[yujiyokoo]

Summary

The Python SDK's tests now install fixed versions of their libraries, from a new uv.lock. Before this, each CI run installed the newest release of every test library from PyPI, the public Python package index. Users of the SDK see no change, because the package has no runtime dependency.

Why

• A new release could fail CI on an unrelated pull request. The failure then appeared on whichever PR ran next.
• Two runs of one commit could install different versions. So an old run could not be repeated.
• The live job installed unchecked releases. That job has the CS_* credentials in its environment, so a malicious release could read them.

The tests must still run against new releases soon after they appear, because users build their classes with attrs, Pydantic, and SQLAlchemy. A monthly Dependabot PR now brings those releases in, after a 7-day cooldown.

Changes

• languages/python/uv.lock: new. It locks 31 packages for Python 3.9 to 3.14.
• languages/python/mise.toml: mise run build installs the test libraries with uv sync --locked, then installs the package with --no-deps.
• languages/python/pyproject.toml: the comment on the test extra describes the lock.
• .github/dependabot.yml: a uv entry for /languages/python. Its settings match the pip entry.
• skills/stash-supply-chain-security/SKILL.md: names uv, as the supply-chain test requires.
• .changeset/supply-chain-skill-uv.md: a stash patch, because the skill is part of that package.
• AGENTS.md: describes the lock.

Verification

• pytest passed on Python 3.14 and on 3.9: 358 passed and 29 skipped on each. Each build installed the locked versions.
• A lock that did not match pyproject.toml failed uv sync --locked.
• e2e/tests/supply-chain.e2e.test.ts passed, 29 of 29. Without the uv entry, it failed and named uv.lock.
• python-ci.test.mjs and crates-ci.test.mjs passed, 40 of 40.
• Not run: the live tests with the lock. The live job on this PR is their first run.
• Not run: Dependabot's uv update. The first scheduled Dependabot run is the first check.

Related

Refs #1341. Refs #1406, whose review notes say the lock comes in a new PR at the top of this stack. Stacked on #1517.

Review notes

• maturin, the build backend, is not in the lock. uv installs it in a separate build environment, within the range in pyproject.toml. Locking it needs a different install method.
• On Python 3.9, uv locked older versions where the newest need a later Python. For example, SQLAlchemy is 2.0.57 on 3.9 and 2.1.8 on 3.14.

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: bb6d7b8

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages

Name	Type
stash	Patch
@cipherstash/basic-example	Patch
@cipherstash/e2e	Patch
@cipherstash/stack-drizzle	Patch
@cipherstash/stack-prisma	Patch
@cipherstash/stack-supabase	Patch
@cipherstash/stack	Patch
@cipherstash/wizard	Patch
@cipherstash/bench	Patch
@cipherstash/prisma-example	Patch
@cipherstash/test-kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: b3b29647-1d08-42dc-88c6-694eec56f2da

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

[cipherstash-agent]

Review attestation

Reviewed bb6d7b8 · posted from Claude Code · claude-sonnet-5-5 · effort medium
Sources: code-review · claude-sonnet-5-5
Skills: code-review, review-cross-check, review-post

Cross-check was done by direct comparison with the PR's existing feedback (no review threads; only changeset-bot and CodeRabbit status comments). No finding duplicated existing feedback. The lockfile body (uv.lock) was not line-by-line reviewed; the hash and resolution entries were sampled only.

Findings (1): 0 critical, 0 major, 1 minor — 1 inline, 0 below.

Other notes, not findings: all 41 CI checks at this head are green or skipped (including Python live, which is the first run of the lock there), and the PR title ends in a typo (uv.lockj).

_{Source: code-review · claude-sonnet-5-5}

---

Generated by Claude Code

[cipherstash-bot]

Recommendation: 🟢 merge as it is

Nothing must change before merging. One optional test can wait for a follow-up: nothing checks that mise run build keeps installing from the lock.

How this review was made

Agent	Model	Review type	Result
claude	claude-opus-5-5	test-gap	1 found, 1 posted
claude	claude-opus-5-5	rust	0 found, 0 posted
claude	claude-opus-5-5	python	0 found, 0 posted
claude	claude-opus-5-5	infracode	0 found, 0 posted

Synthesis: claude-sonnet-5-5 merged the findings, removed duplicates and dropped findings it could not confirm in the code. 0 posted finding(s) were raised by two or more models.

Plain language: claude-sonnet-5-5 read every comment as a new reader would. No comment had a problem that stopped the reader acting, so none was rewritten.

Stack: position 15 of 15 (#1405, #1406, #1414, #1415, #1433, #1437, #1453, #1499, #1509, #1510, #1511, #1513, #1516, #1517, *️⃣ #1582). *️⃣ marks this pull request.

Context loaded: the description, 1 linked issue(s) and 4 discussion entries.