[wu-sheng]

Bumps locked dependencies to close open Dependabot alerts, and re-pins GitHub Actions to ASF-approved versions.

Dependencies (poetry.lock only)

Targeted lock update with Poetry 2.3.3 (the version in the lock header). pyproject.toml is unchanged and the lock content-hash is unchanged. Versions stay on the lowest release line that has the fix, and every version supports the declared Python range >=3.10, <3.15.

Package	Old -> New	Advisories
aiohttp	3.13.5 -> 3.14.5	CVE-2026-111063, CVE-2026-111064, CVE-2026-111065, CVE-2026-111066, CVE-2026-111748, CVE-2026-111749, CVE-2026-111750, CVE-2026-34993, CVE-2026-47265, CVE-2026-50269, CVE-2026-54273, CVE-2026-54274, CVE-2026-54275, CVE-2026-54276, CVE-2026-54277, CVE-2026-54278, CVE-2026-54279, CVE-2026-54280, CVE-2026-59881, CVE-2026-69243, CVE-2026-69244, GHSA-2g87-pp6c-29x5
yarl	1.23.0 -> 1.25.1	(required by aiohttp 3.14.5)
multidict	6.7.1 -> 6.9.1	CVE-2026-104874
idna	3.11 -> 3.15	CVE-2026-45409
urllib3	2.6.3 -> 2.8.0	CVE-2026-44431, CVE-2026-44432, CVE-2026-97687, CVE-2026-97688, CVE-2026-97689
kafka-python	2.3.1 -> 2.3.3	CVE-2026-10142, CVE-2026-10143
anyio	4.13.0 -> 4.14.2	CVE-2026-63374, CVE-2026-64847
django	5.2.13 -> 5.2.18 (Python < 3.12), 6.0.4 -> 6.0.9 (Python >= 3.12)	CVE-2026-15307, CVE-2026-15830, CVE-2026-35192, CVE-2026-35193, CVE-2026-48587, CVE-2026-48588, CVE-2026-53877, CVE-2026-53878, CVE-2026-5766, CVE-2026-6873, CVE-2026-6907, CVE-2026-7666, CVE-2026-8404
sqlparse	0.5.5 -> 0.6.1	CVE-2026-54284, CVE-2026-59893, CVE-2026-59894, CVE-2026-71491, CVE-2026-84305
tornado	6.5.5 -> 6.5.10	CVE-2026-49853, CVE-2026-49854, CVE-2026-49855, CVE-2026-82397, GHSA-3hv7-mjh2-fv65, GHSA-8423-8fgw-73vq, GHSA-c2m8-h5v5-343r, GHSA-chx6-46f5-w4vp, GHSA-pw6j-qg29-8w7f, GHSA-wwv5-g3v4-889x
pymongo	4.16.0 -> 4.18.3	CVE-2026-88029, CVE-2026-96747, CVE-2026-96748, CVE-2026-96749
starlette	1.0.0 -> 1.3.1	CVE-2026-48710, CVE-2026-48817, CVE-2026-48818, CVE-2026-54282, CVE-2026-54283
webob	1.8.9 -> 1.8.11	CVE-2026-44889, CVE-2026-54770
ujson	5.12.0 -> 5.13.0	CVE-2026-44660, CVE-2026-54911
werkzeug	3.1.8 -> 3.1.9	CVE-2026-102598
sanic	25.12.0 -> 25.12.1	CVE-2026-85078

Supersedes #428 (django) and #430 (aiohttp).

Deliberately not bumped: setuptools (81.0.0, alerts CVE-2026-59890 / GHSA-xmj3-9gf7-h52w, fixed in 84.1.0). Every pyramid release imports pkg_resources at module level; pyramid 2.1 declares setuptools<82, and setuptools >= 82 no longer ships pkg_resources. The only lock that reaches setuptools 84.x downgrades pyramid to 2.0.2, which then fails with ModuleNotFoundError: No module named 'pkg_resources' (checked locally with pyramid 2.0.2 + setuptools 84.1.0). #432 makes exactly that change, so this PR does not supersede it. Fixing this needs either a pyramid release without pkg_resources or dropping pyramid from the dev-only plugins group.

GitHub Actions

• actions/checkout v4 -> v7
• actions/setup-python v5 -> v7 (v7 removes only the pip-install input, which is not used here)
• actions/upload-artifact v4 -> v7
• actions/download-artifact v4 -> v8 (downloads are by name and of zipped artifacts, so v5's by-ID path change and v8's direct-download change do not apply)
• tcort/github-action-markdown-link-check e7c7a18 (not on the ASF allowlist; Dead Link Checker runs on master currently end in startup_failure) -> e047c5b # v1.1.3
• docker/login-action 650006c # v4.2.0 -> 81c6f93 # v4.7.0
• docker/setup-qemu-action 0611638 # v4.1.0 -> 9901266 # v4.4.0
• docker/setup-buildx-action d7f5e7f # v4.1.0 -> f87e599 # v4.4.1
• apache/skywalking-eyes/header 501a28d (2022) -> a196742 # v0.9.0. v0.9.0 fails with read protocol: is a directory on the submodule gitlink, so protocol is added to paths-ignore in .licenserc.yaml. The submodule is a separate Apache repo and was not header-checked before either.
• apache/skywalking-infra-e2e cf589b4 -> 56ac8be (current main, for Docker 29 with the containerd image store on ubuntu-26.04 runners)

Unchanged: dorny/paths-filter ceb8a2b # v4.0.3 is already the current approved SHA.

Left as is: the plugin-test job still has its "Install docker-compose" (v1.29.2) fallback step. Nothing calls docker-compose, because testcontainers uses docker compose. The 36 plugin compose files still use the obsolete top-level version: key, which Compose v2 only warns about.

E2E expected data

infra-e2e 56ac8be includes apache/skywalking-infra-e2e#143: contains now matches each expected entry to a distinct actual item. Two expected files depended on the old matching:

• tests/e2e/case/expected/logs-list.yml: removed the placeholder entry (ISHOULDNOTEXIST) and its FIXME, which worked around [INFRA-E2E][Bug] E2E mismatch actual data still pass the expected template skywalking#8752. The placeholder never matched. The file passed only because the multi-line exception log, rendered unquoted, broke the YAML of the expected entries and lowered the entry count. As a result the exception entry was never really checked. Its regex Traceback(most recent call last) could not match a real traceback anyway. Changes: each content is now rendered with printf "%q" so multi-line logs stay valid YAML, and the regex is now Traceback \(most recent call last\).
• tests/e2e/case/expected/metrics-has-value.yml: removed the ge .value 0 entry. It overlaps ge .value 1, and with distinct matching it made the check depend on bucket order (it failed when the only non-zero bucket came first, or when there was a single bucket). The check is still "some bucket is >= 1".

Checked by running the verifier.Verify function from both infra-e2e pins on synthetic swctl output:

• New logs-list.yml: passes in all 6 orderings of the three logs. It fails when the exception log is missing, has the wrong level or has no traceback, when a warning is duplicated in its place, and when the basic-auth URL is not masked.
• Old logs-list.yml: passed in only 2 of the 6 orderings, and it passed when the exception log had the wrong level.

The other expected files have only distinct contains entries and are unchanged.

License

This repo has no generated dist LICENSE. The top-level LICENSE is plain Apache-2.0, and .licenserc.yaml has no dependency: section. license-eye dependency resolve (v0.9.0) resolves no dependencies, so the dist LICENSE needs no change.

Verified locally

• poetry check --lock (Poetry 2.3.3): passed
• Python 3.10: poetry install --all-extras --with lint, make lint: flake8 passed. pylint reports E1101 only on the generated skywalking/protocol/*_pb2_grpc.py. pylint, astroid, protobuf and grpcio are not changed by this PR. pylint --disable=all --enable=E0602,E0603,E1101 --ignore=protocol skywalking tests passed (10.00/10).
• Python 3.10 and 3.14: poetry run pytest tests/unit: 135 passed, 1 failed. The failure is test_meter.py::test_counter_timer_decarator, a sleep-timing tolerance on macOS (0.0503 > 0.05). It fails the same way with the old aiohttp/idna/urllib3/kafka-python versions.
• Bumped plugin-group packages installed with pip on Python 3.10 (django 5.2.18) and 3.14 (django 6.0.9): pip check reports nothing broken, and all of them import.
• license-eye header check v0.9.0 with the updated .licenserc.yaml: passed (0 invalid).
• actionlint v1.7.12: actionlint -shellcheck= .github/workflows/*.yaml (shellcheck integration off) passed. Plain actionlint with shellcheck exits 1 on SC2086/SC2069/SC2129 findings in run: scripts (CI.yaml lines 122 and 185, publish-docker.yaml line 42). The same 14 findings appear on master; this PR does not touch those scripts.
• E2E expected files: rendered with the verifier from both infra-e2e pins (cf589b4 and 56ac8be) against synthetic swctl output, see the E2E section.

Not verified locally: Docker-based plugin tests and the real E2E runs. CI on this PR covers them. E2E was green on master in the 2026-10-31 and 2026-11-01 scheduled runs.