From 9581c9e5267390c23978e13dc05d2fbce1f2e0e3 Mon Sep 17 00:00:00 2001 From: Ronald Tse Date: Thu, 3 Sep 2026 02:34:38 +0200 Subject: [PATCH] =?UTF-8?q?docs:=20dependency-security=20register=20closed?= =?UTF-8?q?=20=E2=80=94=20C=20executed,=20PR=20triage=20done?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- TODO.publish/06-dependency-security-decisions.md | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/TODO.publish/06-dependency-security-decisions.md b/TODO.publish/06-dependency-security-decisions.md index d2bf12a..981797e 100644 --- a/TODO.publish/06-dependency-security-decisions.md +++ b/TODO.publish/06-dependency-security-decisions.md @@ -1,9 +1,15 @@ # 06 — Dependency-security decisions (the 56 Dependabot alerts) -Status: ANALYZED 2026-09-03 — decision memo for the owner. Everything -below is owner territory (version/requirements contract); nothing was -executed. Evidence gathered; PRs #51/#52/#53 are the live decision -vehicles. +Status: DECIDED + EXECUTED 2026-09-03 — owner picked **C** (root +floors, PR #78 merged: torch>=2.6, onnx>=1.22, tqdm>=4.66.3) plus a +full open-PR triage: #48 Modernize modernized (main merged in, +workflows fixed green, rebase-merged); dependabot #51/#52/#53 CLOSED +(superseded — exact-pin jumps break the Ruby goldens; #48's ranges +are the chosen path); #26 CLOSED (superseded by the spec split, +goldens already carried). Residual expectation: alerts against the +legacy python/*/requirements.txt pins stay open (ranges admit old +versions by design); eventual closure is option-A dismissal — an +owner act. Dependabot rescans on its own schedule. ## Where the alerts live