Merge upstream changes

[pdobacz]

IMPORTANT: Merge with MERGE COMMIT!

Also important: upstream changed the way fixtures are released, and I'm intending to follow along - instead of a tag push there is a manual workflow to trigger

[greptile-apps]

Too many files changed for review (2095 files, 500 file limit).

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	mypy@​1.20.0 ⏵ 2.1.0	+1
	eth-remerkleable@​0.1.31
	spec256k1@​0.2.3

View full report

[semgrep-code-monad-developers]

Medium severity and reachable issue identified in your code:
Line 161 has a vulnerable usage of filelock, introducing a medium severity vulnerability.

ℹ️ Why this is reachable

A reachable issue is a real security risk because your project actually executes the vulnerable code. This issue is reachable because your code uses a certain version of filelock.
Affected versions of filelock are vulnerable to Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') / Improper Link Resolution Before File Access ('Link Following') / Time-of-check Time-of-use (TOCTOU) Race Condition. filelock is vulnerable to a TOCTOU race condition in its hard file-lock implementation. Because lock acquisition checks for the lock file and then opens it with O_TRUNC without O_NOFOLLOW (Unix) or reparse-point detection (Windows), a local attacker can plant a symlink in the gap between the check and the open, causing filelock to follow the symlink and truncate/corrupt an arbitrary victim-owned file. SoftFileLock is not affected because it opens with O_CREAT | O_EXCL and does not truncate.

References: GHSA

To resolve this comment:
Upgrade this dependency to at least version 3.20.1 at uv.lock.

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-monad-developers]

Medium severity and reachable issue identified in your code:
Line 161 has a vulnerable usage of filelock, introducing a medium severity vulnerability.

ℹ️ Why this is reachable

A reachable issue is a real security risk because your project actually executes the vulnerable code. This issue is reachable because your code uses a certain version of filelock.
Affected versions of filelock are vulnerable to Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') / Improper Link Resolution Before File Access ('Link Following') / Time-of-check Time-of-use (TOCTOU) Race Condition. filelock's SoftFileLock acquires locks by creating the lock file after a separate writability check, with no protection against symlinks. A local attacker who can write to the lock-file directory can plant a symlink in the window between the check and os.open(), redirecting the lock operation to an attacker-controlled file. This causes silent lock-acquisition failures, denial of service, or writes to unintended files. The soft lock is used directly, as the FileLock fallback when fcntl is unavailable, and on platforms lacking os.O_NOFOLLOW.

References: GHSA, CVE

To resolve this comment:
Upgrade this dependency to at least version 3.20.3 at uv.lock.

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[QEDK]

LGTM.