Skip to content

build(deps): update agentrust-trace-tests requirement from <0.6,>=0.5.0 to >=0.5.1,<0.6 - #150

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/agentrust-trace-tests-gte-0.5.1-and-lt-0.6
Open

build(deps): update agentrust-trace-tests requirement from <0.6,>=0.5.0 to >=0.5.1,<0.6#150
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/agentrust-trace-tests-gte-0.5.1-and-lt-0.6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on agentrust-trace-tests to permit the latest version.

Release notes

Sourced from agentrust-trace-tests's releases.

agentrust-trace-tests 0.5.1

What's Changed

New Contributors

Full Changelog: agentrust-io/trace-tests@v0.5.0...v0.5.1

Changelog

Sourced from agentrust-trace-tests's changelog.

v0.5.1 — 2026-08-22

  • Level 1 and Level 2 verification now requires a verifier-issued challenge via --expected-nonce and checks it against the signed runtime.nonce using constant-time comparison. Previously nonce binding existed only as an assertion over the repository's own pytest fixture; the shipped runner and CLI could report conformance for a fresh signed record containing an attacker-chosen or replayed nonce.

v0.5.0 — 2026-08-09

Added

  • trace-tests report: conformance results as an artifact somebody can forward. verify answers a question for whoever ran it; a pass/fail in a terminal is useless to an auditor, a counterparty or an acquirer. The new command emits self-contained HTML, a machine-readable JSON document (schema: agentrust-io/trace-tests/report/1), and an SVG level badge.

    It runs every level up to --max-level instead of one, because the answer a reader needs is the highest level the record reaches, not whether it cleared the level the person running the tool happened to choose. --fail-under N gates CI on a level; without it the command exits 0, since producing an artifact and enforcing a threshold are different jobs.

    The report states that it is not evidence. It is unsigned HTML describing one run of one suite version, and anyone can edit it, so every report carries the record's digest, the suite and authoring-library versions, and the command to reproduce the result — and tells a reader who does not trust the sender to go check the record instead. A conformance report that looks authoritative and cannot be checked is the same shape of thing as a control plane writing its own log, which is the problem this project exists to fix.

    Self-contained by construction: no scripts, no external CSS, no fonts, no badge service. A badge served from someone else's infrastructure would add a dependency to an artifact whose whole point is needing none. A test asserts the HTML fetches nothing.

    The HTML and the JSON are rendered from one assembled structure so they cannot disagree about the verdict, and unverified findings count as failures from Level 1 up exactly as they do in verify.

v0.4.1 — 2026-08-03

Fixed

  • --version reported the wrong version. __version__ was a second hardcoded literal alongside pyproject.toml and never moved, so it sat at 0.2.0 through both the 0.3.0 and 0.4.0 releases: trace-tests --version printed 0.2.0 from a 0.4.0 install while importlib.metadata correctly returned 0.4.0. It is now read from installed distribution metadata, so there is one source of truth and the value cannot fall behind a release again.

    This mattered more than a wrong string usually would. The v0.2 profile cutover shipped in 0.4.0, and a 0.2.x suite rejects every v0.2 record, so --version is exactly the command someone runs to work out whether their suite matches their producer. It was the one command that could not answer.

v0.4.0 — 2026-07-28

Changed

  • BREAKING: the suite now conforms to TRACE v0.2. TR-ENV requires the profile tag:agentrust-io.com,2026:trace-v0.2 and fails a record carrying the v0.1 identifier. The v0.1 URI named agentrust.io, a domain this project never controlled, which RFC 4151 does not permit for a tag URI; see agentrust-io/trace-spec#107. Nothing else about the record format changed, so a producer migrates by updating the profile string and bumping agentrust-trace to 0.5.0.

    This is a deliberate cutover rather than dual acceptance: a conformance suite that passed both identifiers would certify records minted under a domain we do not own. A v0.1 record is checked with the 0.3.x releases of this suite, which stay published.

  • Registry, verifier, and documentation hosts moved from agentrust.io to agentrust-io.com.

v0.3.0 — 2026-07-21

  • azure-cvm-sev-snp platform accepted (runtime.platform): Azure confidential VMs run SEV-SNP behind a Hyper-V paravisor (vTPM-rooted). Added to the bundled schema enum and the TR-RTE valid-platform set so Azure TRACE records pass conformance. Matches agentrust-trace>=0.4.

v0.2.0 — 2026-06-19

  • DID subject support: subject now accepts did: URIs in addition to spiffe://.
  • Embedded signature verification: plain TRACE records signed with agentrust-trace sign_record() are now cryptographically verified at all levels.
  • SLSA Level 0: build_provenance.slsa_level: 0 is now valid for software-only / development records.

... (truncated)

Commits
  • 3af2b53 ci: fail closed when CodeQL analysis fails (#78)
  • d9c0da1 fix(tr-sig): stop publishing a finding whose message names a different code (...
  • f7669e6 fix(tr-sig): report a malformed record instead of raising on it (#75)
  • 71e6bf2 docs: align the published error codes and record samples with the modules (#74)
  • 10911bd docs: document project sponsorship roles (#77)
  • 121c18b ci: deploy the docs when the theme or the landing page changes (#73)
  • af4f010 fix(seo): social cards said "Home", not the page title (#72)
  • c89a983 docs: give the site its own landing page instead of rendering the README (#71)
  • c725bbb fix(tr-sig): canonicalize with RFC 8785, which is the rule this suite scores ...
  • 84ecb81 fix(schema): resync the packaged copy, and a vector that uses the field whose...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): update agentrust-trace-tests requirement
38ff6a9 
Updates the requirements on [agentrust-trace-tests](https://github.com/agentrust-io/trace-tests) to permit the latest version.
- [Release notes](https://github.com/agentrust-io/trace-tests/releases)
- [Changelog](https://github.com/agentrust-io/trace-tests/blob/main/CHANGELOG.md)
- [Commits](agentrust-io/trace-tests@v0.5.0...v0.5.1)

---
updated-dependencies:
- dependency-name: agentrust-trace-tests
  dependency-version: 0.5.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 31, 2026
@dependabot
dependabot Bot requested a review from imran-siddique as a code owner August 31, 2026 04:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@imran-siddique imran-siddique Awaiting requested review from imran-siddique imran-siddique is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants