for aiohttp3.14.5, anyio4.15.1, certifi2026.10.19, cryptography50.0.2, grpcio1.81.1, MCP1.30.0, PyJWT2.15.1, urllib3 2.8.0, OTel1.45.1 and Prometheus0.66b1.
• Committed-tree make test exits0: 2,554 tests pass. make lint, make format-check, make production-check, and the two production-config tests exit0. Host and empty-XDG uv lock --check and locked dry-run sync all exit0. Parent diff and lock checks also exit0.
• Relocking changes only cutoff options: all167 package records and other lock content are unchanged. The prior scan of this package graph had zero advisory matches; recorded scan.
• The independent no-comments pass passed before final verification. Both published mandatory findings were classified verdict-changing and repaired in this one push. Fresh hosted CI and Unfret review are pending on this head; earlier-head green checks are not evidence for it.

Merge Danger

Door: two-way

Revert pyproject.toml, uv.lock, and langgraph.json together.

Blast Radius: runtime

The LangGraph base and telemetry dependency set change. The image deliberately replaces vendor telemetry pins with the tested lock. No live provider/database workflow or application deployment occurred. The existing Studio2 installation is unavailable and remains unchanged.

Not verified

make typecheck exits2 with three existing errors in two unchanged test files. Their blobs, dependency package records, and typecheck settings are unchanged by this repair. make integration_tests exits0 by skipping the absent integration directory; no integration suite ran. Image imports and unit tests do not establish live provider or database behavior.

Linear: OSWE-280

[ericlitman]

@unfret review

[ericlitman]

@unfret review

[ericlitman]

@Mergifyio queue

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-10-22 21:58 UTC · Rule: default · triggered by @ericlitman with the @mergifyio queue command
• 🚫 Left the queue — 2026-10-22 21:58 UTC · at 25fc6409144dce36328d6d02b732fafb10b47b50

This pull request spent 15 seconds in the queue, with no time running CI.

Reason

Pull request #155 has been dequeued by @ericlitman with a dequeue command

Requeued — the merge queue status continues in this comment ↓.

[ericlitman]

@Mergifyio dequeue

[unfret-eal]

🛑 1 blocking finding

🔴 Critical · certifi cooldown exemption is permanent, not scoped to the security release

Walkthrough

This PR moves the LangGraph API base image from 0.11.1 to 0.16.0 and the SDK to 0.4.4, upgrades the OpenTelemetry family to 1.45.1/0.66b1, and relocks so patched versions of aiohttp, certifi, cryptography, grpcio, PyJWT, urllib3 and others enter the production graph. It also changes the image build. It deletes the base image's OpenTelemetry pins from `/api/constraints.txt` and installs the project's hash-verified `uv.lock` export before the generated installer runs. It sets a seven-day `exclude-newer` cooldown with a certifi exemption. The author reports that the production image builds, imports and passes unit tests locally. Hosted CI is still pending, and no live provider or database workflow was run.

Area	What changes	Review notes
Production image build	`langgraph.json` targets API 0.16.0. It strips the vendor OpenTelemetry pins from the base constraints, then installs the exported lock with `--require-hashes --no-deps` so the tested versions replace the vendor telemetry set.
Dependency resolution policy	`pyproject.toml` adds a seven-day `exclude-newer` cooldown and exempts certifi from it. It also adds a direct `opentelemetry-api>=1.45.1` requirement and an override pinning `opentelemetry-exporter-prometheus==0.66b1`. The certifi exemption has no expiry or version bound, so it stays in place after the security release.	certifi cooldown exemption is permanent, not scoped to the security release
Lockfile	Many packages are bumped, including aiohttp, anyio, certifi, cryptography, grpcio, MCP, PyJWT, urllib3, multidict, yarl and OpenTelemetry. `importlib-metadata` and `zipp` are dropped, and new OTLP transport and common packages are added. soupsieve now splits into 2.10 for Python versions before 3.11.5 and 3.0.3 for 3.11.5 and later.

Since the last review

• Fixed: Align the production image with the new LangGraph API pin. Why: The current code no longer exhibits the reported API/base-image mismatch: langgraph.json now selects API 0.16.0, matching langgraph-api==0.16.0 in pyproject.toml, rather than the 0.11.1 image whose grpcio constraint caused the failure. The production customization also removes the conflicting vendor telemetry pins and installs the hash-verified lock before the generated project installer. The exact-head configuration therefore refutes this carried report's unchanged-0.11.1 premise and applies the prior demanded repair. This does not claim that every possible production build or runtime problem has been ruled out.
• New: certifi cooldown exemption is permanent, not scoped to the security release
• Fixed: exclude-newer=false disables uv's release-age cooldown project-wide. Why: The reported project-wide exclude-newer=false setting is absent at this head. It has been replaced by exclude-newer="7 days", and uv.lock records the corresponding P7D span. Thus routine resolution no longer disables release-age filtering for every package, including for the finding's seven-day host-cooldown scenario. The remaining certifi-only exception is adjudicated separately in finding-0000: its unbounded lifetime can remain defective after the global disablement is corrected. This kills the repaired carried failure, not the remaining package-specific concern.

Repair prompt

Read the Unfret check run for ericlitman/open-swe#155 at head 43e38b99e25d884e1335275ff3269d625979a1bd (run panel:43e38b99e25d884e1335275ff3269d625979a1bd:MO8Vv3cgF1K:X4aVrluLgmw, check). Use the check's App id and GET /repos/ericlitman/open-swe/check-runs/120163966532; its output.text contains the structured result. Compare it with the current code and head, verify that each listed mandatory finding still applies, repair only those that do, honor the repository constraints, and validate the changes. Leave advisories and accepted risks alone. A manually resolved thread is not a waiver.

• v1:4c63675299a8f3abeb54afbe45f8a4f40c1970ea02f44a37f03d669bdfb2ed7a

Details

Lane / stage	Model	Effort	Outcome	Duration
broad-gpt-5.6-sol-xhigh / review	openai/gpt-5.6-sol → gpt-5.6-sol · primary	xhigh	succeeded	2 min 15 s
broad-opus-5.5-max / review	anthropic/claude-opus-5-5 → claude-opus-5-5 · primary	max	succeeded	10 min 19 s
focal-gpt-5.6-sol-xhigh copy / review	openai/gpt-6.1-sol → gpt-6.1-sol · primary	xhigh	succeeded	8 min 53 s
focal-gpt-5.6-sol-xhigh copy 2 / review	openai/gpt-6.1-sol → gpt-6.1-sol · primary	xhigh	succeeded	10 min 5 s
judge / judge	openai/gpt-6-astra → gpt-6-astra · primary	high	succeeded	53 s

Reviewed the whole pull request.
4 reviewers finished.
Commit 43e38b9.
Check run.
Run: GET /unfret/run/panel:43e38b99e25d884e1335275ff3269d625979a1bd:MO8Vv3cgF1K:X4aVrluLgmw.

_{@unfret review · @unfret status · @unfret help}

[unfret-eal]

⚠️ Review incomplete
Check

[ericlitman]

@unfret review

[ericlitman]

@Mergifyio queue

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-10-22 23:17 UTC · Rule: default · triggered by @ericlitman with the @mergifyio queue command
• 🚫 Left the queue — 2026-10-22 23:17 UTC · at 18f0560570b358cdef9f191d2e94d427267b78e3

This pull request spent 15 seconds in the queue, with no time running CI.

Reason

Pull request #155 has been dequeued by @ericlitman with a dequeue command

Requeued — the merge queue status continues in this comment ↓.

[ericlitman]

@Mergifyio dequeue

[unfret-eal]

🛑 2 blocking findings
🔴 Critical · exclude-newer=false disables uv's release-age cooldown project-wide
🔴 High · Align the production image with the new LangGraph API pin
Check

[ericlitman]

@Mergifyio queue

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-10-23 00:13 UTC · Rule: default · triggered by @ericlitman with the @mergifyio queue command
• 🚫 Left the queue — 2026-10-23 00:13 UTC · at 43e38b99e25d884e1335275ff3269d625979a1bd

This pull request spent 17 seconds in the queue, with no time running CI.

Reason

Pull request #155 has been dequeued by @ericlitman with a dequeue command

Tick the box to put this pull request back in the merge queue (same as @mergifyio queue).

• Requeue this pull request

[ericlitman]

@Mergifyio dequeue

[unfret-eal]

🛑 1 blocking finding
🔴 Critical · certifi cooldown exemption is permanent, not scoped to the security release
Check

[unfret-eal]

🔴 Critical · certifi cooldown exemption is permanent, not scoped to the security release

Line 49 sets certifi = false. That exempts every certifi version from the 7-day release-age cutoff, not just the 2026.10.19 release the PR says it needs. That release ages past the window on 2026-10-27; after that date the line only admits newly published certifi releases. Project [tool.uv] settings override host uv.toml cooldowns, and uv.lock persists the exemption under [options.exclude-newer-package]. Scenario: a compromised certifi release is uploaded. A routine or agent-driven uv lock --upgrade resolves it within minutes. Its hashes enter uv.lock, and the new hash-verified dockerfile install ships it into the runtime that holds GitHub App and LangSmith credentials. No expiry or comment bounds the exemption. This is the unrepaired 'permanent' half of the prior cooldown finding, now limited to the TLS trust-store package. The project-wide bypass and the 0.11.1 image mismatch are resolved at this head.