From b63acb9386f222b16b0527d738ea2d4f6a4e7903 Mon Sep 17 00:00:00 2001 From: Andrew Mello Date: Thu, 29 Oct 2026 04:04:19 -0700 Subject: [PATCH 01/15] ci: move the workflow actions, promtool and Chrome to their latest releases Each action stays pinned to the commit of its release tag, read with `gh api repos//commits/` on 2026-10-29. - actions/checkout v6.1.0 -> v7.0.1 in every workflow (docs.yml already ran v7.0.1). v7 blocks checking out a fork PR under pull_request_target and workflow_run; no workflow here uses either trigger. - docker/setup-buildx-action v3.12.0 -> v4.4.1, docker/login-action v3.7.0 -> v4.7.0, docker/build-push-action v6.19.2 -> v7.4.0. The majors move to Node 24 and drop deprecated inputs and the DOCKER_BUILD_* envs; build-and-push.yml uses none of them. - softprops/action-gh-release v2.6.2 -> v3.0.3 (Node 24 runtime, same inputs). - hadolint/hadolint-action v3.3.0 -> v3.5.0, which bundles hadolint 2.15.1, the version the devcontainer pins. - KSXGitHub/github-actions-deploy-aur v4.1.3 -> v4.2.0 (adds asset_dir; pkgbuild and the other inputs we pass are unchanged). - promtool 3.15.0 -> 3.15.1, with the sha256 from its sha256sums.txt. - Chrome for Testing 155.0.8059.84 -> 156.0.8078.73, the current Stable. --- .github/workflows/aur-deploy.yml | 4 +- .github/workflows/auto-release.yml | 2 +- .github/workflows/build-and-push.yml | 24 ++++----- .github/workflows/ci.yml | 78 ++++++++++++++-------------- .github/workflows/packages.yml | 6 +-- docs/telemetry.md | 2 +- 6 files changed, 58 insertions(+), 58 deletions(-) diff --git a/.github/workflows/aur-deploy.yml b/.github/workflows/aur-deploy.yml index 846d1cda..873b7f42 100644 --- a/.github/workflows/aur-deploy.yml +++ b/.github/workflows/aur-deploy.yml @@ -16,7 +16,7 @@ jobs: name: Publish k3d-gpu to AUR runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.version && format('aur-v{0}', inputs.version) || github.ref }} @@ -36,7 +36,7 @@ jobs: sed -i "s/^pkgrel=.*/pkgrel=1/" packaging/aur/PKGBUILD - name: Publish to AUR - uses: KSXGitHub/github-actions-deploy-aur@da03e160361ce01bf087e790b6ffd196d7dccff7 # v4.1.3 + uses: KSXGitHub/github-actions-deploy-aur@084b0d9b15415bf9cdb65d44dad1efe37a354050 # v4.2.0 with: pkgname: k3d-gpu pkgbuild: packaging/aur/PKGBUILD diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml index caabf402..82cd1cd6 100644 --- a/.github/workflows/auto-release.yml +++ b/.github/workflows/auto-release.yml @@ -40,7 +40,7 @@ jobs: group: auto-release-${{ github.event_name }} cancel-in-progress: false steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: main fetch-depth: 0 diff --git a/.github/workflows/build-and-push.yml b/.github/workflows/build-and-push.yml index 8550ab5c..46c75bd8 100644 --- a/.github/workflows/build-and-push.yml +++ b/.github/workflows/build-and-push.yml @@ -44,7 +44,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout main - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: main fetch-depth: 0 @@ -300,7 +300,7 @@ jobs: [[ "$RELEASE" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "::error::release '$RELEASE' is not X.Y.Z"; exit 1; } - name: Checkout release tag - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: aur-v${{ inputs.release }} @@ -322,16 +322,16 @@ jobs: echo "ubuntu2404=$u" >> "$GITHUB_OUTPUT" - name: Set up Docker Buildx - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Login to DockerHub - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Login to GitHub Container Registry - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -350,7 +350,7 @@ jobs: # Ubuntu 26.04 is the default (:latest and :X.Y.Z); 24.04 is also published. # Each carries the baked device plugins, so clusters expose GPUs with no apply. - name: Build & push — Ubuntu 26.04 (default / latest) - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . push: true @@ -371,7 +371,7 @@ jobs: ghcr.io/${{ github.repository_owner }}/k3d-gpu:${{ steps.current.outputs.k3s }}-ubuntu26.04 - name: Build & push — Ubuntu 24.04 (variant) - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . push: true @@ -390,7 +390,7 @@ jobs: ghcr.io/${{ github.repository_owner }}/k3d-gpu:${{ steps.current.outputs.k3s }}-ubuntu24.04 - name: Create GitHub Release - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -451,7 +451,7 @@ jobs: names: ${{ steps.list.outputs.names }} steps: - name: Checkout main - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -474,7 +474,7 @@ jobs: COMPONENT: ${{ matrix.component }} steps: - name: Checkout main - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install pinned helm run: | @@ -545,7 +545,7 @@ jobs: pull-requests: write steps: - name: Checkout main - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: main @@ -639,7 +639,7 @@ jobs: pull-requests: write steps: - name: Checkout main - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: main diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 00bf2c28..90f4bde3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,7 +19,7 @@ jobs: name: Shellcheck runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0 with: scandir: . @@ -30,7 +30,7 @@ jobs: name: Workflow lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # rhysd/actionlint, pinned by digest in hack/ci-images.env (the nightly repin moves it). - name: actionlint run: | @@ -41,7 +41,7 @@ jobs: name: Detection tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: tests/detect_test.sh - run: tests/kube_context_test.sh - run: tests/image_test.sh @@ -60,7 +60,7 @@ jobs: name: Quickstart, uninstall and installer runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: tests/quickstart_test.sh - run: tests/quickstart_adversarial_test.sh @@ -68,7 +68,7 @@ jobs: name: Launcher input properties (fuzz) runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # A fresh seed each run; a failure prints its FUZZ_SEED replay line. - run: python3 tests/fuzz/props.py @@ -76,7 +76,7 @@ jobs: name: Remote OpenAI endpoints (resolver, Secret, sandbox egress, redaction) runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: python3 tests/remote_test.py - run: tests/remote_test.sh @@ -84,12 +84,12 @@ jobs: name: Telemetry manifests runs-on: ubuntu-latest env: - PROMETHEUS_VERSION: 3.15.0 - PROMETHEUS_SHA256: 2a542df32eac02ee17b9d844fb2aa1de00dafa5476579ba8a3ba862e9d572ea0 + PROMETHEUS_VERSION: 3.15.1 + PROMETHEUS_SHA256: 6a726885328ad9efebbf36e876ce2fb6225468a71fd1e7ce3ba666d5f4d97a84 # ghcr.io/yannh/kubeconform:v0.8.0 KUBECONFORM_IMAGE: ghcr.io/yannh/kubeconform@sha256:faffaf43f95aa6425306e1ab8d6fcad72acb9049158f38e574c085ea1ec0f64e steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install promtool run: | tgz="prometheus-${PROMETHEUS_VERSION}.linux-amd64.tar.gz" @@ -108,21 +108,21 @@ jobs: name: Agent manifests (kubeconform) runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: tests/agent_kubeconform.sh intel-gpu-dra-manifests: name: Intel GPU DRA manifests (kubeconform) runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: tests/kubeconform.sh share-manifests: name: share/ manifests (kubeconform, CRD schemas) runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: sudo apt-get update && sudo apt-get install -y --no-install-recommends python3-yaml - run: tests/share_kubeconform.sh @@ -130,7 +130,7 @@ jobs: name: Console spine (facts/v1, plan, audit) runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install jsonschema for the schema cross-check (pinned) run: python3 -m venv /tmp/jsonschema && /tmp/jsonschema/bin/pip install --disable-pip-version-check jsonschema==4.26.0 - env: @@ -152,7 +152,7 @@ jobs: name: images.lock complete, every image pinned by digest runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: scripts/images-lock check - run: tests/image_pins_test.sh @@ -160,11 +160,11 @@ jobs: name: report.html (goldens, offline load in headless Chrome) runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - id: chrome uses: browser-actions/setup-chrome@48ad923757ca74d66703209fe939badbdf80f2f4 # v2.2.0 with: - chrome-version: 155.0.8059.84 + chrome-version: 156.0.8078.73 # The headless load runs Chrome in a network namespace (unshare -rn); # Ubuntu's AppArmor blocks unprivileged user namespaces by default. - run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 @@ -177,7 +177,7 @@ jobs: name: Capacity oracle (schema, privacy, validator, fuzz, matrix, leaderboard, share) runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # V4 reads the server image each release tag pins - run: python3 oracle/test_oracle.py @@ -200,7 +200,7 @@ jobs: name: Docs claims guard runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: tests/claims_check_test.sh - run: tests/claims_check.sh - run: python3 tests/ledger_drift_check_test.py @@ -213,7 +213,7 @@ jobs: name: Bench harness tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: tests/bench_test.sh - run: tests/autoquant_test.sh - run: tests/bench_vs_test.sh @@ -222,7 +222,7 @@ jobs: name: k3d-gpu fit and guard tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # tests/fit_test.py (the fit arithmetic on fixture hosts and models, the guard # under simulated PSI) and the launcher's fit, agent manifest and agent guard. - run: tests/fit_test.sh @@ -234,7 +234,7 @@ jobs: name: k3d-gpu tune tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # TUNE_E2E_FULL: two whole tunes against tests/fake_ovms.py, one where no # config changes the speed (must keep the default) and one with a real winner. - run: tests/tune_test.sh @@ -245,7 +245,7 @@ jobs: name: k3d-gpu capacity tests (stub server) runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: python3 bench/apb/test_capacity.py - run: python3 bench/apb/test_apb.py - run: python3 bench/apb/test_stage.py @@ -276,14 +276,14 @@ jobs: name: MCP server tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: tests/mcp_test.sh kuberay-example: name: KubeRay example (static) runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: sudo apt-get update && sudo apt-get install -y python3-yaml - run: tests/kuberay_test.sh @@ -294,7 +294,7 @@ jobs: KUBECONFORM_VERSION: v0.8.0 KUBECONFORM_SHA256: 9bc2bffbf71f261128533edaf912153948b7ff238f9a531ae6d34466ec287883 steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install kubeconform run: | curl -fsSL -o kubeconform.tar.gz \ @@ -312,7 +312,7 @@ jobs: outputs: platforms: ${{ steps.list.outputs.platforms }} steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - id: list run: echo "platforms=$(tests/sim_matrix_test.sh --list-json)" >> "$GITHUB_OUTPUT" @@ -325,7 +325,7 @@ jobs: matrix: platform: ${{ fromJSON(needs.sim-fixtures.outputs.platforms) }} steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - env: PLATFORM: ${{ matrix.platform }} run: tests/sim_matrix_test.sh "$PLATFORM" @@ -338,21 +338,21 @@ jobs: matrix: example: [openai-agents, langgraph, crewai, llamaindex, litellm-gateway] steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: tests/agent_examples_test.sh "${{ matrix.example }}" register-model-test: name: LiteLLM register-model.sh runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: tests/register_model_test.sh render: name: Rendered components runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install pinned helm run: | hack/install-helm "$RUNNER_TEMP/bin" @@ -370,36 +370,36 @@ jobs: name: Packaging consistency tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: tests/packaging_test.sh deb-rpm: name: Build and test .deb + .rpm (nfpm) runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: packaging/check.sh nfpm homebrew: name: Homebrew formula style, audit, install, test runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: packaging/check.sh brew nix-flake: name: Nix flake check runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: packaging/check.sh nix hadolint: name: Dockerfile lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0 with: dockerfile: Dockerfile failure-threshold: error @@ -412,7 +412,7 @@ jobs: outputs: ref: ${{ steps.pin.outputs.ref }} steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: sparse-checkout: hack persist-credentials: false @@ -428,7 +428,7 @@ jobs: runs-on: ubuntu-latest container: ${{ needs.arch-image.outputs.ref }} steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install tools run: pacman -Sy --noconfirm namcap base-devel - name: Create builder user @@ -450,7 +450,7 @@ jobs: KUBECONFORM_VERSION: v0.8.0 KUBECONFORM_SHA256: 9bc2bffbf71f261128533edaf912153948b7ff238f9a531ae6d34466ec287883 steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 with: version: v4.3.1 diff --git a/.github/workflows/packages.yml b/.github/workflows/packages.yml index 3a7e6315..419040bc 100644 --- a/.github/workflows/packages.yml +++ b/.github/workflows/packages.yml @@ -54,7 +54,7 @@ jobs: echo "ver=${VER}" >> "$GITHUB_OUTPUT" echo "tag=aur-v${VER}" >> "$GITHUB_OUTPUT" - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.dry_run && github.sha || steps.ver.outputs.tag }} @@ -93,7 +93,7 @@ jobs: [[ "${VER}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "::error::bad version '${VER}'"; exit 1; } echo "ver=${VER}" >> "$GITHUB_OUTPUT" - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.dry_run && github.sha || 'main' }} fetch-depth: 0 @@ -155,7 +155,7 @@ jobs: [[ "${VER}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "::error::bad version '${VER}'"; exit 1; } echo "ver=${VER}" >> "$GITHUB_OUTPUT" - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: main fetch-depth: 0 diff --git a/docs/telemetry.md b/docs/telemetry.md index a3d11440..922b3146 100644 --- a/docs/telemetry.md +++ b/docs/telemetry.md @@ -254,7 +254,7 @@ Run without a cluster: E-cores offline, non-hybrid), and the AUR `package()` function, which must install every manifest under `/usr/share/k3d-gpu/telemetry/`. When `promtool` is on PATH, it also runs `promtool check metrics` on the script output and `promtool test rules` on the - recording rules with `tests/telemetry-rules.test.yml`. CI's `telemetry-tests` job installs promtool 3.15.0 (sha256-checked) and runs it with the rules test. + recording rules with `tests/telemetry-rules.test.yml`. CI's `telemetry-tests` job installs promtool 3.15.1 (sha256-checked) and runs it with the rules test. - `kubeconform -kubernetes-version -strict share/telemetry share/telemetry/optional` (CI runs this in the same job): 29 resources valid. - `promtool check config` on the extracted `prometheus.yml`: valid, 3 rules. From 8960ce3ddffa4588d144e0e0e1b0abc0a5f9d337 Mon Sep 17 00:00:00 2001 From: Andrew Mello Date: Thu, 29 Oct 2026 04:04:25 -0700 Subject: [PATCH 02/15] packaging: kubectl v1.37.2, nixpkgs nixos-26.05 head, nixos/nix 2.35.4 and Homebrew 7.0.11 - install.sh installs kubectl v1.37.2 (dl.k8s.io stable.txt, 2026-10-28), with the amd64 and arm64 sha256 from dl.k8s.io. - flake.lock moves nixpkgs to the nixos-26.05 head 08d3a975 (2026-10-28), regenerated by packaging/nix-check.sh with K3D_GPU_NIX_LOCK=1. - The nix check image moves to nixos/nix 2.35.4 and the Homebrew image to ghcr.io/homebrew/brew 7.0.11, both by digest. - Homebrew 7.0.11 loads a non-official tap's formulae implicitly only for install, reinstall and upgrade (Homebrew/brew#24352). brew style, audit, test and linkage then refuse the staged tap, so homebrew-check.sh trusts it with `brew trust --tap` right after tapping it. --- flake.lock | 6 +++--- packaging/check.sh | 4 ++-- packaging/homebrew-check.sh | 3 +++ packaging/install.sh | 6 +++--- 4 files changed, 11 insertions(+), 8 deletions(-) diff --git a/flake.lock b/flake.lock index 84c70958..a296d4ec 100644 --- a/flake.lock +++ b/flake.lock @@ -2,11 +2,11 @@ "nodes": { "nixpkgs": { "locked": { - "lastModified": 1792030654, - "narHash": "sha256-OaQwAtPMTjQiY2sT/2/62UbSPhzP/0aDnWzMm/NCiUw=", + "lastModified": 1793183032, + "narHash": "sha256-56mFMf8heLNfYhcgbrh4GpN5x+G9JOfTFXZC3n6w0qM=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "26f4107e47e3ad0ffd0db220469ba83b6f6d96e8", + "rev": "08d3a97586f6b6343b3b5e799980773629432610", "type": "github" }, "original": { diff --git a/packaging/check.sh b/packaging/check.sh index 9fafe72e..9659c2c9 100755 --- a/packaging/check.sh +++ b/packaging/check.sh @@ -13,8 +13,8 @@ set -euo pipefail NFPM_IMAGE="${NFPM_IMAGE:-goreleaser/nfpm:v2.48.0@sha256:d57a1452e7a019896b355f7b1ec67262278f6c503631f652d4fce7aef9ac8df7}" DEBIAN_IMAGE="${DEBIAN_IMAGE:-debian:trixie-slim@sha256:f6b08b09a05725f9431502d3b5714f5c4576e82c1a84fa1debe0c24a7e0c3ec4}" FEDORA_IMAGE="${FEDORA_IMAGE:-fedora:44@sha256:43b29f65a41eb9c35e1cd5323e3bdf3b655c2357a9f4f1ff2f9c2798e5045d80}" -BREW_IMAGE="${BREW_IMAGE:-ghcr.io/homebrew/brew:7.0.9@sha256:00b643d72ab0ee27c64e3e552d08c66e1bb5272bdf4ed28964e27aa5764f2503}" -NIX_IMAGE="${NIX_IMAGE:-nixos/nix:2.35.3@sha256:ff480dbb23511aa1c10710aa068ceea5b93fed9bfce5f5379f3a6b07282cbc7b}" +BREW_IMAGE="${BREW_IMAGE:-ghcr.io/homebrew/brew:7.0.11@sha256:e50d8c463824f72b0c2972815ebff2d59982280201cb0a650ecb452d737a5e5a}" +NIX_IMAGE="${NIX_IMAGE:-nixos/nix:2.35.4@sha256:f159a58f390677f41e8e900a74b6e2f9c7f27b364122ae6acf7a652ce6c551c0}" ROOT="$(cd "$(dirname "$0")/.." && pwd)" DIST="${K3D_GPU_DIST:-${ROOT}/dist}" diff --git a/packaging/homebrew-check.sh b/packaging/homebrew-check.sh index 15f7cf29..a804e72c 100755 --- a/packaging/homebrew-check.sh +++ b/packaging/homebrew-check.sh @@ -15,6 +15,9 @@ git -C "${tap}" init -q git -C "${tap}" -c user.name=ci -c user.email=ci@localhost add -A git -C "${tap}" -c user.name=ci -c user.email=ci@localhost commit -qm formula brew tap 88plug/k3d-gpu "${tap}" +# Homebrew 7.0.11 loads a non-official tap's formulae only for install commands +# unless the tap is trusted; style, audit, test and linkage need the trust. +brew trust --tap 88plug/k3d-gpu brew style 88plug/k3d-gpu/k3d-gpu brew audit --strict 88plug/k3d-gpu/k3d-gpu diff --git a/packaging/install.sh b/packaging/install.sh index 64412b0c..1f7076fe 100755 --- a/packaging/install.sh +++ b/packaging/install.sh @@ -36,9 +36,9 @@ K3D_GPU_RPM_SHA256=f9bae4fc4ab1b118b2a4da782d496029d26aa4c15a9b614bd48df4e0d0196 K3D_VERSION=v5.9.0 K3D_SHA256_AMD64=06d8f25bc3a971c4eb29e0ff08429b180402db0f4dec838c9eac427e296800a0 K3D_SHA256_ARM64=03cde5cf23e6e8e67de5a039ecf26e5b85aca82fba3e5d13dadf904cd218a250 -KUBECTL_VERSION=v1.37.1 -KUBECTL_SHA256_AMD64=65691ff77eb6fa44c908b77a1082c9f092c3b9733b5cefabec0d1104890e21a8 -KUBECTL_SHA256_ARM64=ff749f4b78d9c4f1ec87307df9b50119ed819e2094aa9810cb9acffc3286c8c7 +KUBECTL_VERSION=v1.37.2 +KUBECTL_SHA256_AMD64=c04487523e7aa7d1493f7808174c899db93d7a9cf57531420cd76b9bd415f8f4 +KUBECTL_SHA256_ARM64=fcc16f63186659d9722014b7e02d5fdd2d4e669cb8c0ab66365d7d3b8ba03509 # First k3d-gpu release with the quickstart command; the closing hint follows it. QUICKSTART_SINCE=0.1.33 From f2411652ea44065e806632b8e00a862b49e6041e Mon Sep 17 00:00:00 2001 From: Andrew Mello Date: Thu, 29 Oct 2026 04:04:34 -0700 Subject: [PATCH 03/15] docs-build: Python 3.15.2 and mkdocs-material 9.8.0, lock regenerated The docs interpreter moves from python:3.14.8-slim to python:3.15.2-slim, the newest Python release (2026-10-25), pinned by its index digest. mkdocs-material moves to 9.8.0. requirements.txt is regenerated from scratch with docs-build/lock.sh in that image, so every transitive pin is the newest the direct pins allow: certifi 2026.10.23, markdown 3.11.2, platformdirs 4.14.0, python-dateutil 3.0.0 and tzdata 2026.6 (new, from dateutil 3). mkdocs 1.6.1 and pymdown-extensions 12.3 are already their latest releases. In that image the hashed install, tests/docs_test.sh (63 passed) and `mkdocs build --strict` all pass. --- docs-build/Dockerfile | 2 +- docs-build/requirements.in | 2 +- docs-build/requirements.txt | 36 ++++++++++++++++++++---------------- 3 files changed, 22 insertions(+), 18 deletions(-) diff --git a/docs-build/Dockerfile b/docs-build/Dockerfile index 6c6a5981..c18ec8a8 100644 --- a/docs-build/Dockerfile +++ b/docs-build/Dockerfile @@ -1,4 +1,4 @@ # Interpreter pin for the docs toolchain. Not built: it exists so Dependabot's # docker ecosystem can bump it. The Docs workflow's `container: image:` and # docs-build/lock.sh use this exact image; tests/docs_test.sh checks they match. -FROM python:3.14.8-slim@sha256:fbecd461fc72d21b2143c6eaba25143738079154a6d0ea3da3aec724f50eed4a +FROM python:3.15.2-slim@sha256:c4158543ecb725b99e57d129dfd43d761d4c43e4577b5e23326aabb223cf7f4e diff --git a/docs-build/requirements.in b/docs-build/requirements.in index b43a3b84..00ac9ed9 100644 --- a/docs-build/requirements.in +++ b/docs-build/requirements.in @@ -1,5 +1,5 @@ # Docs site toolchain (direct dependencies). requirements.txt is the hashed lock: # regenerate it with docs-build/lock.sh, never by hand. mkdocs==1.6.1 -mkdocs-material==9.7.7 +mkdocs-material==9.8.0 pymdown-extensions==12.3 diff --git a/docs-build/requirements.txt b/docs-build/requirements.txt index 994ef6f6..4919a1f5 100644 --- a/docs-build/requirements.txt +++ b/docs-build/requirements.txt @@ -1,5 +1,5 @@ # -# This file is autogenerated by pip-compile with Python 3.14 +# This file is autogenerated by pip-compile with Python 3.15 # by the following command: # # pip-compile --allow-unsafe --generate-hashes --output-file=requirements.txt --strip-extras requirements.in @@ -17,9 +17,9 @@ backrefs==8.1 \ --hash=sha256:db577dbae1c61187534d35fc9bfbd0c01158fff6239a66fecf7590e5b17879a9 \ --hash=sha256:f86d9312df3ebae1241758af80809a319cafa1d8f32189edfb242c9aa55573b6 # via mkdocs-material -certifi==2026.7.22 \ - --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \ - --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55 +certifi==2026.10.23 \ + --hash=sha256:a9895e6e2758b371e0545e321a3a8fd1fcfd9829ada8824a936dfb16aaaf36cd \ + --hash=sha256:e9b54de76e530bb6cf0ccd036787103acb58fd42ba930ea8bf948ddbaa2f61d1 # via requests charset-normalizer==3.5.2 \ --hash=sha256:01077390b03f7988f11d700a2194e69b119741a86b1a638b1db88891e3eced8e \ @@ -217,9 +217,9 @@ jinja2==3.1.6 \ # via # mkdocs # mkdocs-material -markdown==3.11.1 \ - --hash=sha256:496f4f80f9ebd3395a04c8ec9595c40bbe8ec19e9c67d21fe071a1643e876606 \ - --hash=sha256:f1fa378ba5d682900c9ecb55ccceacca936016dda7c3b27097e8ae03ff78feb5 +markdown==3.11.2 \ + --hash=sha256:87bf5d90f2d2882e2c02fcda182c2800456b985bff38913867c49706481514b0 \ + --hash=sha256:f80390747a2a0ff2ba54da074ce4f862f72a6685f608cd2637b646a6d83993f5 # via # mkdocs # mkdocs-material @@ -395,9 +395,9 @@ mkdocs-get-deps==0.2.2 \ --hash=sha256:8ee8d5f316cdbbb2834bc1df6e69c08fe769a83e040060de26d3c19fad3599a1 \ --hash=sha256:e7878cbeac04860b8b5e0ca31d3abad3df9411a75a32cde82f8e44b6c16ff650 # via mkdocs -mkdocs-material==9.7.7 \ - --hash=sha256:8ea9bb1737a5b524a5f9dcf2e1b4ebda8274ae3008aa7845720a97083bef708f \ - --hash=sha256:c0649c065b1b0512d60aad8c10f947f8e455284475239b364b610f2deb4d0855 +mkdocs-material==9.8.0 \ + --hash=sha256:19304a7263c5700428227122b3b2699aa73f432c9de8816876adaec7d7293ce3 \ + --hash=sha256:1ed4c5edaf405a3fb62e55288b8fdff592971729361548b1ffa757bf9849fb81 # via -r requirements.in mkdocs-material-extensions==1.3.1 \ --hash=sha256:10c9511cea88f568257f960358a467d12b970e1f7b2c0e5fb2bb48cab1928443 \ @@ -415,9 +415,9 @@ pathspec==1.1.1 \ --hash=sha256:17db5ecd524104a120e173814c90367a96a98d07c45b2e10c2f3919fff91bf5a \ --hash=sha256:a00ce642f577bf7f473932318056212bc4f8bfdf53128c78bbd5af0b9b20b189 # via mkdocs -platformdirs==4.13.3 \ - --hash=sha256:5e567f664eb087ab8521c0179cd8d1bd60857d271136567a39719e28e2d383ce \ - --hash=sha256:f6ad7f447f24f8a3b82cce5976387428bff894a0eca6c3488f4a17f153c130c4 +platformdirs==4.14.0 \ + --hash=sha256:1dadfc59a8a5d7565b3d9270ae8fa71c065595352c4277b41c11ee6c222c4b91 \ + --hash=sha256:83f009c1e8c5fc36869b5171755b291887bd2cade7965233cdfabd23d754720b # via mkdocs-get-deps pygments==2.21.0 \ --hash=sha256:2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9 \ @@ -429,9 +429,9 @@ pymdown-extensions==12.3 \ # via # -r requirements.in # mkdocs-material -python-dateutil==2.9.0.post0 \ - --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \ - --hash=sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427 +python-dateutil==3.0.0 \ + --hash=sha256:3c79630202e4152c6add678446984236efe4f57e84d8e892aab0637bab82e9fd \ + --hash=sha256:7ebcb3c29a92f3ceafe79a7a48a5c45677e9e004bbeec5742ac0bbb00560b7a2 # via ghp-import pyyaml==6.0.3 \ --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \ @@ -524,6 +524,10 @@ six==1.17.0 \ --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \ --hash=sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81 # via python-dateutil +tzdata==2026.6 \ + --hash=sha256:0a10eec6e13ef16b627fabed9a5f2ba61a62b1c67f327305f4e7e412a70b4aec \ + --hash=sha256:85d2cd9c09f81f0bb29db27759fc83af4f1e620efb814f8c5bf8b4cc4feece6d + # via python-dateutil urllib3==2.8.0 \ --hash=sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3 \ --hash=sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63 From 1adb5304f838c58dad72ac7d751f78378eaf46fa Mon Sep 17 00:00:00 2001 From: Andrew Mello Date: Thu, 29 Oct 2026 04:04:35 -0700 Subject: [PATCH 04/15] examples(agents): newest framework pins on python 3.13.18, constraints refrozen - crewai 1.15.28 -> 1.15.33; langgraph 1.2.15 -> 1.2.18, langchain-openai 1.7.2 -> 1.7.3 and langchain-core 1.6.11 -> 1.7.1 (langchain-openai 1.7.3 needs core >= 1.7.0); openai 3.31.0 -> 3.41.0 for openai-agents 0.24.0. llama-index, mcp and openai-agents are already their latest releases. - litellm stays 1.83.14: it is the LiteLLM that EAT release-1.1.0's gateway ships (v1.83.14-stable.patch.2), and EAT has no newer release. - The test image moves to python:3.13.18-slim-trixie. It stays on 3.13 because crewai 1.15.33 and litellm 1.83.14 both require Python < 3.14. - Each constraints.txt is refrozen: requirements.txt installed alone in that image, `pip check`, then `pip freeze --all --exclude pip`. tests/agent_examples_test.sh passes all five examples. --- examples/agents/README.md | 2 +- examples/agents/crewai/constraints.txt | 62 +++++++++---------- examples/agents/crewai/requirements.txt | 2 +- examples/agents/langgraph/constraints.txt | 38 ++++++------ examples/agents/langgraph/requirements.txt | 6 +- .../agents/litellm-gateway/constraints.txt | 14 ++--- examples/agents/llamaindex/constraints.txt | 28 ++++----- examples/agents/openai-agents/constraints.txt | 24 +++---- .../agents/openai-agents/requirements.txt | 2 +- tests/agent_examples_test.sh | 4 +- 10 files changed, 91 insertions(+), 91 deletions(-) diff --git a/examples/agents/README.md b/examples/agents/README.md index ed6e1c9a..36718db9 100644 --- a/examples/agents/README.md +++ b/examples/agents/README.md @@ -106,7 +106,7 @@ model name, a `multiply` tool call, then an answer from the tool's result, streaming or not. `check.py ` runs an example against it and checks the requests it sent (for `litellm-gateway`, also that `model.json` targets the in-cluster agent Service, which `agent.py` swaps for the stub). -`tests/agent_examples_test.sh` does that for every example in a pinned `python:3.13.16-slim-trixie` container, which is where the +`tests/agent_examples_test.sh` does that for every example in a pinned `python:3.13.18-slim-trixie` container, which is where the packages get installed from `requirements.txt` under `constraints.txt`; the installed set must equal `constraints.txt`. It takes example names, so a CI matrix can run one example per job. diff --git a/examples/agents/crewai/constraints.txt b/examples/agents/crewai/constraints.txt index 783bdf19..5ba8df06 100644 --- a/examples/agents/crewai/constraints.txt +++ b/examples/agents/crewai/constraints.txt @@ -1,5 +1,5 @@ # Full pinned set for requirements.txt, transitive dependencies included: -# pip freeze --all --exclude pip after installing it in python:3.13.16-slim-trixie. +# pip freeze --all --exclude pip after installing it in python:3.13.18-slim-trixie. # pip install -r requirements.txt -c constraints.txt aiofiles==24.1.0 aiohappyeyeballs==2.7.1 @@ -14,36 +14,36 @@ attrs==26.1.0 bcrypt==5.0.0 build==1.6.1 cel-python==0.5.0 -certifi==2026.7.22 +certifi==2026.10.23 cffi==2.1.1 charset-normalizer==3.5.2 chromadb==1.5.9 click==8.5.0 -crewai==1.15.28 -crewai-cli==1.15.28 -crewai-core==1.15.28 +crewai-cli==1.15.33 +crewai-core==1.15.33 +crewai==1.15.33 cryptography==50.0.2 deprecation==2.1.0 distro==1.9.0 docstring_parser==0.18.0 durationpy==0.11 et_xmlfile==2.0.0 -filelock==4.2.0 +filelock==4.2.4 flatbuffers==25.12.19 frozenlist==1.8.0 fsspec==2026.9.0 google-re2==1.1.20251105 -googleapis-common-protos==1.75.5 -grpcio==1.84.0 +googleapis-common-protos==1.76.0 +grpcio==1.85.0 h11==0.16.0 -hf-xet==1.7.0 +hf-xet==1.7.1 +httpcore2==2.16.0 httpcore==1.0.9 -httpcore2==2.13.1 httptools==0.9.0 -httpx==0.28.1 httpx-sse==0.4.3 -httpx2==2.13.1 -huggingface_hub==2.2.0 +httpx2==2.16.0 +httpx==0.28.1 +huggingface_hub==2.3.0 idna==3.20 importlib_resources==7.1.0 instructor==1.15.4 @@ -51,26 +51,26 @@ Jinja2==3.1.6 jiter==0.14.0 jmespath==1.1.0 json5==0.10.0 -json_repair==0.60.1 jsonref==1.1.0 -jsonschema==4.26.0 jsonschema-specifications==2025.9.1 +jsonschema==4.26.0 +json_repair==0.60.1 kubernetes==36.0.3 -lance-namespace==0.13.0 lance-namespace-urllib3-client==0.13.0 -lancedb==0.30.0 +lance-namespace==0.13.0 +lancedb==0.41.0 lark==1.3.1 linkify-it-py==2.2.0 markdown-it-py==4.2.0 MarkupSafe==3.0.4 -mcp==1.28.1 +mcp==1.30.0 mdit-py-plugins==0.6.1 mdurl==0.1.2 mmh3==5.3.1 -multidict==7.1.0 +multidict==7.2.1 numpy==2.5.4 oauthlib==4.0.0 -onnxruntime==1.31.0 +onnxruntime==1.31.1 openai==2.54.0 openpyxl==3.1.5 opentelemetry-api==1.45.1 @@ -88,37 +88,37 @@ packaging==26.3 pdfminer.six==20260107 pdfplumber==0.11.10 pendulum==3.3.0 -pillow==12.3.0 -platformdirs==4.13.3 +pillow==13.0.0 +platformdirs==4.14.0 portalocker==2.7.0 propcache==0.5.4 protobuf==7.36.2 pyarrow==26.0.0 pybase64==1.5.1 -pycparser==3.11 +pycparser==3.12 +pydantic-settings==2.16.2 pydantic==2.12.5 -pydantic-settings==2.16.0 pydantic_core==2.41.5 Pygments==2.21.0 PyJWT==2.15.1 pypdfium2==5.14.0 PyPika==0.51.1 pyproject_hooks==1.3.3 -python-dateutil==2.9.0.post0 +python-dateutil==3.0.0 python-dotenv==1.2.4 python-multipart==0.0.32 PyYAML==6.0.3 referencing==0.37.0 regex==2026.1.15 -requests==2.34.2 requests-oauthlib==2.0.0 +requests==2.34.2 rich==14.3.4 rpds-py==2026.9.1 shellingham==1.5.4 six==1.17.0 sniffio==1.3.1 -sse-starlette==3.5.0 -starlette==1.8.0 +sse-starlette==3.6.0 +starlette==1.10.0 tenacity==9.2.1 textual==8.2.8 tokenizers==0.23.3 @@ -129,12 +129,12 @@ truststore==0.10.5 typer==0.27.3 typing-inspection==0.4.4 typing_extensions==4.16.0 -tzdata==2026.5 +tzdata==2026.6 urllib3==2.8.0 -uv==0.11.33 +uv==0.13.6 uvicorn==0.54.0 uvloop==0.23.0 watchfiles==1.3.0 websocket-client==1.9.2 -websockets==17.2 +websockets==17.3 yarl==1.25.1 diff --git a/examples/agents/crewai/requirements.txt b/examples/agents/crewai/requirements.txt index 7f87cd7a..9339f6ac 100644 --- a/examples/agents/crewai/requirements.txt +++ b/examples/agents/crewai/requirements.txt @@ -1 +1 @@ -crewai==1.15.28 +crewai==1.15.33 diff --git a/examples/agents/langgraph/constraints.txt b/examples/agents/langgraph/constraints.txt index 2629c041..3ef87eb9 100644 --- a/examples/agents/langgraph/constraints.txt +++ b/examples/agents/langgraph/constraints.txt @@ -1,29 +1,29 @@ # Full pinned set for requirements.txt, transitive dependencies included: -# pip freeze --all --exclude pip after installing it in python:3.13.16-slim-trixie. +# pip freeze --all --exclude pip after installing it in python:3.13.18-slim-trixie. # pip install -r requirements.txt -c constraints.txt annotated-types==0.8.0 anyio==4.15.1 -certifi==2026.7.22 +certifi==2026.10.23 charset-normalizer==3.5.2 distro==1.9.0 h11==0.16.0 +httpcore2==2.16.0 httpcore==1.0.9 -httpcore2==2.13.1 +httpx2==2.16.0 httpx==0.28.1 -httpx2==2.13.1 idna==3.20 -jiter==0.17.0 -jsonpatch==1.35 -jsonpointer==3.2.1 -langchain-core==1.6.11 -langchain-openai==1.7.2 -langchain-protocol==0.0.19 -langgraph==1.2.15 -langgraph-checkpoint==4.3.0 +jiter==0.18.0 +jsonpatch==1.38 +jsonpointer==3.6 +langchain-core==1.7.1 +langchain-openai==1.7.3 +langchain-protocol==0.0.20 +langgraph-checkpoint==4.3.1 langgraph-prebuilt==1.1.1 -langgraph-sdk==0.4.7 -langsmith==0.14.11 -openai==3.31.0 +langgraph-sdk==0.4.10 +langgraph==1.2.18 +langsmith==0.14.14 +openai==3.41.0 orjson==3.13.0 ormsgpack==1.13.0 packaging==26.3 @@ -31,8 +31,8 @@ pydantic==2.14.1 pydantic_core==2.50.1 PyYAML==6.0.3 regex==2026.9.29 -requests==2.34.2 requests-toolbelt==1.0.0 +requests==2.34.2 sniffio==1.3.1 tenacity==9.2.1 tiktoken==0.14.0 @@ -40,7 +40,7 @@ truststore==0.10.5 typing-inspection==0.4.4 typing_extensions==4.16.0 urllib3==2.8.0 -uuid_utils==0.17.1 -websockets==16.1.1 -xxhash==4.0.1 +uuid_utils==0.19.0 +websockets==17.3 +xxhash==4.0.2 zstandard==0.25.0 diff --git a/examples/agents/langgraph/requirements.txt b/examples/agents/langgraph/requirements.txt index 6b1f33b9..42ea904e 100644 --- a/examples/agents/langgraph/requirements.txt +++ b/examples/agents/langgraph/requirements.txt @@ -1,3 +1,3 @@ -langgraph==1.2.15 -langchain-openai==1.7.2 -langchain-core==1.6.11 +langgraph==1.2.18 +langchain-openai==1.7.3 +langchain-core==1.7.1 diff --git a/examples/agents/litellm-gateway/constraints.txt b/examples/agents/litellm-gateway/constraints.txt index e9e3be5a..a7d5e8a3 100644 --- a/examples/agents/litellm-gateway/constraints.txt +++ b/examples/agents/litellm-gateway/constraints.txt @@ -1,5 +1,5 @@ # Full pinned set for requirements.txt, transitive dependencies included: -# pip freeze --all --exclude pip after installing it in python:3.13.16-slim-trixie. +# pip freeze --all --exclude pip after installing it in python:3.13.18-slim-trixie. # pip install -r requirements.txt -c constraints.txt aiohappyeyeballs==2.7.1 aiohttp==3.13.4 @@ -8,25 +8,25 @@ annotated-doc==0.0.5 annotated-types==0.8.0 anyio==4.15.1 attrs==26.1.0 -certifi==2026.7.22 +certifi==2026.10.23 charset-normalizer==3.5.2 click==8.1.8 distro==1.9.0 fastuuid==0.14.0 -filelock==4.2.0 +filelock==4.2.4 frozenlist==1.8.0 fsspec==2026.9.0 h11==0.16.0 -hf-xet==1.7.0 +hf-xet==1.7.1 httpcore==1.0.9 httpx==0.28.1 huggingface_hub==1.16.1 idna==3.20 importlib_metadata==8.5.0 Jinja2==3.1.6 -jiter==0.17.0 -jsonschema==4.23.0 +jiter==0.18.0 jsonschema-specifications==2025.9.1 +jsonschema==4.23.0 litellm==1.83.14 markdown-it-py==4.2.0 MarkupSafe==3.0.4 @@ -55,4 +55,4 @@ typing-inspection==0.4.4 typing_extensions==4.16.0 urllib3==2.8.0 yarl==1.25.1 -zipp==4.1.1 +zipp==4.1.2 diff --git a/examples/agents/llamaindex/constraints.txt b/examples/agents/llamaindex/constraints.txt index 63d0c864..a45ce30b 100644 --- a/examples/agents/llamaindex/constraints.txt +++ b/examples/agents/llamaindex/constraints.txt @@ -1,5 +1,5 @@ # Full pinned set for requirements.txt, transitive dependencies included: -# pip freeze --all --exclude pip after installing it in python:3.13.16-slim-trixie. +# pip freeze --all --exclude pip after installing it in python:3.13.18-slim-trixie. # pip install -r requirements.txt -c constraints.txt aiohappyeyeballs==2.7.1 aiohttp==3.14.5 @@ -9,7 +9,7 @@ annotated-types==0.8.0 anyio==4.15.1 attrs==26.1.0 banks==2.5.1 -certifi==2026.7.22 +certifi==2026.10.23 charset-normalizer==3.5.2 click==8.5.0 cloudpickle==3.1.2 @@ -23,42 +23,42 @@ filetype==1.2.0 frozenlist==1.8.0 fsspec==2026.9.0 greenlet==3.5.6 -griffe==2.3.2 -griffecli==2.3.2 -griffelib==2.3.2 +griffe==2.4.1 +griffecli==2.4.1 +griffelib==2.4.1 h11==0.16.0 httpcore==1.0.9 httpx==0.28.1 idna==3.20 Jinja2==3.1.6 -jiter==0.17.0 +jiter==0.18.0 joblib==1.6.0 llama-index-core==0.14.25 llama-index-instrumentation==0.6.0 -llama-index-llms-openai==0.8.3 llama-index-llms-openai-like==0.8.1 -llama-index-workflows==2.26.0 +llama-index-llms-openai==0.8.3 +llama-index-workflows==2.26.1 MarkupSafe==3.0.4 marshmallow==3.26.2 -multidict==7.1.0 +multidict==7.2.1 mypy_extensions==1.1.0 nest-asyncio==1.6.0 networkx==3.7 -nltk==3.10.3 +nltk==3.10.4 numpy==2.5.4 openai==2.54.0 packaging==26.3 -pillow==12.3.0 -platformdirs==4.13.3 +pillow==13.0.0 +platformdirs==4.14.0 propcache==0.5.4 pydantic==2.14.1 pydantic_core==2.50.1 PyYAML==6.0.3 regex==2026.9.29 requests==2.34.2 -setuptools==84.0.0 +setuptools==84.2.1 sniffio==1.3.1 -SQLAlchemy==2.1.4 +SQLAlchemy==2.1.6 tenacity==9.2.1 tiktoken==0.14.0 tinytag==2.3.2 diff --git a/examples/agents/openai-agents/constraints.txt b/examples/agents/openai-agents/constraints.txt index 4df5a290..a445ce86 100644 --- a/examples/agents/openai-agents/constraints.txt +++ b/examples/agents/openai-agents/constraints.txt @@ -1,28 +1,28 @@ # Full pinned set for requirements.txt, transitive dependencies included: -# pip freeze --all --exclude pip after installing it in python:3.13.16-slim-trixie. +# pip freeze --all --exclude pip after installing it in python:3.13.18-slim-trixie. # pip install -r requirements.txt -c constraints.txt annotated-types==0.8.0 anyio==4.15.1 attrs==26.1.0 -certifi==2026.7.22 +certifi==2026.10.23 cffi==2.1.1 charset-normalizer==3.5.2 click==8.5.0 cryptography==50.0.2 -griffelib==2.3.2 +griffelib==2.4.1 h11==0.16.0 -httpcore2==2.13.1 -httpx2==2.13.1 +httpcore2==2.16.0 +httpx2==2.16.0 idna==3.20 -jiter==0.17.0 -jsonschema==4.26.0 +jiter==0.18.0 jsonschema-specifications==2025.9.1 -mcp==2.3.0 +jsonschema==4.26.0 mcp-types==2.3.0 -openai==3.31.0 +mcp==2.3.0 openai-agents==0.24.0 +openai==3.41.0 opentelemetry-api==1.45.1 -pycparser==3.11 +pycparser==3.12 pydantic==2.14.1 pydantic_core==2.50.1 PyJWT==2.15.1 @@ -31,8 +31,8 @@ referencing==0.37.0 requests==2.34.2 rpds-py==2026.9.1 sniffio==1.3.1 -sse-starlette==3.5.0 -starlette==1.8.0 +sse-starlette==3.6.0 +starlette==1.10.0 truststore==0.10.5 typing-inspection==0.4.4 typing_extensions==4.16.0 diff --git a/examples/agents/openai-agents/requirements.txt b/examples/agents/openai-agents/requirements.txt index 10f0511f..37886fb2 100644 --- a/examples/agents/openai-agents/requirements.txt +++ b/examples/agents/openai-agents/requirements.txt @@ -1,3 +1,3 @@ openai-agents==0.24.0 -openai==3.31.0 +openai==3.41.0 mcp==2.3.0 diff --git a/tests/agent_examples_test.sh b/tests/agent_examples_test.sh index 77633d09..df850473 100755 --- a/tests/agent_examples_test.sh +++ b/tests/agent_examples_test.sh @@ -10,8 +10,8 @@ set -uo pipefail EXAMPLES_DIR="$(cd "$(dirname "$0")/../examples/agents" && pwd)" -# python:3.13.16-slim-trixie (multi-arch index digest) -IMAGE="${K3D_GPU_EXAMPLES_IMAGE:-python:3.13.16-slim-trixie@sha256:cf50a4f6ac4f026458b08d5222023d700ac806410dff5e9ca8728fa44f2b850f}" +# python:3.13.18-slim-trixie (multi-arch index digest) +IMAGE="${K3D_GPU_EXAMPLES_IMAGE:-python:3.13.18-slim-trixie@sha256:76baad6037690d6e8c4397fbcaef17bca6f19eecef822b708fe8fa3417d30bb5}" if [ "$#" -gt 0 ]; then examples=("$@") From da8b6b06304b1be9cc4cc60ae9b0450c91ef9648 Mon Sep 17 00:00:00 2001 From: Andrew Mello Date: Thu, 29 Oct 2026 04:04:55 -0700 Subject: [PATCH 05/15] devcontainer: base 2.2.5-trixie mcr.microsoft.com/devcontainers/base moves from 2.2.3-trixie to 2.2.5-trixie, the newest release (the same index digest the floating :trixie tag serves). The image builds, and its pinned tools report the expected versions: shellcheck 0.11.0, hadolint 2.15.1, kubeconform 0.8.0, actionlint 1.7.12, helm 4.3.1 and python3-yaml 6.0.2. --- .devcontainer/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index 1543643c..1f078c5f 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -1,6 +1,6 @@ # Toolchain for working on k3d-gpu: every static validator `make check` runs. # Each tool is pinned to an exact release and verified against its sha256. -FROM mcr.microsoft.com/devcontainers/base:2.2.3-trixie@sha256:6ee2b4097c75d33e9a94d941577a3286e5d629434fba384688b06daeeaaeac99 +FROM mcr.microsoft.com/devcontainers/base:2.2.5-trixie@sha256:71b6fe7c4e07ec747a94a72b2a17f2f8c286eaa7b1c59862888df764efb8b6c6 ARG SHELLCHECK_VERSION=0.11.0 ARG HADOLINT_VERSION=2.15.1 From 97d999017b7b467f4c86fbdb68c03c7fa41d9001 Mon Sep 17 00:00:00 2001 From: Andrew Mello Date: Thu, 29 Oct 2026 04:05:00 -0700 Subject: [PATCH 06/15] convert pins: torch 2.15.0 and torchvision 0.29.2; amx-autoquant probe on Python 3.14.10 - console/convert-pins.json: torch 2.14.1 -> 2.15.0 and torchvision 0.29.1 -> 0.29.2, exactly what `hack/bump-convert-pins` moves (its run here). The other pins are already the newest optimum-intel 2.2.0 allows (transformers < 5.6, huggingface-hub < 1.22). - bench/amx-autoquant/probe.sh: the NLL venv takes the same torch 2.15.0+cpu and torchvision 0.29.2+cpu from the PyTorch CPU index. Its image moves from python:3.12-slim (3.12.15, digest only) to python:3.14.10-slim, written with its tag so the nightly repin can move it. 3.14 is the newest Python openvino 2026.4.1 has wheels for (cp310-cp314). The venv builds there, `pip check` is clean, and the stack imports. H27 and H27x name their own commits, so their records are unaffected. --- bench/amx-autoquant/probe.sh | 6 +++--- console/convert-pins.json | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/bench/amx-autoquant/probe.sh b/bench/amx-autoquant/probe.sh index adcd2f56..9602fc0f 100755 --- a/bench/amx-autoquant/probe.sh +++ b/bench/amx-autoquant/probe.sh @@ -40,14 +40,14 @@ BUDGET=1200 ABORT_AT=1140 PREFIX=k3dgpu-i-amx-autoquant # openvino/model_server:2026.4.1-gpu, the agent's pin (scripts/k3d-gpu AGENT_OVMS_IMAGE). OVMS_IMAGE="openvino/model_server@sha256:a928903fe429f1e3e27107cc45932d30d95febfd2d1159dc50869c3eac76fc58" -# python:3.12-slim (PYTHON_VERSION=3.12.15) by digest. -PY_IMAGE="python@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1" +# python:3.14.10-slim by digest: the newest Python that openvino 2026.4.1 ships wheels for (cp310-cp314). +PY_IMAGE="python:3.14.10-slim@sha256:3cabfd7d7aaf394e6040e79fa1eec6ca1c52b74ed9188650472695d9a9326999" # Checked on PyPI / download.pytorch.org 2026-10-17. openvino 2026.4.1 matches the # OVMS release. transformers and huggingface_hub are the newest inside optimum-intel # 2.2.0's bounds (transformers<5.6, huggingface-hub<1.22). torch/torchvision come # from the CPU wheel index so no CUDA wheels are pulled. --prepare still records # the full resolved set in pip-freeze.txt. -PIP_PINS="openvino==2026.4.1 openvino-tokenizers==2026.4.1 optimum-intel==2.2.0 optimum==2.3.0 transformers==5.5.4 huggingface-hub==1.21.0 torch==2.14.1+cpu torchvision==0.29.1+cpu pyarrow==26.0.0" +PIP_PINS="openvino==2026.4.1 openvino-tokenizers==2026.4.1 optimum-intel==2.2.0 optimum==2.3.0 transformers==5.5.4 huggingface-hub==1.21.0 torch==2.15.0+cpu torchvision==0.29.2+cpu pyarrow==26.0.0" PIP_INDEX="--extra-index-url https://download.pytorch.org/whl/cpu" # Containers run as the invoking user so the cache stays user-owned. UIDGID="$(id -u):$(id -g)" diff --git a/console/convert-pins.json b/console/convert-pins.json index 1fa3aebb..1929cf35 100644 --- a/console/convert-pins.json +++ b/console/convert-pins.json @@ -1,7 +1,7 @@ { "schema": "k3d-gpu.convert-pins/v1", "comment": "Toolchain of the QAT-matched OpenVINO conversion (console/model_opt.py conversion_job). Each pin is the newest release optimum-intel's own requirements allow; hack/bump-convert-pins moves them nightly (build-and-push.yml bump-convert-pins).", - "checked": "2026-10-20", + "checked": "2026-10-29", "pins": { "huggingface-hub": "1.21.0", "nncf": "3.4.0", @@ -9,8 +9,8 @@ "openvino-tokenizers": "2026.4.1.0", "optimum": "2.3.0", "optimum-intel": "2.2.0", - "torch": "2.14.1", - "torchvision": "0.29.1", + "torch": "2.15.0", + "torchvision": "0.29.2", "transformers": "5.5.4" } } From a6dab3aecdf13b60b7e207673123e3b3ac30d253 Mon Sep 17 00:00:00 2001 From: Andrew Mello Date: Thu, 29 Oct 2026 04:05:04 -0700 Subject: [PATCH 07/15] kserve example: cert-manager v1.21.3 cert-manager v1.21.3 (2026-10-23) removes trust in the compromised eMudhra root, fixes an ACME ARI renewal loop and a next-private-key Secret ownership check, and moves to Go 1.26.10. Its OCI chart at quay.io/jetstack resolves (sha256:e482675a...). KServe v0.21.0 is still its latest release. --- README.md | 2 +- examples/kserve/install.sh | 2 +- tests/kserve_test.sh | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 5756f5e6..e704433b 100644 --- a/README.md +++ b/README.md @@ -776,7 +776,7 @@ not set. `examples/kserve/install.sh` adds [KServe](https://kserve.github.io/website/) v0.21.0 in Standard mode (plain Deployments and Services, no Knative or Istio) -with cert-manager v1.21.2, both from their pinned OCI Helm charts. It then +with cert-manager v1.21.3, both from their pinned OCI Helm charts. It then serves `OpenVINO/Qwen3-4B-int4-ov` on the Intel GPU through KServe's OpenVINO Model Server runtime (OVMS 2026.4.1), with tool calling: diff --git a/examples/kserve/install.sh b/examples/kserve/install.sh index a9a143ee..34101868 100755 --- a/examples/kserve/install.sh +++ b/examples/kserve/install.sh @@ -6,7 +6,7 @@ # Needs: kubectl, helm 3.8+ (OCI charts), an Intel GPU on the xe or i915 driver. set -euo pipefail -CERT_MANAGER_VERSION=v1.21.2 # supports Kubernetes 1.33-1.36 +CERT_MANAGER_VERSION=v1.21.3 # supports Kubernetes 1.33-1.36 KSERVE_VERSION=v0.21.0 HERE="$(cd "$(dirname "$0")" && pwd)" SYSROOT="${K3D_GPU_SYSROOT:-}" diff --git a/tests/kserve_test.sh b/tests/kserve_test.sh index 3e40d66d..67ec6b19 100755 --- a/tests/kserve_test.sh +++ b/tests/kserve_test.sh @@ -75,8 +75,8 @@ render_node "${SYS}" renderD128 0x8086 i915 gid=$(stat -c %g "${SYS}/dev/dri/renderD128") check "install.sh exits 0 with a render node" is "$(run_install "${SYS}")" 0 -check "cert-manager chart pinned to v1.21.2 with CRDs" has \ - '^helm upgrade --install cert-manager oci://quay.io/jetstack/charts/cert-manager --version v1.21.2 .*--set crds.enabled=true' "${CALLS}" +check "cert-manager chart pinned to v1.21.3 with CRDs" has \ + '^helm upgrade --install cert-manager oci://quay.io/jetstack/charts/cert-manager --version v1.21.3 .*--set crds.enabled=true' "${CALLS}" check "kserve-crd chart pinned to v0.21.0" has \ '^helm upgrade --install kserve-crd oci://ghcr.io/kserve/charts/kserve-crd --version v0.21.0 ' "${CALLS}" check "kserve-resources chart pinned to v0.21.0 with example values" has \ @@ -144,7 +144,7 @@ else pull() { helm pull "$1" --version "$2" --untar --untardir "${CH}" >/dev/null; } check "pull kserve-crd v0.21.0" pull oci://ghcr.io/kserve/charts/kserve-crd v0.21.0 check "pull kserve-resources v0.21.0" pull oci://ghcr.io/kserve/charts/kserve-resources v0.21.0 - check "pull cert-manager v1.21.2" pull oci://quay.io/jetstack/charts/cert-manager v1.21.2 + check "pull cert-manager v1.21.3" pull oci://quay.io/jetstack/charts/cert-manager v1.21.3 helm template kserve-crd "${CH}/kserve-crd" -n kserve --include-crds > "${WORK}/crds.yaml" helm template kserve-resources "${CH}/kserve-resources" -n kserve \ From 5c5d0bb063a396c58a1b86f48627dd876e6ac6da Mon Sep 17 00:00:00 2001 From: Andrew Mello Date: Thu, 29 Oct 2026 04:05:54 -0700 Subject: [PATCH 08/15] ledger(crescent): amendment E4, kubectl v1.37.2, helm v4.3.1 and uv 0.13.6 Shared rule 5 pins kubectl v1.35.2, helm v4.1.1 and uv 0.8.0 in the crescent workspace. The rows' node image runs k3s v1.37.1, two minors past kubectl v1.35, outside kubectl's one-minor skew. Amendment E2 item 3 says moving these tools takes a further amendment; E4 is that amendment, recorded before any H52b, H53 or H58 hold. Mechanics only: no arm, prediction, statistic, gate or cap changes. - setup.sh installs kubectl v1.37.2, helm v4.3.1 and uv 0.13.6, each still checked against its upstream checksum. - uv 0.13 refuses to overwrite an existing venv, so setup.sh keeps an existing mafvenv. Run twice under a scratch HOME, setup.sh passes both times, and the venv equals banking-venv.txt. A uv 0.13.6 build of the venv freezes identical to a uv 0.8.0 build. - Render check: with helm v4.1.1 and v4.3.1, H53's B2 render, H54's eat-vllm render and the 0d3438d ovms render give the same objects (the text differs only in blank lines and trailing whitespace), and the staged B2 and B1g are byte-identical. - H54q keeps its own ~/k3dgpu-gemma/bin. Its runner amendment, not yet written, names its tools; E4 records the render check for its EAT renders. - EAT_REV stays 0d3438d. Its checkout serves only H50o's B3, a row that has run. The shared LiteLLM gateway runs EAT's image, not EAT's chart, and release-1.1.0 pins the same image tag, whose digest is unchanged. --- EXPERIMENTS.md | 77 +++++++++++++++++++++++++++++++++ bench/eatflow/crescent/setup.sh | 13 +++--- 2 files changed, 85 insertions(+), 5 deletions(-) diff --git a/EXPERIMENTS.md b/EXPERIMENTS.md index 3cd4ce42..2c0a7fa1 100644 --- a/EXPERIMENTS.md +++ b/EXPERIMENTS.md @@ -4112,6 +4112,83 @@ ran at 09:26:26Z. S1 changes nothing that decides the verdict: its ranges are M1 the holds, both serving pairs answered through `:8100` (`prehold/frontdoor-post.txt`, 10:07Z): :30000 144 to 145, :30001 33 to 34. +### Crescent amendment E4: kubectl v1.37.2, helm v4.3.1 and uv 0.13.6 in the crescent workspace (2026-10-29) + +Recorded 2026-10-29, after H50, H50o and H51 ran and before any H52b, H53 or H58 hold. Mechanics +only. No hypothesis, arm, model, prediction, statistic, gate, threshold, seed or cap changes. It +moves three of shared rule 5's tools, which +[amendment E2](#crescent-amendment-e2-pins-deploy-commits-order-and-the-restore-check-for-the-pending-crescent-rows-2026-10-29) +item 3 says takes a further amendment. + +**Why.** + +- Shared rule 5 pins kubectl v1.35.2, helm v4.1.1 and uv 0.8.0 in `~/k3dgpu-bench/bin`. The node + image these rows run (0.1.61, E2 item 1) carries k3s v1.37.1. kubectl supports one minor version + of skew against its API server, so v1.35 against v1.37 is outside it. +- The newest releases on 2026-10-29: kubectl v1.37.2 (dl.k8s.io `stable.txt`, released + 2026-10-28), helm v4.3.1 and uv 0.13.6 (released 2026-10-27). k3d v5.9.0 is still its newest + release and stays. + +**The change.** + +1. `bench/eatflow/crescent/setup.sh` installs kubectl v1.37.2, helm v4.3.1 and uv 0.13.6, each + checked against its upstream checksum as before. The sha256 values read on 2026-10-29: kubectl + `c0448752...f8f4`, the helm tarball `0403a88a...e54b`, the uv tarball `f29c3e94...3645`. +2. **When.** setup.sh runs once on crescent, from a deploy commit at or after this amendment's + merge (E2 item 2), under the bench lock, before the first hold of any row this amendment + covers. It runs after H52b's hold if H52b comes first, as in the current order. If a covered + row comes first, H52b runs on these tools and its records name them. setup.sh's output (the + checksum lines and the four versions) goes into the next hold's records. +3. **The banking venv.** uv 0.13 will not overwrite an existing venv: `uv venv` without `--clear` + exits 2. So setup.sh now keeps an existing `mafvenv` and only re-checks its packages against + `banking-venv.txt`. The venv on crescent, built with uv 0.8.0, stays as it is: over a venv built + the same way, uv 0.13.6 checks the 71 packages and installs nothing. On a fresh host, uv 0.13.6 + builds the venv on a later python-build-standalone build of Python 3.12.11 (2025-10-07 instead + of 2025-07-11), with the same 71 packages: its `uv pip freeze` equals uv 0.8.0's and + `banking-venv.txt`. Both were checked on 2026-10-29, as was a second setup.sh run over a first. +4. **Rows.** H53 and H58, and every later crescent row that runs on these shared rules (H59 and + H60 are pre-registered in open PRs). H52b only as item 2 says. Not the rows that have run. +5. **H54q.** H54q runs from `~/k3dgpu-gemma/bin`, with H54a's kubectl v1.35.2 and helm v4.1.1, + which setup.sh does not touch. Its runner amendment + ([amendment Q1](#h54-amendment-q1-h54qs-reference-arm-hold-cap-and-order-2026-10-29)) names its + tools. The render check below covers H54's two EAT renders, so moving them there changes no + object. + +**Render check, helm v4.1.1 against v4.3.1.** Done 2026-10-29, as +[amendment E1](#crescent-amendment-e1-eat-stock-is-release-110-for-h50-h50o-and-h51-2026-10-29) +item 3 did for B1. Each chart was rendered with the runner's own command and values: + +- H53's B2: `live.sh`'s solo B2 render of release-1.1.0's `core/helm-charts/vllm` (the + `c86c42b` tree in `eat-pr21`), with `xpu-values.yaml`, B2's tag pin, + `LLM_MODEL_ID=Qwen/Qwen3.6-27B` and TP 4. 5 objects. +- H54's `eat-vllm`, which B1g and the arms derived from it use: `0d3438d`'s vllm chart with B1g's + values. 6 objects. +- H54's `eat-ovms`, and `live.sh`'s B3: `0d3438d`'s ovms chart. 4 objects. + +In each one the two helm versions render the same objects, parsed and compared. The texts differ +only in blank lines and trailing whitespace that helm v4.3.1 keeps at the end of some templates. +After `bench/apb/stage.py`, H53's staged B2 (`stage.py xpu`) and the staged B1g (`stage.py vllm`) +are byte-identical across the two versions. + +**Not changed.** + +- `EAT_REV` in setup.sh stays `0d3438d` (release-1.0.3-hotfix). `~/k3dgpu-bench/eat-src` at that + commit serves one thing: the OVMS chart of H50o's B3 (`pairs-hold.sh`), a row that has run. No + pending row renders from it. The LiteLLM gateway that every arm shares is not rendered from + EAT's genai-gateway chart. `live.sh` runs the chart's image as a container with its own + one-model config. Release-1.1.0, EAT's latest release on 2026-10-29, pins the same image tag, + `docker.litellm.ai/berriai/litellm:v1.83.14-stable.patch.2`. The tag still serves the index + digest `live.sh` pins (`73cbb215...`, read 2026-10-29). So the gateway is already release-1.1.0's, + and the "0d3438d + genai-gateway pin" of E1 item 5 names that same image. +- k3d v5.9.0, the node image, Python 3.12.11 and the banking venv's pins. Those pins are the + blueprint's own, and EAB v1.0.0 is still its latest release. + +**Predictions.** None is edited. + +**Disclosed.** Written with the predictions of the covered rows in view and before any of their +data existed. + ### H53 pre-registration: EAT's banking flow on Arc Pro B70 (2026-10-20) Written 2026-10-20, before any H53 measurement and before either H53 arm has run on a GPU. The diff --git a/bench/eatflow/crescent/setup.sh b/bench/eatflow/crescent/setup.sh index 6d29adc1..18ca3d1a 100755 --- a/bench/eatflow/crescent/setup.sh +++ b/bench/eatflow/crescent/setup.sh @@ -1,11 +1,13 @@ #!/usr/bin/env bash # setup.sh: the crescent campaign's tools, venvs and checkouts under ~/k3dgpu-bench (nothing -# system-wide; EXPERIMENTS.md "H50-H52 pre-registration", shared rule 5). Each binary is checked -# against its upstream checksum. Run from a checkout of this repo on the host. +# system-wide; EXPERIMENTS.md "H50-H52 pre-registration", shared rule 5, and crescent amendment E4 +# for the tool versions). Each binary is checked against its upstream checksum. Run from a checkout +# of this repo on the host, under the bench lock with no hold running. A second run replaces the +# binaries and keeps the venv and checkouts that exist. set -euo pipefail B=${HOME}/k3dgpu-bench HERE=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd) -K3D_V=v5.9.0 KUBECTL_V=v1.35.2 HELM_V=v4.1.1 UV_V=0.8.0 +K3D_V=v5.9.0 KUBECTL_V=v1.37.2 HELM_V=v4.3.1 UV_V=0.13.6 EAB_REV=758d4845520ca5456bf732264ef02d92a26d25a6 # enterprise-ai-blueprints (banking agent) EAT_REV=0d3438d7119de44cafc5903f66665c0b623e3333 # EAT release-1.0.3-hotfix EAT_PR21=c86c42b073ee533e9fb9e9b9330b9d1478e4bf47 # EAT PR #21 head (release 1.1.0 XPU path) @@ -28,8 +30,9 @@ tar xzf helm.tgz && install -m755 linux-amd64/helm "${B}/bin/" tar xzf uv.tgz && install -m755 uv-x86_64-unknown-linux-gnu/uv "${B}/bin/" cd "${B}" && rm -rf dl export PATH=${B}/bin:${PATH} -# The banking agent's venv: the desktop venv's `uv pip freeze`, rebuilt (Python 3.12.11). -uv venv -q --python 3.12.11 mafvenv +# The banking agent's venv: the desktop venv's `uv pip freeze`, rebuilt (Python 3.12.11). uv 0.13 +# refuses to overwrite an existing venv, and an existing one is kept (amendment E4). +[ -d mafvenv ] || uv venv -q --python 3.12.11 mafvenv uv pip install -q --python mafvenv/bin/python -r "${HERE}/banking-venv.txt" [ -d eab ] || git clone -q https://github.com/intel/enterprise-ai-blueprints eab git -C eab checkout -q "${EAB_REV}" From b7b423793fbf8cb7aa1cc27fb0ad402c329bc363 Mon Sep 17 00:00:00 2001 From: Andrew Mello Date: Thu, 29 Oct 2026 04:32:28 -0700 Subject: [PATCH 09/15] examples(agents): the README table names the pins requirements.txt holds The framework bump left examples/agents/README.md's table on the old pins: openai 3.31.0, langgraph 1.2.15, langchain-openai 1.7.2, langchain-core 1.6.11 and crewai 1.15.28. The table now names openai 3.41.0, langgraph 1.2.18, langchain-openai 1.7.3, langchain-core 1.7.1 and crewai 1.15.33. tests/agent_examples_test.sh now checks, before it starts an example's container, that the example's README row names exactly the pins in its requirements.txt. On the old table it fails crewai, langgraph and openai-agents; on this one all five examples pass. --- examples/agents/README.md | 6 +++--- tests/agent_examples_test.sh | 7 +++++++ 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/examples/agents/README.md b/examples/agents/README.md index 36718db9..6bf5cba1 100644 --- a/examples/agents/README.md +++ b/examples/agents/README.md @@ -6,9 +6,9 @@ endpoint: OpenVINO Model Server (OVMS) serving `OpenVINO/Qwen3-4B-int4-ov` as | Directory | Framework | Pinned packages | |---|---|---| -| [`openai-agents/`](openai-agents/) | OpenAI Agents SDK, tool served over MCP (stdio) | `openai-agents==0.24.0`, `openai==3.31.0`, `mcp==2.3.0` | -| [`langgraph/`](langgraph/) | LangGraph `StateGraph` + `ToolNode` | `langgraph==1.2.15`, `langchain-openai==1.7.2`, `langchain-core==1.6.11` | -| [`crewai/`](crewai/) | CrewAI agent + task | `crewai==1.15.28` | +| [`openai-agents/`](openai-agents/) | OpenAI Agents SDK, tool served over MCP (stdio) | `openai-agents==0.24.0`, `openai==3.41.0`, `mcp==2.3.0` | +| [`langgraph/`](langgraph/) | LangGraph `StateGraph` + `ToolNode` | `langgraph==1.2.18`, `langchain-openai==1.7.3`, `langchain-core==1.7.1` | +| [`crewai/`](crewai/) | CrewAI agent + task | `crewai==1.15.33` | | [`llamaindex/`](llamaindex/) | LlamaIndex `FunctionAgent` | `llama-index-core==0.14.25`, `llama-index-llms-openai-like==0.8.1` | | [`litellm-gateway/`](litellm-gateway/) | Intel Enterprise Agent Toolkit GenAI gateway (LiteLLM) | `litellm==1.83.14` (see [the gateway section](#enterprise-agent-toolkit-gateway)) | diff --git a/tests/agent_examples_test.sh b/tests/agent_examples_test.sh index df850473..9a328591 100755 --- a/tests/agent_examples_test.sh +++ b/tests/agent_examples_test.sh @@ -26,6 +26,13 @@ FAILS=() for ex in "${examples[@]}"; do [ -f "${EXAMPLES_DIR}/${ex}/requirements.txt" ] || { echo "no such example: ${ex}" >&2; FAILS+=("${ex}"); continue; } [ -f "${EXAMPLES_DIR}/${ex}/constraints.txt" ] || { echo "FAIL ${ex}: no constraints.txt" >&2; FAILS+=("${ex}"); continue; } + # README.md's table row names the example's direct pins: they must equal requirements.txt. + want=$(grep -v '^#' "${EXAMPLES_DIR}/${ex}/requirements.txt" | sed '/^[[:space:]]*$/d' | sort) + got=$(grep -F "| [\`${ex}/\`]" "${EXAMPLES_DIR}/README.md" | grep -o "\`[A-Za-z0-9._-]*==[^\`]*\`" | tr -d "\`" | sort) + if [ "${got}" != "${want}" ]; then + echo "FAIL ${ex}: README.md table names '${got//$'\n'/ }', requirements.txt pins '${want//$'\n'/ }'" >&2 + FAILS+=("${ex}"); continue + fi echo "=== ${ex}" if docker run --rm \ -v "${EXAMPLES_DIR}:/examples:ro" \ From 419c1556e98408cf419323ab9d8788db3cbbc9c6 Mon Sep 17 00:00:00 2001 From: Andrew Mello Date: Thu, 29 Oct 2026 04:32:40 -0700 Subject: [PATCH 10/15] ledger(crescent): E4 item 5 says H54q has no runner yet Amendment Q1 is H54q's reference-arm, cap and order amendment, not its runner amendment: Q1 itself says H54q has no runner yet and that a runner amendment lands before its first hold. E4 item 5 named Q1 as that runner amendment. It now says the runner amendment Q1 requires names H54q's tools. No other text changes. --- EXPERIMENTS.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/EXPERIMENTS.md b/EXPERIMENTS.md index 2c0a7fa1..418480e0 100644 --- a/EXPERIMENTS.md +++ b/EXPERIMENTS.md @@ -4149,10 +4149,10 @@ item 3 says takes a further amendment. 4. **Rows.** H53 and H58, and every later crescent row that runs on these shared rules (H59 and H60 are pre-registered in open PRs). H52b only as item 2 says. Not the rows that have run. 5. **H54q.** H54q runs from `~/k3dgpu-gemma/bin`, with H54a's kubectl v1.35.2 and helm v4.1.1, - which setup.sh does not touch. Its runner amendment - ([amendment Q1](#h54-amendment-q1-h54qs-reference-arm-hold-cap-and-order-2026-10-29)) names its - tools. The render check below covers H54's two EAT renders, so moving them there changes no - object. + which setup.sh does not touch. H54q has no runner yet: its runner amendment, which + [amendment Q1](#h54-amendment-q1-h54qs-reference-arm-hold-cap-and-order-2026-10-29) requires + before its first hold, names its tools. The render check below covers H54's two EAT renders, + so moving them there changes no object. **Render check, helm v4.1.1 against v4.3.1.** Done 2026-10-29, as [amendment E1](#crescent-amendment-e1-eat-stock-is-release-110-for-h50-h50o-and-h51-2026-10-29) From 71c1573a052914e98eb1ae322117fa0f97a75ef9 Mon Sep 17 00:00:00 2001 From: Andrew Mello Date: Thu, 29 Oct 2026 04:34:50 -0700 Subject: [PATCH 11/15] telemetry: Prometheus server v3.15.1 CI already runs promtool 3.15.1, but the opt-in Prometheus server in share/telemetry/prometheus.yml stayed on v3.15.0. v3.15.1 (2026-10-21) is the newest release and a security release: CA certificates that distrust the two roots behind the compromised eMudhra intermediates, Go 1.27.3 for net/http, net/textproto, crypto/tls and html/template, and golang.org/x/net v0.60.0 for the HTTP/2 advisories. Nothing else changes. The manifest, its header, images.lock and docs/telemetry.md move to quay.io/prometheus/prometheus:v3.15.1 at its index digest fa330227..., read with docker buildx imagetools inspect and scripts/images-lock digest on 2026-10-29. scripts/images-lock check and pins pass; telemetry_test (with promtool 3.15.1), audit_test, console_test, image_pins_test and share_kubeconform pass. --- docs/telemetry.md | 2 +- images.lock | 4 ++-- share/telemetry/prometheus.yml | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/telemetry.md b/docs/telemetry.md index 922b3146..e0623634 100644 --- a/docs/telemetry.md +++ b/docs/telemetry.md @@ -31,7 +31,7 @@ only for a supported Intel dGPU. Everything in the stack is pinned: | `node-exporter.yml` | Prometheus node_exporter | `quay.io/prometheus/node-exporter:v1.12.1` | 9100 (hostNetwork) | root, no capabilities | | `intel-gpu-exporter.yml` | home-operations drm-exporter | chart 0.3.4, image `ghcr.io/home-operations/drm-exporter@sha256:9b54…5e60` | 8081 | privileged | | `dcgm-exporter.yml` | NVIDIA dcgm-exporter | chart 4.8.4, `nvcr.io/nvidia/k8s/dcgm-exporter:4.6.1-4.8.4-distroless` | 9400 | root + `SYS_ADMIN`, RuntimeClass `nvidia` | -| `prometheus.yml` | Prometheus server and recording rules | `quay.io/prometheus/prometheus:v3.15.0` | 9090 | uid 65534 | +| `prometheus.yml` | Prometheus server and recording rules | `quay.io/prometheus/prometheus:v3.15.1` | 9090 | uid 65534 | | `optional/intel-xpumd.yml` | Intel XPU Manager daemon | chart 2.3.0, `ghcr.io/intel/xpumanager/xpumd:v2.3.0` | 8080 | privileged | Rendered charts carry their exact `helm template` values in their file header. Re-render diff --git a/images.lock b/images.lock index 472f05ed..c08012c1 100644 --- a/images.lock +++ b/images.lock @@ -405,12 +405,12 @@ "tag": "v1.12.1" }, { - "digest": "sha256:efd719c99d83b060d9daefdcf00360461adf279f45ef5391f8d111892118753e", + "digest": "sha256:fa3302279710be2f21a8301ec17a8b4f2301fd829bd113839b3b6b02b6f191a2", "name": "quay.io/prometheus/prometheus", "sources": [ "share/telemetry/prometheus.yml" ], - "tag": "v3.15.0" + "tag": "v3.15.1" }, { "digest": "sha256:e1d96312487eba7d8f001e848a9d4e644b7deea8c2a4564ccc318abb729be731", diff --git a/share/telemetry/prometheus.yml b/share/telemetry/prometheus.yml index 557ccf7e..fc9a836f 100644 --- a/share/telemetry/prometheus.yml +++ b/share/telemetry/prometheus.yml @@ -1,5 +1,5 @@ # Prometheus server for the opt-in k3d-gpu telemetry stack -# Source: https://github.com/prometheus/prometheus (image quay.io/prometheus/prometheus:v3.15.0). +# Source: https://github.com/prometheus/prometheus (image quay.io/prometheus/prometheus:v3.15.1). # Scrapes every pod in k3d-gpu-telemetry that declares a container port named # `metrics` or `http` (node-exporter, intel-gpu-exporter, dcgm-exporter, optional xpumd), # plus kube-system pods annotated prometheus.io/scrape=true on prometheus.io/port (the @@ -187,7 +187,7 @@ spec: type: RuntimeDefault containers: - name: prometheus - image: quay.io/prometheus/prometheus:v3.15.0@sha256:efd719c99d83b060d9daefdcf00360461adf279f45ef5391f8d111892118753e + image: quay.io/prometheus/prometheus:v3.15.1@sha256:fa3302279710be2f21a8301ec17a8b4f2301fd829bd113839b3b6b02b6f191a2 imagePullPolicy: IfNotPresent args: - --config.file=/etc/prometheus/prometheus.yml From 739a6843d110a1172fd637ee381cfa1e3940f56c Mon Sep 17 00:00:00 2001 From: Andrew Mello Date: Thu, 29 Oct 2026 04:35:18 -0700 Subject: [PATCH 12/15] comments: name the brew and PyPI check that the pins now follow - tests/packaging_test.sh renders the formula wrapper as Homebrew's Pathname#write_env_script does. Its comment named brew 7.0.9; CI now runs 7.0.11, whose write_env_script (Library/Homebrew/extend/pathname.rb) is the same code, so the comment names 7.0.11. - bench/amx-autoquant/probe.sh moved to torch 2.15.0+cpu and torchvision 0.29.2+cpu on 2026-10-29, but still said its pins were checked on 2026-10-17. A pip --dry-run of PIP_PINS in python:3.14.10-slim resolves them (57 packages) on 2026-10-29. --- bench/amx-autoquant/probe.sh | 2 +- tests/packaging_test.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/bench/amx-autoquant/probe.sh b/bench/amx-autoquant/probe.sh index 9602fc0f..ac703cae 100755 --- a/bench/amx-autoquant/probe.sh +++ b/bench/amx-autoquant/probe.sh @@ -42,7 +42,7 @@ PREFIX=k3dgpu-i-amx-autoquant OVMS_IMAGE="openvino/model_server@sha256:a928903fe429f1e3e27107cc45932d30d95febfd2d1159dc50869c3eac76fc58" # python:3.14.10-slim by digest: the newest Python that openvino 2026.4.1 ships wheels for (cp310-cp314). PY_IMAGE="python:3.14.10-slim@sha256:3cabfd7d7aaf394e6040e79fa1eec6ca1c52b74ed9188650472695d9a9326999" -# Checked on PyPI / download.pytorch.org 2026-10-17. openvino 2026.4.1 matches the +# Checked on PyPI / download.pytorch.org 2026-10-29. openvino 2026.4.1 matches the # OVMS release. transformers and huggingface_hub are the newest inside optimum-intel # 2.2.0's bounds (transformers<5.6, huggingface-hub<1.22). torch/torchvision come # from the CPU wheel index so no CUDA wheels are pulled. --prepare still records diff --git a/tests/packaging_test.sh b/tests/packaging_test.sh index 534afdc8..07672383 100755 --- a/tests/packaging_test.sh +++ b/tests/packaging_test.sh @@ -90,7 +90,7 @@ check "formula points K3D_GPU_SHARE at pkgshare" grep -qF 'K3D_GPU_SHARE: "${K3D check "formula test asserts a user K3D_GPU_SHARE wins" \ grep -qF 'assert_match "/x/nvidia-device-plugin.yml", shell_output("K3D_GPU_SHARE=/x #{bin}/k3d-gpu help")' "${FORMULA}" -# Render bin/k3d-gpu the way Homebrew's Pathname#write_env_script does (brew 7.0.9, +# Render bin/k3d-gpu the way Homebrew's Pathname#write_env_script does (brew 7.0.11, # Library/Homebrew/extend/pathname.rb: KEY="value" exec "target" "$@") and run it. share_value=$(sed -n 's/.*write_env_script libexec\/"k3d-gpu", K3D_GPU_SHARE: "\(.*\)"$/\1/p' "${FORMULA}") check "formula wrapper value found" test -n "${share_value}" From fa268e8b3da81bd16ece34745a7324a27313381c Mon Sep 17 00:00:00 2001 From: Andrew Mello Date: Thu, 29 Oct 2026 13:12:19 -0700 Subject: [PATCH 13/15] examples(agents): langchain-core 1.7.2, constraints refrozen langchain-core 1.7.2 was released on 2026-10-29 at 19:04Z, after this branch's first freeze. Every example's constraints.txt is refrozen the same way in python:3.13.18-slim-trixie: requirements.txt installed alone, pip check, then pip freeze --all --exclude pip. The refreeze also moves langsmith 0.14.16, pydantic 2.14.2 and pydantic_core 2.50.2, the opentelemetry 1.45.2 / 0.66b2 set and huggingface_hub 2.4.0 (crewai). litellm-gateway's set is unchanged. tests/agent_examples_test.sh passes all five examples. --- examples/agents/README.md | 2 +- examples/agents/crewai/constraints.txt | 20 +++++++++---------- examples/agents/langgraph/constraints.txt | 8 ++++---- examples/agents/langgraph/requirements.txt | 2 +- examples/agents/llamaindex/constraints.txt | 4 ++-- examples/agents/openai-agents/constraints.txt | 6 +++--- 6 files changed, 21 insertions(+), 21 deletions(-) diff --git a/examples/agents/README.md b/examples/agents/README.md index 6bf5cba1..f30a167c 100644 --- a/examples/agents/README.md +++ b/examples/agents/README.md @@ -7,7 +7,7 @@ endpoint: OpenVINO Model Server (OVMS) serving `OpenVINO/Qwen3-4B-int4-ov` as | Directory | Framework | Pinned packages | |---|---|---| | [`openai-agents/`](openai-agents/) | OpenAI Agents SDK, tool served over MCP (stdio) | `openai-agents==0.24.0`, `openai==3.41.0`, `mcp==2.3.0` | -| [`langgraph/`](langgraph/) | LangGraph `StateGraph` + `ToolNode` | `langgraph==1.2.18`, `langchain-openai==1.7.3`, `langchain-core==1.7.1` | +| [`langgraph/`](langgraph/) | LangGraph `StateGraph` + `ToolNode` | `langgraph==1.2.18`, `langchain-openai==1.7.3`, `langchain-core==1.7.2` | | [`crewai/`](crewai/) | CrewAI agent + task | `crewai==1.15.33` | | [`llamaindex/`](llamaindex/) | LlamaIndex `FunctionAgent` | `llama-index-core==0.14.25`, `llama-index-llms-openai-like==0.8.1` | | [`litellm-gateway/`](litellm-gateway/) | Intel Enterprise Agent Toolkit GenAI gateway (LiteLLM) | `litellm==1.83.14` (see [the gateway section](#enterprise-agent-toolkit-gateway)) | diff --git a/examples/agents/crewai/constraints.txt b/examples/agents/crewai/constraints.txt index 5ba8df06..25065c41 100644 --- a/examples/agents/crewai/constraints.txt +++ b/examples/agents/crewai/constraints.txt @@ -43,7 +43,7 @@ httptools==0.9.0 httpx-sse==0.4.3 httpx2==2.16.0 httpx==0.28.1 -huggingface_hub==2.3.0 +huggingface_hub==2.4.0 idna==3.20 importlib_resources==7.1.0 instructor==1.15.4 @@ -73,15 +73,15 @@ oauthlib==4.0.0 onnxruntime==1.31.1 openai==2.54.0 openpyxl==3.1.5 -opentelemetry-api==1.45.1 -opentelemetry-exporter-http-transport==0.66b1 -opentelemetry-exporter-otlp-common==0.66b1 -opentelemetry-exporter-otlp-proto-common==1.45.1 -opentelemetry-exporter-otlp-proto-grpc==1.45.1 -opentelemetry-exporter-otlp-proto-http==1.45.1 -opentelemetry-proto==1.45.1 -opentelemetry-sdk==1.45.1 -opentelemetry-semantic-conventions==0.66b1 +opentelemetry-api==1.45.2 +opentelemetry-exporter-http-transport==0.66b2 +opentelemetry-exporter-otlp-common==0.66b2 +opentelemetry-exporter-otlp-proto-common==1.45.2 +opentelemetry-exporter-otlp-proto-grpc==1.45.2 +opentelemetry-exporter-otlp-proto-http==1.45.2 +opentelemetry-proto==1.45.2 +opentelemetry-sdk==1.45.2 +opentelemetry-semantic-conventions==0.66b2 orjson==3.13.0 overrides==7.7.0 packaging==26.3 diff --git a/examples/agents/langgraph/constraints.txt b/examples/agents/langgraph/constraints.txt index 3ef87eb9..d87519aa 100644 --- a/examples/agents/langgraph/constraints.txt +++ b/examples/agents/langgraph/constraints.txt @@ -15,20 +15,20 @@ idna==3.20 jiter==0.18.0 jsonpatch==1.38 jsonpointer==3.6 -langchain-core==1.7.1 +langchain-core==1.7.2 langchain-openai==1.7.3 langchain-protocol==0.0.20 langgraph-checkpoint==4.3.1 langgraph-prebuilt==1.1.1 langgraph-sdk==0.4.10 langgraph==1.2.18 -langsmith==0.14.14 +langsmith==0.14.16 openai==3.41.0 orjson==3.13.0 ormsgpack==1.13.0 packaging==26.3 -pydantic==2.14.1 -pydantic_core==2.50.1 +pydantic==2.14.2 +pydantic_core==2.50.2 PyYAML==6.0.3 regex==2026.9.29 requests-toolbelt==1.0.0 diff --git a/examples/agents/langgraph/requirements.txt b/examples/agents/langgraph/requirements.txt index 42ea904e..36437969 100644 --- a/examples/agents/langgraph/requirements.txt +++ b/examples/agents/langgraph/requirements.txt @@ -1,3 +1,3 @@ langgraph==1.2.18 langchain-openai==1.7.3 -langchain-core==1.7.1 +langchain-core==1.7.2 diff --git a/examples/agents/llamaindex/constraints.txt b/examples/agents/llamaindex/constraints.txt index a45ce30b..18ad88af 100644 --- a/examples/agents/llamaindex/constraints.txt +++ b/examples/agents/llamaindex/constraints.txt @@ -51,8 +51,8 @@ packaging==26.3 pillow==13.0.0 platformdirs==4.14.0 propcache==0.5.4 -pydantic==2.14.1 -pydantic_core==2.50.1 +pydantic==2.14.2 +pydantic_core==2.50.2 PyYAML==6.0.3 regex==2026.9.29 requests==2.34.2 diff --git a/examples/agents/openai-agents/constraints.txt b/examples/agents/openai-agents/constraints.txt index a445ce86..edf00f8f 100644 --- a/examples/agents/openai-agents/constraints.txt +++ b/examples/agents/openai-agents/constraints.txt @@ -21,10 +21,10 @@ mcp-types==2.3.0 mcp==2.3.0 openai-agents==0.24.0 openai==3.41.0 -opentelemetry-api==1.45.1 +opentelemetry-api==1.45.2 pycparser==3.12 -pydantic==2.14.1 -pydantic_core==2.50.1 +pydantic==2.14.2 +pydantic_core==2.50.2 PyJWT==2.15.1 python-multipart==0.0.32 referencing==0.37.0 From 1da4abefb56071ee9d340c02932465c07748c77d Mon Sep 17 00:00:00 2001 From: Andrew Mello Date: Thu, 29 Oct 2026 13:13:17 -0700 Subject: [PATCH 14/15] ledger(crescent): E4 revised after H52b's hold, before any H53 or H58 hold The amendment's facts are brought up to date; no pin, checksum, check or render changes, and every pin it names was read again on 2026-10-29 at 19:50Z (kubectl v1.37.2, helm v4.3.1 and uv 0.13.6 are still the newest, with the same sha256; k3d v5.9.0, EAT release-1.1.0, EAB v1.0.0 and the LiteLLM index digest 73cbb215 are unchanged). - Item 2: H52b came first. Its one hold (18:32-18:43Z, PR #232) ran before setup.sh, on shared rule 5's k3d v5.9.0, kubectl v1.35.2 and helm v4.1.1, as its records name them. - Item 4: H59 and H60 have merged. H60's Reproduce block runs it from the cross-host workspace ~/k3dgpu-xhost/bin, which amendment K1 covers and setup.sh does not touch, so E4 does not cover it. H59 has no runner yet; its runner amendment names its tools. - Item 5: H54q's runner amendment Q2 was pushed at 19:34Z (PR #243). It keeps H54a's tools in ~/k3dgpu-gemma (kubectl v1.35.2) and renders no arm with helm, so E4 does not touch H54q. --- EXPERIMENTS.md | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/EXPERIMENTS.md b/EXPERIMENTS.md index 418480e0..c9689b5f 100644 --- a/EXPERIMENTS.md +++ b/EXPERIMENTS.md @@ -4118,7 +4118,10 @@ Recorded 2026-10-29, after H50, H50o and H51 ran and before any H52b, H53 or H58 only. No hypothesis, arm, model, prediction, statistic, gate, threshold, seed or cap changes. It moves three of shared rule 5's tools, which [amendment E2](#crescent-amendment-e2-pins-deploy-commits-order-and-the-restore-check-for-the-pending-crescent-rows-2026-10-29) -item 3 says takes a further amendment. +item 3 says takes a further amendment. Revised 2026-10-29 at 19:50Z, after H52b's hold and before +any H53 or H58 hold. Items 2, 4 and 5 now record what happened since: H52b ran first, H59 and H60 +merged, and H54q's runner amendment was pushed. Item 4 also names the workspace H60 runs from. No +pin, checksum, check or render changes, and every pin was read again at the revision. **Why.** @@ -4136,9 +4139,10 @@ item 3 says takes a further amendment. `c0448752...f8f4`, the helm tarball `0403a88a...e54b`, the uv tarball `f29c3e94...3645`. 2. **When.** setup.sh runs once on crescent, from a deploy commit at or after this amendment's merge (E2 item 2), under the bench lock, before the first hold of any row this amendment - covers. It runs after H52b's hold if H52b comes first, as in the current order. If a covered - row comes first, H52b runs on these tools and its records name them. setup.sh's output (the - checksum lines and the four versions) goes into the next hold's records. + covers. H52b came first: its one hold ([H52b run](#h52b-run-xeon-6741p-2026-10-29), 18:32-18:43Z, + PR #232) ran before setup.sh, on shared rule 5's k3d v5.9.0, kubectl v1.35.2 and helm v4.1.1, + and its records name them. + setup.sh's output (the checksum lines and the four versions) goes into the next hold's records. 3. **The banking venv.** uv 0.13 will not overwrite an existing venv: `uv venv` without `--clear` exits 2. So setup.sh now keeps an existing `mafvenv` and only re-checks its packages against `banking-venv.txt`. The venv on crescent, built with uv 0.8.0, stays as it is: over a venv built @@ -4146,13 +4150,19 @@ item 3 says takes a further amendment. builds the venv on a later python-build-standalone build of Python 3.12.11 (2025-10-07 instead of 2025-07-11), with the same 71 packages: its `uv pip freeze` equals uv 0.8.0's and `banking-venv.txt`. Both were checked on 2026-10-29, as was a second setup.sh run over a first. -4. **Rows.** H53 and H58, and every later crescent row that runs on these shared rules (H59 and - H60 are pre-registered in open PRs). H52b only as item 2 says. Not the rows that have run. +4. **Rows.** H53 and H58, and every later crescent row that runs from `~/k3dgpu-bench/bin` on + these shared rules. Not H60: its Reproduce block runs it from the cross-host workspace, + `~/k3dgpu-xhost/bin`, which setup.sh does not touch and + [cross-host amendment K1](#cross-host-amendment-k1-kubectl-v1372-in-the-cross-host-workspace-2026-10-29) + covers. H59 has no runner yet; its runner amendment names its tools. H52b only as item 2 says. + Not the rows that have run. 5. **H54q.** H54q runs from `~/k3dgpu-gemma/bin`, with H54a's kubectl v1.35.2 and helm v4.1.1, - which setup.sh does not touch. H54q has no runner yet: its runner amendment, which + which setup.sh does not touch. Its runner amendment Q2, which [amendment Q1](#h54-amendment-q1-h54qs-reference-arm-hold-cap-and-order-2026-10-29) requires - before its first hold, names its tools. The render check below covers H54's two EAT renders, - so moving them there changes no object. + before its first hold, was pushed 2026-10-29 at 19:34Z (PR #243). Q2 names those tools (H54a's + runner's `~/k3dgpu-gemma/h54a/bin` and `~/k3dgpu-gemma/bin`, k3d v5.9.0 behind the shim and + kubectl v1.35.2) and renders no arm with helm. The render check below also covers H54's two EAT + renders, so moving them there would change no object. **Render check, helm v4.1.1 against v4.3.1.** Done 2026-10-29, as [amendment E1](#crescent-amendment-e1-eat-stock-is-release-110-for-h50-h50o-and-h51-2026-10-29) From 6ae8b24bad1743b5c6a4c48f13abe4a0bd8c6c07 Mon Sep 17 00:00:00 2001 From: Andrew Mello Date: Thu, 29 Oct 2026 14:40:27 -0700 Subject: [PATCH 15/15] examples(agents): langchain-core 1.7.3 langchain-core 1.7.3 was released at 20:55Z on 2026-10-29, after the last pin read. The langgraph example moves to it. All five examples were refrozen in python:3.13.18-slim-trixie; only langgraph's set changed, by that one line. --- examples/agents/README.md | 2 +- examples/agents/langgraph/constraints.txt | 2 +- examples/agents/langgraph/requirements.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/examples/agents/README.md b/examples/agents/README.md index f30a167c..72bd35ef 100644 --- a/examples/agents/README.md +++ b/examples/agents/README.md @@ -7,7 +7,7 @@ endpoint: OpenVINO Model Server (OVMS) serving `OpenVINO/Qwen3-4B-int4-ov` as | Directory | Framework | Pinned packages | |---|---|---| | [`openai-agents/`](openai-agents/) | OpenAI Agents SDK, tool served over MCP (stdio) | `openai-agents==0.24.0`, `openai==3.41.0`, `mcp==2.3.0` | -| [`langgraph/`](langgraph/) | LangGraph `StateGraph` + `ToolNode` | `langgraph==1.2.18`, `langchain-openai==1.7.3`, `langchain-core==1.7.2` | +| [`langgraph/`](langgraph/) | LangGraph `StateGraph` + `ToolNode` | `langgraph==1.2.18`, `langchain-openai==1.7.3`, `langchain-core==1.7.3` | | [`crewai/`](crewai/) | CrewAI agent + task | `crewai==1.15.33` | | [`llamaindex/`](llamaindex/) | LlamaIndex `FunctionAgent` | `llama-index-core==0.14.25`, `llama-index-llms-openai-like==0.8.1` | | [`litellm-gateway/`](litellm-gateway/) | Intel Enterprise Agent Toolkit GenAI gateway (LiteLLM) | `litellm==1.83.14` (see [the gateway section](#enterprise-agent-toolkit-gateway)) | diff --git a/examples/agents/langgraph/constraints.txt b/examples/agents/langgraph/constraints.txt index d87519aa..0c7cc54b 100644 --- a/examples/agents/langgraph/constraints.txt +++ b/examples/agents/langgraph/constraints.txt @@ -15,7 +15,7 @@ idna==3.20 jiter==0.18.0 jsonpatch==1.38 jsonpointer==3.6 -langchain-core==1.7.2 +langchain-core==1.7.3 langchain-openai==1.7.3 langchain-protocol==0.0.20 langgraph-checkpoint==4.3.1 diff --git a/examples/agents/langgraph/requirements.txt b/examples/agents/langgraph/requirements.txt index 36437969..81368189 100644 --- a/examples/agents/langgraph/requirements.txt +++ b/examples/agents/langgraph/requirements.txt @@ -1,3 +1,3 @@ langgraph==1.2.18 langchain-openai==1.7.3 -langchain-core==1.7.2 +langchain-core==1.7.3