[junkai-roe-ai]

Resolves the five Oneleet alerts open against roe-python.

Advisory	Package	Change
GHSA-6q48-6c7w-9gw2	certifi	2025.8.3 → 2026.10.19
CVE-2026-63374, CVE-2026-64847	anyio	4.10.0 → 4.15.1
CVE-2026-105801	openapi-python-client	0.28.3 → 0.29.1
GHSA-vxmw-7h4f-hqxh	pypa/gh-action-pypi-publish	release/v1 → v1.14.3

Note on openapi-python-client

0.29 requires Python 3.11+, while the SDK supports 3.10. The codegen dependency is gated on python_version >= '3.11', so the SDK's requires-python is unchanged. It is only used by scripts/generate-sdk.

The SDK code is not regenerated in this PR. Running scripts/generate-sdk with 0.29.1 produces code that uses StrEnum and datetime.fromisoformat, which would break SDK users on Python 3.10. The next regeneration will hit this, so we should decide whether to drop 3.10 support (it reaches end-of-life this month) or pin the templates before then.

Testing

• uv run pytest: 62 passed
• uv lock --check: in sync (lock revision unchanged)
• The publish workflow change is not exercised until the next v* tag.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 4/5

[Medium impact] The changes reach SDK dependency installs, code generation, and release publishing.

Fix the code generation check before merging.

Findings

1.  Code generation check fails ▶

Summary

Updates the locked security dependencies and pins the PyPI publishing action.

• The SDK's locked networking packages move to newer releases.
• Code generation uses version 0.29.1 on Python 3.11 and newer.
• The PyPI release workflow uses a fixed publisher version.

_{Reviews (1) · Last reviewed commit: "Resolve Oneleet security advisories for ..." · Reviewed by Greptile}

[greptile-apps]

Code generation check fails

check-codegen-drift runs the upgraded generator on Python 3.11.9, replaces src/roe/_generated, and checks that the result matches the committed files. Those files still use Enum, while the PR description confirms that 0.29.1 generates StrEnum. The existing CI job therefore fails now, not just on the next manual regeneration.

Preserve the current output with compatible templates, or update the generated files alongside the Python support decision.