chore(deps): bump google-api-core from 2.33.0 to 2.34.0 - #917
chore(deps): bump google-api-core from 2.33.0 to 2.34.0#917dependabot[bot] wants to merge 3 commits into
Conversation
Bumps [google-api-core](https://github.com/googleapis/google-cloud-python) from 2.33.0 to 2.34.0. - [Release notes](https://github.com/googleapis/google-cloud-python/releases) - [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/CHANGELOG.md) - [Commits](googleapis/google-cloud-python@google-api-core-v2.33.0...google-api-core-v2.34.0) --- updated-dependencies: - dependency-name: google-api-core dependency-version: 2.34.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
Exact-head fail-closed RCA for
|
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (5 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (5 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: strix-google-api-core-pin.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: strix-google-api-core-pin.md"]
R2 --> V2["docs review"]
Evidence --> S3["CI script: materialize_base_python_requirements.py"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script: materialize_base_python_requirements.py"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: The 3-insertion/3-deletion bump in requirements-strix-ci-hashes.txt fully implements the Dependabot intent (google-api-core 2.33.0 to 2.34.0 with matching sha256 digests); the changed file was inspected via the trusted focused hunk (receipt region lines 697-699). Verification posture: current-head Failed GitHub Check evidence records no completed failed checks for head b9fb68a; mergeStateStatus blocked is branch-policy state (mergeable true, not DIRTY/CONFLICTING); the repo test contract python3 -m pytest tests exists but no changed source or tests exist to run. Linter/static: no lint gate applies to the changed lock entry (hadolint, bandit, pip_audit, trivy, npm audit target source/containers, not this file). TDD/regression: no behavior surface changed; regression coverage is the hash-locked Strix CI install that consumes this file. Coverage: Coverage execution evidence result PASS with test coverage explicitly not applicable (no supported changed source files or package manifests). Docstring coverage: not applicable per Coverage execution evidence (no supported changed source files or package manifests). DAG: source-backed base-to-head flowchart requirements-strix-ci-hashes.txt bump -> Strix CI hash-locked install -> Strix quality gates; CodeGraph changed-scope exploration found no code call edges for the lockfile (only test-helper symbol matches). PoC/execution: no OPENCODE_EXECUTION_RECEIPT exists for this run; verification rests on trusted diff, check, and coverage evidence, not on executed commands. DDD/domain: no domain logic touched; the entry is an infrastructure lock contract. CDD/context: no context boundary changed. Similar issues: repo history shows the identical bump pattern merged for 2.31.0 to 2.33.0 (commit 3f65dbe, PR #602) and a prior Strix lock security refresh (commit 7616fd8). Claim/concept check: the PR body (Dependabot release notes for google-api-core v2.34.0) matches the version pin and digest update in the diff. Standards search: PEP 610 hash-lock grammar (sha256, 64-hex digests, backslash continuations) is preserved and matches adjacent entries; no other external standard is material to this lock-only change. Compatibility/convention: no new identifiers, objects, routes, or config keys; naming and reserved-word review is N/A because the changed surface carries no externally meaningful names beyond the PEP 503 token google-api-core==2.34.0. Breaking-change/backcompat: point-release bump of an already-pinned transitive dependency of the unchanged google-cloud-* consumers; no repo API or contract change. Implementation completeness: the lock entry is complete (version pin plus two digests plus unchanged via annotations); no placeholder or stub surfaces exist. Performance: no runtime path changed. Developer experience: DX surface is the Dependabot refresh flow for the Strix CI lock, consistent with prior merged bumps and the CI-consumed lock snapshot pattern. User experience: no end-user surface; the non-web interaction surface reviewed is the Strix CI hash-locked install contract and review-comment output. Visual/DOM: non-web change; no Playwright visual/DOM/ARIA evidence applies and no browser execution receipt exists. Accessibility/i18n: no interactive or localized surface changed. Supply-chain/license: the two new sha256 digests pin exact 2.34.0 distributions (fail-closed install); no new dependency or license surface is added (same already-pinned package, point release). Packaging: lockfile grammar and continuation style match PEP 610 and the surrounding file. Security/privacy: hash-locked install prevents unpinned supply-chain drift; no secrets, auth, identifiers, or sequential-id exposure in the change.
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including requirements-strix-ci-hashes.txt.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports test coverage as not applicable because no supported changed source files or package manifests were found.
Docstring coverage: coverage execution evidence reports docstring coverage as not applicable because no supported changed source files or package manifests were found.
DAG: CodeGraph/source-backed behavior map connects requirements-strix-ci-hashes.txt to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source claims require trusted bounded source evidence prepared outside the isolated model process; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: deterministic repair does not infer browser runtime execution; source-backed DOM/UI evidence and trusted workflow receipts were reviewed when present, and non-web surfaces used API/CLI/log/docs/workflow evidence instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
Adversarial validation
{"status":"passed","probes":[{"path":"requirements-strix-ci-hashes.txt","line":697,"hypothesis":"The bumped google-api-core entry breaks pip --require-hashes grammar (malformed version token, non-hex or wrong-length digest, broken line continuation), so the locked Strix CI install would reject the file.","attack_or_counterexample":"The exact new entry bytes shown in the focused changed hunk: google-api-core==2.34.0 with two --hash=sha256: lines, each 64 lowercase hex chars with backslash continuations, compared against the removed 2.33.0 entry and the adjacent frozenlist/fsspec/google-auth entries.","evidence":"Trusted current-head diff at requirements-strix-ci-hashes.txt:697 shows the new google-api-core==2.34.0 entry replacing 2.33.0 with exactly two 64-char lowercase-hex sha256 digests and continuation style identical to surrounding entries; diff stat confirms a balanced 3-insertion/3-deletion patch; the identical bump pattern 2.31.0 to 2.33.0 was previously merged (commit 3f65dbee, PR #602) and passed the same CI install contract; source-line-sha256=51a5bba794da2dbecc7f0edd67e09fde1d7a770cbf65693c3eb71652fa036915","outcome":"falsified"},{"path":"requirements-strix-ci-hashes.txt","line":699,"hypothesis":"A stale or mismatched sha256 digest was introduced (e.g., copied from the old 2.33.0 release or an unrelated artifact), so hash verification at install time would fail or silently pin the wrong artifact.","attack_or_counterexample":"Compare the two new digests shown in the hunk (98a779fe... and cdf9c67e...) against the two removed 2.33.0 digests (3a36bcc3... and a2e22a0c...) for any copied or stale value.","evidence":"Trusted current-head diff at requirements-strix-ci-hashes.txt:699 shows the new digests differ from both removed 2.33.0 digests and are valid 64-char lowercase-hex sha256 strings; current-head Failed GitHub Check evidence records no completed failed checks for head b9fb68ac and Coverage execution evidence classifies the change as lock-only with no supported package manifest changed; the Strix CI install consumes this hash-locked file, so a wrong digest fails closed at first install rather than silently drifting; source-line-sha256=1438a0b97d1d0ef38c017ad96753c28b8c6f3b28ffe00240467cb50877de74bb","outcome":"falsified"}],"residual_risk":"The two new sha256 digests cannot be independently recomputed against PyPI from this offline environment; digest correctness rests on the Dependabot-generated lock mechanism, the repo's merged precedent (2.31.0 to 2.33.0, PR #602), and the absence of failed checks at head. The failure mode is fail-closed: a wrong digest aborts the first hash-locked Strix CI install, so no silent supply-chain drift is possible."}- Result: APPROVE
- Reason: Lock-only Dependabot bump of google-api-core 2.33.0 to 2.34.0 in requirements-strix-ci-hashes.txt; PEP 610 hash grammar preserved with two valid 64-hex sha256 digests, balanced 3/3 diff, no completed failed checks at head b9fb68a, coverage evidence PASS (not applicable), and no unresolved review threads.
- Head SHA:
b9fb68ace2f80ab2c2b078b955b197228bb031f0 - Workflow run: 31562565945
- Workflow attempt: 1
|
Exact-head dependency review for The diff is mechanically bounded to the The first causal boundary is the incomplete permanent path trigger repaired by #935. Do not treat the absent gate as success and do not arm auto-merge yet. After #935 reaches protected |
|
Exact-head gate status for Do not approve or merge until #935 is protected-merged (or equivalent permanent trigger behavior exists), the branch is rebased/recreated if required, and the resulting exact head passes the full hash-locked Strix dependency-lock, import, model-pool, syntax, and clean-worktree quality contract. Any head mutation invalidates prior evidence. |
CWE-494/CWE-829: the Strix --require-hashes lock must keep both published SHA-256 digests and must not retain 2.33.0.
Materialize a base Python lock only when every package line is an exact SHA-256 pin or a two-token relative -r/--requirement include of a candidate lock path. A lone --require-hashes directive, ./dotted paths, and -r other-hashes.txt no longer enter the trusted build context.
|
@opencode-agent review Re-evaluate exact current head |
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
1d853876d6e37ab727a45890939177af89f37dcc. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- CodeQL PR/Detect CodeQL languages: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264086/job/94518544824)
- Detect CodeQL languages check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264086/job/94518544824)
- OSV-Scanner PR/osv-scan / osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264578/job/94518546674)
- Python 3.10 compatibility contract check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264046/job/94518544738)
- Python 3.14 full quality gate check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264046/job/94518544564)
- Python Security/pip-audit (Python dependency audit): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264084/job/94522596987)
- SAST Semgrep/Semgrep (multi-language SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264151/job/94518544759)
- Scorecard PR/Scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264074/job/94518544881)
- Scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264074/job/94518544881)
- Secret Scan/gitleaks (secret scan): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264115/job/94518547017)
- Security Scan/osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264097/job/94518545254)
- Security Scan/scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264097/job/94518545336)
- Security Scan/trivy-fs: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264097/job/94518545061)
- Semgrep (multi-language SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264151/job/94518544759)
- Trusted uv Materializer Quality CI/Python 3.10 compatibility contract: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264046/job/94518544738)
- Trusted uv Materializer Quality CI/Python 3.14 full quality gate: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264046/job/94518544564)
- coverage-source-tree check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264191/job/94522772006)
- gitleaks (secret scan) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264115/job/94518547017)
- osv-scan / osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264578/job/94518546674)
- osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264097/job/94518545254)
- pip-audit (Python dependency audit) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264084/job/94522596987)
- scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264097/job/94518545336)
- trivy-fs check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31721264097/job/94518545061)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (5 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (5 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: strix-google-api-core-pin.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: strix-google-api-core-pin.md"]
R2 --> V2["docs review"]
Evidence --> S3["CI script: materialize_base_python_requirements.py"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script: materialize_base_python_requirements.py"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
|
Returned to Draft because this is no longer a clean Dependabot update. The intended slice is the Recreate or rebuild from protected |
|
Closing this current branch rather than merging an overlapping dependency update. The intended |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps google-api-core from 2.33.0 to 2.34.0.
Release notes
Sourced from google-api-core's releases.
Commits
905bfe3chore: release main (#17832)ad8f93cfix(api-core): use truthiness check in setup_request_id to support proto-plus...06dd2c0chore: bump google-api-core to 2.28.0 (#18003)2619725chore: remove bigtable and sqlalchemy-spanner from bulk release due to faili...56b6bd2fix(ci): skip loaded lines calculation on iterations after the first (#17790)08f21a6fix(proto-plus): add context to TypeErrors during message manipulation (#17682)32fd479tests(spanner): avoid table name collisions in tests (#18001)2207ca6feat: add pandas-gbq capability helper (#17957)6167e41fix: deduplicate x-goog-api-client headers (#17616)71bc622docs: add connector libraries overview table to package README (#17939)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)