Skip to content

chore(deps): bump strands-agents in strands lockfile - #6089

Merged
cdbartholomew merged 1 commit into
mainfrom
chore/security-daily-20261025-uv-strands
Oct 25, 2026
Merged

cdbartholomew merged 1 commit into
mainfrom
chore/security-daily-20261025-uv-strands

Conversation

@cdbartholomew

Copy link
Copy Markdown
Contributor

Routine dependency maintenance for hindsight-integrations/strands/uv.lock.

Closes Dependabot alert: #2331

  • strands-agents 1.39.0 -> 1.62.0 (affected range < 1.43.0). Same major. strands-agents now lists httpx as a direct dependency, which was already in the lock.
  • The integration imports only strands.tool and strands.Agent from the package; both resolve on 1.62.0.

Local verification

There is no CI job for this integration, so local results are the evidence:

  • uv build OK, uv sync --frozen OK (Python 3.11)
  • uv run pytest tests — 82 passed, identical to a clean origin/main checkout (82 passed)
  • python -c "import hindsight_strands, strands, strands.agent, strands.tools" OK

@cdbartholomew cdbartholomew added security Security / dependency vulnerability remediation p1 High severity - remediate within 30 days labels Oct 25, 2026
@cdbartholomew cdbartholomew self-assigned this Oct 25, 2026
@cdbartholomew

Copy link
Copy Markdown
Contributor Author

Merge evidence: CI does not cover this change. .github/workflows/test.yml has no test-strands-integration job and no strands path filter, so the only checks that ran here (detect-changes, build-docs, verify-generated-files) say nothing about this lockfile.

I reproduced it locally today, Python 3.11, uv 0.13.5:

  • this branch: uv build OK, uv sync --frozen OK, uv run pytest tests gave 82 passed
  • clean origin/main (4822d66), same commands: 82 passed, so there is no regression and no failures that predate this change
  • load-time imports resolve on strands-agents 1.62.0: import hindsight_strands, strands, strands.agent, strands.tools. The integration uses only strands.tool and strands.Agent.

@cdbartholomew
cdbartholomew merged commit fa35987 into main Oct 25, 2026
93 checks passed
@cdbartholomew
cdbartholomew deleted the chore/security-daily-20261025-uv-strands branch October 25, 2026 14:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

p1 High severity - remediate within 30 days security Security / dependency vulnerability remediation

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant