Merge dev into main

.github/requirements/integration.in

@@ -1,8 +1,9 @@
 # Python 3.12 integration dependencies, locked for all runner platforms.
 # Regenerate: uv pip compile --universal --python-version 3.12 --generate-hashes
-# --only-binary :all: --exclude-newer 2026-10-05T00:00:00Z
+# --only-binary :all: --exclude-newer 2026-10-25T00:00:00Z --exclude-newer-package pyasn1=2026-10-28T00:00:00Z
+# (pyasn1 0.6.5, the security fix, is newer than the cut-off and exempt from it.)
 # .github/requirements/integration.in -o .github/requirements/integration.txt
-setuptools>=77
+setuptools>=84.1.0
 wheel
 requests>=2.31.0
 tqdm>=4.66.0
@@ -14,10 +15,10 @@ je_action_core>=0.0.2
 PyYAML>=6.0.3
 # Keep Windows timezone data even when Dependabot recompiles this shared lock on Linux.
 tzdata>=2026.5
-opentelemetry-api>=1.44.0
-opentelemetry-sdk>=1.44.0
+opentelemetry-api>=1.45.1
+opentelemetry-sdk>=1.45.1
 tomli>=2.0.1; python_version<"3.11"
-boto3>=1.43.108
+boto3>=1.43.109
 azure-storage-blob>=12.19.0
 google-api-python-client>=2.100.0
 google-auth-httplib2>=0.2.0
@@ -27,7 +28,7 @@ paramiko>=3.4.0
 smbprotocol>=1.13.0
 fsspec>=2024.2.0
 msal>=1.39.0
-boxsdk>=10.15.0,<11
+boxsdk>=10.17.1,<11
 pyarrow>=25.0.1
 PySide6>=6.11.2,<6.12
 pytest>=8.0.0

.github/requirements/integration.txt

@@ -1,5 +1,5 @@
 # This file was autogenerated by uv via the following command:
-#    uv pip compile .github/requirements/integration.in --python-version 3.12 --universal --generate-hashes --only-binary :all: --exclude-newer 2026-10-05T00:00:00Z -o .github/requirements/integration.txt
+#    uv pip compile .github/requirements/integration.in --python-version 3.12 --universal --generate-hashes --only-binary :all: --exclude-newer 2026-10-25T00:00:00Z -o .github/requirements/integration.txt --exclude-newer-package pyasn1=2026-10-28T00:00:00Z
 azure-core==1.41.0 \
     --hash=sha256:522b4011e8180b1a3dcd2024396a4e7fe9ac37fb8597db47163d230b5efe892d \
     --hash=sha256:f46ff5dfcd230f25cf1c19e8a34b8dc08a337b2503e268bb600a16c00db8ad5a
@@ -73,23 +73,23 @@ bcrypt==5.0.0 \
     --hash=sha256:f8429e1c410b4073944f03bd778a9e066e7fad723564a52ff91841d278dfc822 \
     --hash=sha256:fc746432b951e92b58317af8e0ca746efe93e66555f1b40888865ef5bf56446b
     # via paramiko
-boto3==1.43.108 \
-    --hash=sha256:03341f089158368acf83e921aca98b706095322ca52bc4c039a616940aa5ad41 \
-    --hash=sha256:19e9da95ef0c494e27052049a42137550e66730509bb613e76eaa30ddf9a7170
+boto3==1.43.109 \
+    --hash=sha256:703a81baed186d31e27cf50065d25a9faeb704f009e7c56b0f002ca52a328896 \
+    --hash=sha256:c829bc3352e1e3922d8fe1db10b697182ac411b64ce5fc3acb0a06a29837417e
     # via -r .github/requirements/integration.in
-botocore==1.43.108 \
-    --hash=sha256:ab9d16c6b4350aaa54ed28202dfa2998b2d735fdbf3247eb60af469d8d48a5b8 \
-    --hash=sha256:ee4f75cf3bdbb0da7912e089950e8112f692016539d939312c771499958e6cfd
+botocore==1.43.114 \
+    --hash=sha256:d1c441a22e93e158de5b1e026205f5d6d67a4545d10540c5090c62dccb3a9eca \
+    --hash=sha256:f366fa4db518775632ad1eb128cd8203ca46396cecf37209d904f0bbc049ce90
     # via
     #   boto3
     #   s3transfer
-boxsdk==10.17.0 \
-    --hash=sha256:86c9a1f665c8879af501c02ec51bbe02247b24f96c6bc39f6890912e70091840 \
-    --hash=sha256:fe42658185901b80437a0d5b393c91b4a732f3b78d1be11d881aa7484807c9d5
+boxsdk==10.17.1 \
+    --hash=sha256:7e85b520172ccc1e9c9f9ad7c72875a69caee8d8f609e804936f8a7e111a7774 \
+    --hash=sha256:c17ef54a30062e9a4528facdbf386a1e3e426661d319451a8ceb9007019623ea
     # via -r .github/requirements/integration.in
-certifi==2026.7.22 \
-    --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \
-    --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55
+certifi==2026.10.23 \
+    --hash=sha256:a9895e6e2758b371e0545e321a3a8fd1fcfd9829ada8824a936dfb16aaaf36cd \
+    --hash=sha256:e9b54de76e530bb6cf0ccd036787103acb58fd42ba930ea8bf948ddbaa2f61d1
     # via requests
 cffi==2.1.1 ; platform_python_implementation != 'PyPy' \
     --hash=sha256:046bfc24911b37851ee1b51aab8bffe713d89c68c6a057b09484ce9fd5f69b4e \
@@ -744,21 +744,21 @@ oauthlib==4.0.0 \
     --hash=sha256:624c28c13a0a59cabf9747dfa52af63be3e512a7f2714df16e91b5b3a145e6cd \
     --hash=sha256:efb274799819440f95b4ab3b818869f1ce9ae26c5beacba0201d1a1b76b54f86
     # via requests-oauthlib
-opentelemetry-api==1.45.0 \
-    --hash=sha256:711ede81773c8025c2c03dac0450bc89f3d30aea6eabcc815c570d4e35a963f7 \
-    --hash=sha256:80e068aba7cd56c8b58512d6a36f8d25cb1dfaa0c0a4cc1c938ccf9f362d9cb3
+opentelemetry-api==1.45.1 \
+    --hash=sha256:aa38ed19bcc084ba42782a73255b3582283eced7ad6dddbd6695189e69adfb75 \
+    --hash=sha256:b31553efa588ae44bc306f863c785c5333a9ecc091248c6ee68b4b6c87fdedfb
     # via
     #   -r .github/requirements/integration.in
     #   google-api-core
     #   opentelemetry-sdk
     #   opentelemetry-semantic-conventions
-opentelemetry-sdk==1.45.0 \
-    --hash=sha256:20caa5130505e386c67c3da1c76e446c842698ced54c76c6148679539aa97972 \
-    --hash=sha256:5dc634c946546f61b757c5b1781f9fd1a10e96ffaf7357c797e508fe9c57e75e
+opentelemetry-sdk==1.45.1 \
+    --hash=sha256:63d24a6ca645019a631e6a51999c73e93adcac1196ca640b8ae78a7cc4762bf3 \
+    --hash=sha256:c604c11dc429810812348989115fa44bd558772a3d7442afc43d024f2c250ca4
     # via -r .github/requirements/integration.in
-opentelemetry-semantic-conventions==0.66b0 \
-    --hash=sha256:175b19dd98c4473f4f43a2b1df59186fd7b4a48cd3f77cbe03438b6d6fda230a \
-    --hash=sha256:97a77dce484c54861e7eeff7651fd8a806dd3c30e501dc316730215ec36890e6
+opentelemetry-semantic-conventions==0.66b1 \
+    --hash=sha256:497ca63bf383723411e8eaf60c8779e9877633c936bb641080adab59d0eb6ec8 \
+    --hash=sha256:d4cddeb4315490b35213f55e2bdc9ac54bb1e4d318927475bed62b35545e581b
     # via opentelemetry-sdk
 packaging==26.3 \
     --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \
@@ -843,9 +843,9 @@ pyarrow==25.0.1 \
     --hash=sha256:f3831aaa25c67a99f99dc8b05873cb9d64560390372e2aa197ce9dd4a3f06a44 \
     --hash=sha256:f729cfdbd36fd99d543b67a914d2de044c84ebe45be8b34902b299b608c15c8f
     # via -r .github/requirements/integration.in
-pyasn1==0.6.4 \
-    --hash=sha256:9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81 \
-    --hash=sha256:deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b
+pyasn1==0.6.5 \
+    --hash=sha256:4017b0fce125096b8573b39c989fdb1a4b19cf761e683398184550fea0e66587 \
+    --hash=sha256:6b11616a6bcf3a40e635f082bb232fa57b5e0dd7f517bd7ddd69ec3794508a47
     # via pyasn1-modules
 pyasn1-modules==0.4.2 \
     --hash=sha256:29253a9207ce32b64c3ac6600edc75368f98473906e8fd1043bd6b5b1de2c14a \
@@ -1029,9 +1029,9 @@ s3transfer==0.19.2 \
     --hash=sha256:ba0309fd86be3c27dbf78cdd813c13c5e1df16e5874b99d2535ebbdfb9892993 \
     --hash=sha256:d8168eccca828cbb2cd573675333f3bddd254313a9c42494b84c76b539e8ba25
     # via boto3
-setuptools==84.0.0 \
-    --hash=sha256:51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670 \
-    --hash=sha256:f4695c21257f0d9b537ec2692c941d02ee143b7cc1276941349a546573b2ef73
+setuptools==84.2.1 \
+    --hash=sha256:3ff8b3b5492a0aa66960f4419365a86b84e013070d4313e4d4a6894f5d64d6bc \
+    --hash=sha256:ca140b45d5325a9478f880e351484f62fef15f336462e449ca0c03c873d589c2
     # via -r .github/requirements/integration.in
 shiboken6==6.11.2 \
     --hash=sha256:4bbbd6fa4d7cff5ec5e12bc4c10e1d845fa30c89457ecb13cc64f7bddb77f6f9 \

.github/requirements/publish.txt

@@ -1,12 +1,12 @@
 # This file was autogenerated by uv via the following command:
-#    uv pip compile .github/requirements/publish.in --generate-hashes --python-version 3.12 --python-platform x86_64-manylinux_2_28 --only-binary :all: --exclude-newer 2026-10-05T00:00:00Z -o .github/requirements/publish.txt
+#    uv pip compile .github/requirements/publish.in --generate-hashes --python-version 3.12 --python-platform x86_64-manylinux_2_28 --only-binary :all: --exclude-newer 2026-10-25T00:00:00Z -o .github/requirements/publish.txt
 build==1.6.1 \
     --hash=sha256:51cc11666391ab6f092070437ac747002ff46f3e4113a3622177ee6b488bfc53 \
     --hash=sha256:ecd351a4be9d35a9eaaba244a7687143c9c7d4aea6ac964e7e7ddab20cbcf4e7
     # via -r .github/requirements/publish.in
-certifi==2026.7.22 \
-    --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \
-    --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55
+certifi==2026.10.23 \
+    --hash=sha256:a9895e6e2758b371e0545e321a3a8fd1fcfd9829ada8824a936dfb16aaaf36cd \
+    --hash=sha256:e9b54de76e530bb6cf0ccd036787103acb58fd42ba930ea8bf948ddbaa2f61d1
     # via requests
 cffi==2.1.1 \
     --hash=sha256:046bfc24911b37851ee1b51aab8bffe713d89c68c6a057b09484ce9fd5f69b4e \
@@ -468,9 +468,9 @@ secretstorage==3.5.0 \
     --hash=sha256:0ce65888c0725fcb2c5bc0fdb8e5438eece02c523557ea40ce0703c266248137 \
     --hash=sha256:f04b8e4689cbce351744d5537bf6b1329c6fc68f91fa666f60a380edddcd11be
     # via keyring
-setuptools==84.0.0 \
-    --hash=sha256:51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670 \
-    --hash=sha256:f4695c21257f0d9b537ec2692c941d02ee143b7cc1276941349a546573b2ef73
+setuptools==84.2.1 \
+    --hash=sha256:3ff8b3b5492a0aa66960f4419365a86b84e013070d4313e4d4a6894f5d64d6bc \
+    --hash=sha256:ca140b45d5325a9478f880e351484f62fef15f336462e449ca0c03c873d589c2
     # via -r .github/requirements/publish.in
 twine==7.0.0 \
     --hash=sha256:85cdb29c518efef867360ae4acd4b0dfd61c8654a22fca08e6f8539f05022177 \

.github/workflows/ci-dev.yml

@@ -61,7 +61,7 @@ jobs:
         run: python -m pytest tests/ -v --tb=short --cov=automation_file --cov-report=term-missing --cov-report=xml
       - name: Upload coverage artifact
         if: matrix.python-version == '3.12'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: coverage-xml
           path: coverage.xml

.github/workflows/ci-stable.yml

@@ -61,7 +61,7 @@ jobs:
         run: python -m pytest tests/ -v --tb=short --cov=automation_file --cov-report=term-missing --cov-report=xml
       - name: Upload coverage artifact
         if: matrix.python-version == '3.12'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: coverage-xml
           path: coverage.xml

README.md

@@ -1436,3 +1436,8 @@ sphinx-build -b html docs/source docs/_build/html
 
 See [`CLAUDE.md`](CLAUDE.md) for architecture notes, conventions, and security
 considerations.
+
+## Security
+
+Report vulnerabilities privately. The policy, supported versions, and operator notes are in [SECURITY.md](SECURITY.md).
+

README.zh-CN.md

@@ -1385,3 +1385,8 @@ sphinx-build -b html docs/source docs/_build/html
 ```
 
 架构笔记、代码规范与安全考量请参见 [`CLAUDE.md`](CLAUDE.md)。
+
+## 安全
+
+请私下报告漏洞。政策、支持版本与操作者注意事项见 [SECURITY.md](SECURITY.md)。
+

README.zh-TW.md

@@ -1386,3 +1386,8 @@ sphinx-build -b html docs/source docs/_build/html
 ```
 
 架構筆記、程式碼慣例與安全考量請參見 [`CLAUDE.md`](CLAUDE.md)。
+
+## 安全性
+
+漏洞請私下回報。政策、支援版本與操作者注意事項見 [SECURITY.md](SECURITY.md)。
+

SECURITY.md

@@ -0,0 +1,39 @@
+# Security policy
+
+## Supported versions
+
+Security fixes are provided for the latest release and the default
+branch. Older releases are not supported. Upgrade before reporting
+an issue that may already be fixed.
+
+## Reporting a vulnerability
+
+Do not open a public issue, pull request, or discussion for a suspected
+vulnerability.
+
+Use either private channel:
+
+- **GitHub Security Advisories.** Open a private report from this
+  repository's Security tab, **Report a vulnerability**. This is the
+  preferred channel.
+- **Email.** `jechenmailman@gmail.com`, with a subject line that begins
+  with `[SECURITY]`.
+
+Include the affected version, platform, impact, and steps to reproduce.
+Do not attach credentials, tokens, or unredacted logs.
+
+The maintainers aim to acknowledge a report within 5 business days, and
+to coordinate a fix and disclosure within 90 days. There is no bug-bounty
+promise.
+
+## Operational notes
+
+Treat archive members as untrusted paths. Do not extract an archive from a
+source you do not trust until extraction is confined to the directory you
+chose.
+
+A secrets provider reads files. Give it only a root it is allowed to read.
+An SFTP or FTP root is a path prefix, not a jail.
+
+A device-code login places the access token in the result and in the GUI
+log. Do not share either.