[Change] Consolidate dependency updates and validate compatible package refresh #747

Why

Open Dependabot PRs #744 and #727 cover only part of the available dependency updates. Hatchling declarations need a coherent frozen-graph refresh, while the JSON 3.x PR also downgrades Jekyll. A complete compatible-package assessment must distinguish resolver success, vulnerability checks, and malicious-package/provenance approval.

What Changes

• Create OpenSpec change dependency-update-consolidation with proposal, design, tasks, scenario specs, and a complete dated dependency audit.
• Inventory runtime, build, all extras, Hatch/test tooling, isolated Code Review requirements, exact pins, and transitives; review intervening releases and assign every package a disposition.
• Consolidate compatible updates through existing resolution and frozen-delivery tooling. The 2026-09-21 scan found Hatchling 1.32.4 beyond PR fix(deps): secure Python dependencies for 0.55.6 #744's 1.32.3 and Pylint 4.0.8 beyond its isolated pin.
• Defer major migrations and the JSON 3.x/Jekyll downgrade. Current JSON 2.21.2 is already the latest stable 2.x registry release.
• Require separate current vulnerability and malicious-package/provenance checks before executing candidate artifacts. Preserve exact artifact hashes, blocked releases, reviewed exceptions, and security-tool floors.
• Verify Python 3.11–3.13, minimal runtime and extras, wheel/install paths, frozen graphs, module compatibility/signatures, and any changed docs graph before the future patch release.

Current evidence and limits

• The inventory covers 187 distinct Python package names across primary and isolated graphs.
• The repository vulnerability gate passed for baseline and candidate primary/isolated exports. Explicit OSV queries covering all inventoried baseline/candidate version pairs returned no advisories at the assessment timestamp.
• These are candidate discovery results, not upgrade approval. Compatibility tests, full intervening-release reviews, and exact-artifact malware/provenance review remain implementation gates.
• Socket's PR fix(deps): secure Python dependencies for 0.55.6 #744 alert check is green but explicitly skipped because it detected no dependency changes; it does not prove the new Hatchling artifact was inspected.
• Retain pycparser 2.22 until a fresh exact-artifact review supports another version; preserve the denied 3.0 family.

Acceptance Criteria

• Every dependency record has declaration/path context, baseline/latest/candidate versions, security evidence, and an explicit upgrade/retain/defer/remove disposition.
• All candidate and baseline graphs are audited, including isolated Code Review tooling and marker branches; unavailable evidence prevents promotion.
• Confirmed malicious/blocked artifacts are rejected; unresolved malware signals are deferred. Vulnerability exceptions satisfy existing exact-version, mitigation, and expiry policy and do not substitute for compatible fixes.
• Declarations, generated locks/exports, artifact identities, related policy, and affected regression expectations agree.
• Required compatibility, frozen delivery, license, vulnerability, Socket, code review, signature, and applicable docs gates pass against the final graph.
• Release metadata is synchronized during implementation, final audits are fresh, and only superseded bot PRs are closed after the replacement merges.

Relationships and scope

• Parent Epic: [Epic] Architecture (CLI structure, modularity, performance) #194; project: SpecFact CLI chore: remove mcp.json from version control #1, Todo.
• Source PRs: fix(deps): secure Python dependencies for 0.55.6 #744 and fix(docs): retain patched compatible JSON 2.x #727. Both target main; future consolidation targets dev and follows normal release promotion.
• Completed foundations: [Change] Reproducible delivery and type authority #651 and [Bug] Remediate frozen dependency security findings and publish patch baseline #686. They are references, not outstanding blockers.
• No outstanding issue-to-issue blocker identified for this proposal. Missing security and compatibility evidence blocks adopting candidates.
• This issue and its first PR are planning only: no package/lock/release bump, runtime policy change, automatic merge, or unrelated security-code fix. Implementation tasks remain unchecked.

OpenSpec Change Proposal: dependency-update-consolidation

Focused implementation amendment — 9 October 2026 (Europe/Berlin)

The owner approved the focused dependency/fixture repair and concurrent ownership as djm81. This amendment records that implementation slice separately from the planning-only first PR #748, whose branch and broader inventory/build/Ruby/release work remain unchanged. PR #756 delivers this slice to repair the baseline blocking #755.

Authorized scope: coherent uv.lock and CI export updates for PyJWT 2.15.1, urllib3 2.8.0, virtualenv 21.11.0, resolver-required Semgrep 1.179.0 and python-discovery 1.6.0; staging only generated project files in the versioning fixture; isolated app data and disabled periodic updates for the ephemeral virtualenv smoke fallback; exact-lock sentinel and JWT/cache regression evidence.

Acceptance criteria:

• Both frozen advisory gates pass without new waivers; exact artifacts, provenance limitations, licenses and Socket outcomes are retained.
• Caller-owned JWT options, expiry on reuse, ordinary tokens/padding, normal HTTP behavior and launcher behavior retain focused regression/control evidence.
• A fresh, immutable authored → RED → repair sequence validates with the existing native verifier and exact-head member authority; unsupported or stale evidence remains failed.
• Current-head ordinary tests, compatibility, built-wheel Python 3.11/3.12/3.13, reproducible delivery, independent static analysis, code review and signatures pass before integration.
• Retain remaining review findings and limitations, then refresh docs: reconcile bounded workflow and risk-first execution #755's baseline and verify its independent current-head checks.

Non-goals: full consolidation, changing CI/proof/trust gates, release/module identity changes, shared user-cache deletion, merging #755, or activating its planned workflow runtime. External previously compromised caches require separate clean recreation. Do not close #747 or archive the broad consolidation after this slice.

This issue amendment records implementation scope; it is not an expiring Trusted Requirements Authority grant. Every such grant remains bound to its own exact commit/tree.

Owner-approved dependency stack — 2026-10-10 (Europe/Berlin)

Implement all five retained PRs in order: dev ← #744 Python/build ← #727 compatible JSON hardening ← #752 redirects ← #754 feeds ← #753 relative links. #744 includes GitPython 3.2.0 and Hatchling 1.32.4; #727 keeps JSON 2.21.2/Jekyll 4.4.1 with >=2.21.2,<3. Prepare one 0.55.5 bugfix release after the live version gate. Preserve merged #756 proof and security repairs; reconcile proposal #748 and the internal wiki. JSON 3 and unselected dependency work remain deferred. Keep this issue open until the broader accepted scope completes.

The human explicitly approved taking over this scope. Signed commits, explicit leases, current artifact review, security/quality/Requirements checks and final-head compatibility are required. This amendment does not grant trusted CI authority or authorize merging/publishing a release.