skilldrop-cli 0.16.29 → 0.16.31

package/packs/dev-team/skills/dependency-upgrade-review/evals/evals.json

@@ -0,0 +1,77 @@
+{
+  "skill_name": "dependency-upgrade-review",
+  "evals": [
+    {
+      "id": 1,
+      "prompt": "Dependabot opened PR #212 on harbor-notes: \"Bump quillmark from 3.4.1 to 4.1.0\". CI is green. The PR diff is in pr.diff, quillmark's changelog is quillmark-CHANGELOG.md, and I've attached src/render/, test/ and .github/workflows/ci.yml from the repo. Can I merge it?",
+      "assertions": [
+        "Gives exactly one verdict at the top, and it is DO NOT MERGE",
+        "Reports that renderInline() was removed in 4.0.0 and that src/render/comment.js still imports and calls it, citing the file and line",
+        "Flags that 4.0.0 changed the sanitize default to false and that src/render/note.js renders note bodies with quillmark.render(markdown) and no sanitize option, so raw HTML from users passes through",
+        "Lists the lockfile changes the title does not mention: entity-codec 2.1.0 to 3.0.2 (a major, with its licence changing from MIT to MPL-2.0), html-escape-lite removed, and quill-native-highlight and prebuild-install added, with quill-native-highlight's new install script",
+        "Says the green CI does not cover the change: the only test renders Markdown with no raw HTML, and no test imports src/render/comment.js",
+        "Accounts for the skipped releases, not only 4.1.0: names the 3.5.0 link-title security fix and the setOptions() deprecation that src/render/note.js still uses",
+        "Gives a rollback that pins quillmark back and regenerates package-lock.json (or reverts the PR), and names taking 3.5.x as the way to get the security fix without the breaking changes",
+        "Does not invent versions, advisory IDs, APIs, files or tests that are not in the supplied input"
+      ]
+    },
+    {
+      "id": 2,
+      "prompt": "Dependabot PR #88 on tidewater-tools: \"Bump the github-actions group with 2 updates\". Checks passed. Diff in pr.diff, the two workflow files after the change are in .github/workflows/, and I pasted the release notes from both action repos into release-notes.md. OK to merge?",
+      "assertions": [
+        "Gives MERGE AFTER CHECKS, not MERGE",
+        "Treats the northwind-ci/checkout-lite SHA as unverified and gives the exact git ls-remote command for refs/tags/v3.2.0 and refs/tags/v3.2.0^{}, saying which line must equal 9b8e7a6d5c4b3a291807f6e5d4c3b2a1908f7e6d",
+        "Says octo-tools/pypi-publish moving from @v2 to @v3 is a tag-only pin that can be moved after review, recommends pinning it to a commit SHA, and notes the step receives secrets.PYPI_TOKEN",
+        "Says the passing checks never ran pypi-publish v3, because release.yml runs only on a v* tag push, and names a way to exercise it before the next real release",
+        "Reports that release.yml still passes the deprecated password input (release.yml line 22) and that verify-metadata now defaults to true, so the next release can fail on an invalid long description",
+        "Classes the jumps: checkout-lite v3.1.0 to v3.2.0 as minor, pypi-publish v2 to v3 as major",
+        "Gives a rollback (revert the PR or restore the old uses: lines) and notes a revert cannot undo a release already published to PyPI with v3",
+        "Does not invent action versions, SHAs, inputs or workflow steps that are not in the supplied files"
+      ]
+    },
+    {
+      "id": 3,
+      "prompt": "Renovate PR on our Go rate-limiter service: \"fix(deps): update module github.com/lanternhq/ratelimit to v0.9.0\". CI passed. Quick verdict please.\n\ngo.mod:\n-\tgithub.com/lanternhq/ratelimit v0.8.3\n+\tgithub.com/lanternhq/ratelimit v0.9.0\n+\tgithub.com/lanternhq/clock v1.2.0 // indirect\n\ngo.sum:\n-github.com/lanternhq/ratelimit v0.8.3 h1:AbCd=\n-github.com/lanternhq/ratelimit v0.8.3/go.mod h1:EfGh=\n+github.com/lanternhq/clock v1.2.0 h1:IjKl=\n+github.com/lanternhq/clock v1.2.0/go.mod h1:MnOp=\n+github.com/lanternhq/ratelimit v0.9.0 h1:QrSt=\n+github.com/lanternhq/ratelimit v0.9.0/go.mod h1:UvWx=\n\nRelease notes for v0.9.0:\n- Limiter.Wait(ctx) now returns ErrLimitExceeded immediately when burst is 0, instead of blocking.\n- NewLimiter(rate, burst) is deprecated; use New(Config{Rate: r, Burst: b}).\n- Uses github.com/lanternhq/clock for time, so tests can inject a fake clock.",
+      "assertions": [
+        "Gives MERGE AFTER CHECKS, not MERGE",
+        "States that v0.8.3 to v0.9.0 is a 0.x minor bump, which semver treats as potentially breaking",
+        "Names the Wait behaviour change and the NewLimiter deprecation, and gives a concrete search command for Wait( and NewLimiter( since no code was supplied, without claiming there are or are not hits",
+        "Points out that only the v0.9.0 notes were supplied, so any releases between v0.8.3 and v0.9.0 are still unread",
+        "Flags github.com/lanternhq/clock v1.2.0 as a new indirect module the PR title does not mention",
+        "Says the passing CI only covers this if a test exercises the burst-0 Wait path, and lists that as a check rather than assuming it",
+        "Gives a rollback command such as go get github.com/lanternhq/ratelimit@v0.8.3 followed by go mod tidy, or reverting the PR",
+        "Does not invent file names, call sites, tests or release versions that are not in the prompt"
+      ]
+    },
+    {
+      "id": 4,
+      "held_out": "2026-10-20",
+      "prompt": "Renovate opened PR #287 bumping quillstream from 2.4.1 to 3.1.0 and CI is green. The PR body is in PR.md, the diff is pr.diff, and I copied the upstream changelog into upstream/. Repo is checked out at main. Is this safe to merge? I'd like to get it in today.",
+      "assertions": [
+        "Gives the verdict DO NOT MERGE for #287 (not MERGE, and not MERGE AFTER CHECKS without code changes), and ties it to at least one breaking change that hits code in this repo.",
+        "Points out that read_legacy_archive in src/ingest/reader.py imports quillstream.legacy.parse_frame inside the function, and that the 3.0.0 entry in the changelog (a release this PR skips) removes that module. Names quillstream.frames.decode(buf, strict=False) as the replacement and says the `header, payload = parse_frame(...)` unpacking has to change too, because decode returns a Frame object.",
+        "Points out that fetch_with_retry in src/ingest/client.py retries only on `if result is None`. Under 3.0.0, Client.fetch raises quillstream.errors.QuillTimeout instead of returning None, so timeouts will escape as exceptions rather than being retried. Suggests catching QuillTimeout, or migrating first with 2.5.0's Client(raise_on_timeout=True).",
+        "Flags that the Dockerfile builds FROM python:3.9-slim while 3.0.0 requires Python >=3.10 (and grainwire wheels only cover CPython 3.10–3.13), so the production image build or install will break. Notes that CI and pip-compile both ran on Python 3.11, so a green CI could not catch this.",
+        "Lists the requirements.txt changes beyond the title, as shown in pr.diff: new transitive package grainwire 1.0.0, removed compat-six 1.16.2, and typing-shimx bumped 4.5.0 -> 4.9.1. Ties grainwire to the 3.1.0 changelog entry, including the sdist/Rust-toolchain caveat for platforms without wheels.",
+        "Explains why the green check is weak evidence: tests/test_reader.py only tests read_stream, with a mocked Client whose fetch returns a payload. Nothing exercises read_legacy_archive (the lazy import means the missing module never fails at import or collection time) or the timeout/None path.",
+        "Gives a concrete rollback: revert the PR, or restore quillstream==2.4.1 in requirements.in and re-run `pip-compile --generate-hashes`, then rebuild and redeploy the image. Optionally offers a staged path, e.g. moving to 2.5.0 first to surface the deprecation warnings.",
+        "Does not invent versions, APIs or changelog entries that are not in the files (e.g. no made-up 3.0.1 fix, no Python-3.9 compatibility shim). Does not claim to have installed the package, run the tests, or checked the sha256 hashes against PyPI. If it recommends checking the hashes, it says that needs network access and gives the command rather than asserting they match."
+      ]
+    },
+    {
+      "id": 5,
+      "held_out": "2026-10-20",
+      "prompt": "Dependabot opened two PRs this morning and both are green: #412 bumps the bramblewick/setup-toolchain action pin (a teammate pushed an extra commit to it) and #413 bumps release-notary. Descriptions are PR-412.md / PR-413.md, diffs are pr-412.diff / pr-413.diff, upstream release notes are in upstream/. Are the action SHA pins right, and can I merge both before we push the v5.13.0 tag on Friday?",
+      "assertions": [
+        "Gives a separate verdict for each PR. #413 is DO NOT MERGE. #412 is not a plain MERGE: it is MERGE AFTER CHECKS or DO NOT MERGE until the pins are reconciled.",
+        "Catches that pr-412.diff pins setup-toolchain to two different commits that are both labelled `# v3.3.0`: 8141d107d0837efc25f86e096a7eefd58e979515 in ci.yml (from Dependabot) and 7dd0aa52537f8f4f4002b505507186cdaec669c4 in release.yml (from mkowalczyk's hand-made commit). Says at most one of them can be the tag's commit, and that the release.yml one is the suspect because it was edited by hand and is the one that runs with production secrets.",
+        "Says plainly that it cannot confirm offline which SHA (if either) the v3.3.0 tag points to. Gives a concrete command, e.g. `git ls-remote https://github.com/bramblewick/setup-toolchain 'refs/tags/v3.3.0*'` (using the peeled `^{}` line if the tag is annotated) or `gh api repos/bramblewick/setup-toolchain/git/ref/tags/v3.3.0`. Never states that either SHA is verified.",
+        "For #412, notes that v3.3.0 switches the action to the node24 runtime, which needs self-hosted runners on v2.328.0 or newer. release.yml runs on [self-hosted, linux, release] and PR CI runs only on ubuntu-latest, so the first real test would be Friday's tag push. Also mentions the `cache` default flipping to true, which affects the release job.",
+        "For #413, finds that scripts/release.mjs calls createNotary({ legacyMode: true, ... }). 1.9.0 removed legacyMode and now throws TypeError: Unknown option \"legacyMode\", so `npm run release` in release.yml will fail. Also notes that the switch to the v2 manifest layout breaks the downstream ledger-portal parser mentioned in the code comment.",
+        "For #413, lists the package-lock changes beyond the title: a new transitive package notary-telemetry 0.2.1 with \"hasInstallScript\": true, resolved from https://npm.notary-cdn.io rather than registry.npmjs.org; ansi-tint 1.0.4 removed; semver-lite 2.1.0 -> 2.3.0; release-notary's engines raised to node >=20. Treats the install script plus the off-registry tarball as a supply-chain concern in its own right.",
+        "Explains that the green checks never ran the changed code. ci.yml runs on pull_request with `npm ci --ignore-scripts` and never runs scripts/release.mjs. release.yml runs plain `npm ci`, so notary-telemetry's install script would first execute in the production environment, with RELEASE_SIGNING_KEY and NPM_TOKEN in the job and contents: write / id-token: write permissions. Mentions NOTARY_TELEMETRY=0 and/or keeping 1.8.x as mitigations.",
+        "Gives a rollback for each PR: revert #412 to restore the c8aee2ae521bdb1ef1b97761673ebbe92c953b0f (v3.2.0) pins; revert #413, or pin release-notary back to 1.8.2 and regenerate package-lock.json. Does not invent versions, flags or APIs that are not in the files, and does not claim to have run npm install, the workflows, or the release script."
+      ]
+    }
+  ]
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/1/.github/workflows/ci.yml

@@ -0,0 +1,20 @@
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - run: npm ci
+      - run: npm test

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/1/pr.diff

@@ -0,0 +1,87 @@
+diff --git a/package-lock.json b/package-lock.json
+index b0d3cbb..906d58a 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -10,7 +10,7 @@
+       "dependencies": {
+         "express": "^4.19.2",
+         "pino": "^9.3.2",
+-        "quillmark": "^3.4.1",
++        "quillmark": "^4.1.0",
+         "zod": "^3.23.8"
+       },
+       "devDependencies": {
+@@ -21,28 +21,45 @@
+       }
+     },
+     "node_modules/entity-codec": {
+-      "version": "2.1.0",
+-      "resolved": "https://registry.npmjs.org/entity-codec/-/entity-codec-2.1.0.tgz",
+-      "integrity": "sha512-EXAMPLEentitycodec210AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==",
+-      "license": "MIT"
++      "version": "3.0.2",
++      "resolved": "https://registry.npmjs.org/entity-codec/-/entity-codec-3.0.2.tgz",
++      "integrity": "sha512-EXAMPLEentitycodec302BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB==",
++      "license": "MPL-2.0"
+     },
+-    "node_modules/html-escape-lite": {
+-      "version": "1.0.3",
+-      "resolved": "https://registry.npmjs.org/html-escape-lite/-/html-escape-lite-1.0.3.tgz",
+-      "integrity": "sha512-EXAMPLEhtmlescapelite103AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==",
+-      "license": "MIT"
++    "node_modules/prebuild-install": {
++      "version": "7.1.2",
++      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.2.tgz",
++      "integrity": "sha512-EXAMPLEprebuildinstall712BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB==",
++      "license": "MIT",
++      "optional": true,
++      "bin": {
++        "prebuild-install": "bin.js"
++      }
++    },
++    "node_modules/quill-native-highlight": {
++      "version": "1.0.0",
++      "resolved": "https://registry.npmjs.org/quill-native-highlight/-/quill-native-highlight-1.0.0.tgz",
++      "integrity": "sha512-EXAMPLEquillnativehighlight100BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB==",
++      "hasInstallScript": true,
++      "license": "MIT",
++      "optional": true,
++      "dependencies": {
++        "prebuild-install": "^7.1.2"
++      }
+     },
+     "node_modules/quillmark": {
+-      "version": "3.4.1",
+-      "resolved": "https://registry.npmjs.org/quillmark/-/quillmark-3.4.1.tgz",
+-      "integrity": "sha512-EXAMPLEquillmark341AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==",
++      "version": "4.1.0",
++      "resolved": "https://registry.npmjs.org/quillmark/-/quillmark-4.1.0.tgz",
++      "integrity": "sha512-EXAMPLEquillmark410BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB==",
+       "license": "MIT",
+       "dependencies": {
+-        "entity-codec": "^2.1.0",
+-        "html-escape-lite": "^1.0.3"
++        "entity-codec": "^3.0.2"
+       },
+       "engines": {
+-        "node": ">=16"
++        "node": ">=18"
++      },
++      "optionalDependencies": {
++        "quill-native-highlight": "^1.0.0"
+       }
+     },
+     "node_modules/zod": {
+diff --git a/package.json b/package.json
+index afd6691..03f7ec6 100644
+--- a/package.json
++++ b/package.json
+@@ -13,7 +13,7 @@
+   "dependencies": {
+     "express": "^4.19.2",
+     "pino": "^9.3.2",
+-    "quillmark": "^3.4.1",
++    "quillmark": "^4.1.0",
+     "zod": "^3.23.8"
+   },
+   "devDependencies": {

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/1/quillmark-CHANGELOG.md

@@ -0,0 +1,24 @@
+# quillmark changelog
+
+## 4.1.0 (2026-09-02)
+
+- Added: optional native syntax highlighter `quill-native-highlight`, installed as an optional dependency. Its install script downloads a prebuilt binary for the current platform and falls back to the JavaScript highlighter when the download fails.
+- Fixed: tables with an empty header cell rendered an extra column.
+
+## 4.0.1 (2026-08-11)
+
+- Fixed: `render()` threw on input with CRLF line endings.
+
+## 4.0.0 (2026-07-28)
+
+### Breaking
+
+- `renderInline()` is removed. Use `render(src, { inline: true })`.
+- The `sanitize` option now defaults to `false`. Raw HTML in the input is passed through to the output unless `sanitize: true` is set on the call or through `setOptions()`.
+- Node.js 18 is the minimum supported version.
+- The `html-escape-lite` dependency is dropped; escaping now uses `entity-codec` 3.
+
+## 3.5.0 (2026-05-19)
+
+- Security: a link title containing `"` could close the `title` attribute and inject markup. Fixed in 3.5.0; affects 3.0.0 to 3.4.x.
+- Deprecated: `setOptions()` (global options). Pass options to each `render()` call instead. `setOptions()` will be removed in 5.0.

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/1/src/render/comment.js

@@ -0,0 +1,6 @@
+// Renders the one-line title a user types above a comment on a note.
+import { renderInline } from "quillmark";
+
+export function renderCommentTitle(title) {
+  return renderInline(title.trim());
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/1/src/render/note.js

@@ -0,0 +1,8 @@
+// Renders the Markdown body of a shared team note. Bodies are written by any team member.
+import quillmark, { setOptions } from "quillmark";
+
+setOptions({ breaks: true });
+
+export function renderNoteBody(markdown) {
+  return quillmark.render(markdown);
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/1/test/note.test.js

@@ -0,0 +1,12 @@
+import { describe, expect, it } from "vitest";
+import { renderNoteBody } from "../src/render/note.js";
+
+describe("renderNoteBody", () => {
+  it("renders bold text", () => {
+    expect(renderNoteBody("**ship it**")).toBe("<p><strong>ship it</strong></p>\n");
+  });
+
+  it("keeps single line breaks", () => {
+    expect(renderNoteBody("a\nb")).toBe("<p>a<br>\nb</p>\n");
+  });
+});

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/2/.github/workflows/ci.yml

@@ -0,0 +1,23 @@
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python: ["3.11", "3.12"]
+    steps:
+      - uses: northwind-ci/checkout-lite@9b8e7a6d5c4b3a291807f6e5d4c3b2a1908f7e6d # v3.2.0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+      - run: pip install -e ".[test]"
+      - run: pytest -q

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/2/.github/workflows/release.yml

@@ -0,0 +1,23 @@
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: pypi
+    steps:
+      - uses: northwind-ci/checkout-lite@9b8e7a6d5c4b3a291807f6e5d4c3b2a1908f7e6d # v3.2.0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: pip install build && python -m build
+      - uses: octo-tools/pypi-publish@v3
+        with:
+          password: ${{ secrets.PYPI_TOKEN }}
+          packages-dir: dist/

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/2/pr.diff

@@ -0,0 +1,32 @@
+diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
+index 96ae786..e6bc8d0 100644
+--- a/.github/workflows/ci.yml
++++ b/.github/workflows/ci.yml
+@@ -15,7 +15,7 @@ jobs:
+       matrix:
+         python: ["3.11", "3.12"]
+     steps:
+-      - uses: northwind-ci/checkout-lite@3f1c2a9e8b7d6c5f4e3d2c1b0a9f8e7d6c5b4a39 # v3.1.0
++      - uses: northwind-ci/checkout-lite@9b8e7a6d5c4b3a291807f6e5d4c3b2a1908f7e6d # v3.2.0
+       - uses: actions/setup-python@v5
+         with:
+           python-version: ${{ matrix.python }}
+diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
+index e5c6eb0..012a492 100644
+--- a/.github/workflows/release.yml
++++ b/.github/workflows/release.yml
+@@ -12,12 +12,12 @@ jobs:
+     runs-on: ubuntu-latest
+     environment: pypi
+     steps:
+-      - uses: northwind-ci/checkout-lite@3f1c2a9e8b7d6c5f4e3d2c1b0a9f8e7d6c5b4a39 # v3.1.0
++      - uses: northwind-ci/checkout-lite@9b8e7a6d5c4b3a291807f6e5d4c3b2a1908f7e6d # v3.2.0
+       - uses: actions/setup-python@v5
+         with:
+           python-version: "3.12"
+       - run: pip install build && python -m build
+-      - uses: octo-tools/pypi-publish@v2
++      - uses: octo-tools/pypi-publish@v3
+         with:
+           password: ${{ secrets.PYPI_TOKEN }}
+           packages-dir: dist/

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/2/release-notes.md

@@ -0,0 +1,20 @@
+# Release notes copied from the two action repositories
+
+## northwind-ci/checkout-lite
+
+### v3.2.0
+
+- Added: `sparse-paths` input for partial checkouts.
+- Changed: the action now runs on the Node 24 runtime. Self-hosted runners need runner version 2.330.0 or later.
+
+### v3.1.1
+
+- Fixed: `fetch-depth: 0` timed out on repositories with more than 50,000 tags.
+
+## octo-tools/pypi-publish
+
+### v3.0.0
+
+- Breaking: trusted publishing (OIDC) is now the default. A job that does not pass `password` needs `permissions: id-token: write`.
+- Deprecated: the `password` input. It still works in v3 and is removed in v4.
+- Changed: `verify-metadata` now defaults to `true`; an upload with an invalid long description fails instead of warning.

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/4/.github/workflows/ci.yml

@@ -0,0 +1,18 @@
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9951bcc823800e62153b06d6e56d8ed6c5c10e7a # v4.1.1
+      - uses: actions/setup-python@a0a57c5ce737a953c85cefc45772185c9fafddbc # v5.0.0
+        with:
+          python-version: "3.11"
+      - run: pip install --require-hashes -r requirements.txt
+      - run: pip install pytest==8.2.0
+      - run: pytest tests/

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/4/Dockerfile

@@ -0,0 +1,8 @@
+FROM python:3.9-slim
+
+WORKDIR /app
+COPY requirements.txt .
+RUN pip install --no-cache-dir --require-hashes -r requirements.txt
+COPY src/ src/
+
+CMD ["python", "-m", "src.ingest.main"]

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/4/PR.md

@@ -0,0 +1,36 @@
+# PR #287: Update dependency quillstream to v3 (major)
+
+**Author:** renovate[bot]
+**Base:** main  **Head:** renovate/quillstream-3.x
+**Checks:** ✅ ci / test (pull_request) — passed in 2m 14s
+
+---
+
+This PR contains the following updates:
+
+| Package | Change | Age | Adoption | Passing | Confidence |
+|---|---|---|---|---|---|
+| quillstream | `==2.4.1` -> `==3.1.0` | 9 days | 41% | 96% | low |
+
+---
+
+### Release Notes
+
+<details>
+<summary>quillstream/quillstream (quillstream)</summary>
+
+See `upstream/quillstream-CHANGELOG.md` (copied from the project's CHANGELOG at tag v3.1.0).
+
+</details>
+
+---
+
+### Configuration
+
+📅 **Schedule**: Branch creation - At any time. Automerge - Disabled by config.
+
+🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
+
+---
+
+This PR was generated by Renovate Bot. `pip-compile --generate-hashes` was run on ubuntu-latest with Python 3.11 to refresh `requirements.txt`.

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/4/pr.diff

@@ -0,0 +1,47 @@
+diff --git a/requirements.in b/requirements.in
+index 4b1c2e0..9a7d3f1 100644
+--- a/requirements.in
++++ b/requirements.in
+@@ -1,4 +1,4 @@
+ httpcore-lite==1.3.0
+-quillstream==2.4.1
++quillstream==3.1.0
+ pydantic-mini==0.9.2
+ structlog-tiny==4.0.1
+diff --git a/requirements.txt b/requirements.txt
+index 77e0a1d..c2f9b48 100644
+--- a/requirements.txt
++++ b/requirements.txt
+@@ -4,10 +4,10 @@
+ #
+ #    pip-compile --generate-hashes requirements.in
+ #
+-compat-six==1.16.2 \
+-    --hash=sha256:5926410f0515cd47563d23317bb234f19b519e17a61f630b3a7a3be2fbd023f3
+-    # via quillstream
++grainwire==1.0.0 \
++    --hash=sha256:ac5a05fbf6a38d80bb205b0640bfe3c886336e7fa936be0c57d323fe24f258ba
++    # via quillstream
+ httpcore-lite==1.3.0 \
+     --hash=sha256:993ac8ea6cc9be8463df390c480a245a090a3bba42ed538f9c8742d09ad7222a
+     # via
+     #   -r requirements.in
+     #   quillstream
+@@ -16,15 +16,15 @@ pydantic-mini==0.9.2 \
+     --hash=sha256:5411291f6c6c8ca714342bb4a421861331b89026a8318fa95c72043a8b6cfee7
+     # via -r requirements.in
+-quillstream==2.4.1 \
+-    --hash=sha256:7eb6637605fcb69f63cecd3000870f473af8aaaf41e5347ee3e80708a07561ca
++quillstream==3.1.0 \
++    --hash=sha256:e56b4c0d40fd62f44e33a53cc83ab388ac8edb6275eaac283afb2744bcd27c6d
+     # via -r requirements.in
+ structlog-tiny==4.0.1 \
+     --hash=sha256:1058a4589566f633cf2e795c7e5cfacdeb635d0b35e927619b4a437a1f6bdc01
+     # via -r requirements.in
+-typing-shimx==4.5.0 \
+-    --hash=sha256:0c8ab72efe0bd56117af955bfa741a49741395e2dfcd4ba688c941bda1cb963a
++typing-shimx==4.9.1 \
++    --hash=sha256:2e0970bbb5cd4ca819222abb76df78762fb1a7a0b3a98ee8fc38c3271cb7f450
+     # via
+     #   pydantic-mini
+     #   quillstream

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/4/src/ingest/client.py

@@ -0,0 +1,24 @@
+from __future__ import annotations
+
+import time
+
+import structlog_tiny
+
+log = structlog_tiny.get_logger(__name__)
+
+MAX_ATTEMPTS = 3
+
+
+def fetch_with_retry(client, url: str):
+    """Fetch ``url``, retrying on timeout.
+
+    quillstream's ``Client.fetch`` returns ``None`` when the request times out.
+    """
+    for attempt in range(1, MAX_ATTEMPTS + 1):
+        result = client.fetch(url)
+        if result is None:
+            log.warning("quillstream fetch timed out", url=url, attempt=attempt)
+            time.sleep(2 ** attempt)
+            continue
+        return result
+    raise RuntimeError(f"gave up fetching {url} after {MAX_ATTEMPTS} attempts")

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/4/src/ingest/reader.py

@@ -0,0 +1,32 @@
+"""Readers for the ingest pipeline.
+
+Current-format files go through ``read_stream``. Archived ``.qsf1`` files
+written before the 2024 migration are still replayed by the monthly backfill
+job through ``read_legacy_archive``.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Iterator
+
+import quillstream
+
+from .client import fetch_with_retry
+
+
+def read_stream(url: str) -> Iterator[bytes]:
+    client = quillstream.Client(timeout=10)
+    payload = fetch_with_retry(client, url)
+    yield from payload.chunks()
+
+
+def read_legacy_archive(path: Path) -> Iterator[bytes]:
+    # Imported lazily: only the backfill job needs the old frame format.
+    from quillstream.legacy import parse_frame
+
+    data = path.read_bytes()
+    offset = 0
+    while offset < len(data):
+        header, payload = parse_frame(data[offset:])
+        yield payload
+        offset += header.length

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/4/tests/test_reader.py

@@ -0,0 +1,15 @@
+from unittest import mock
+
+from src.ingest import reader
+
+
+class FakePayload:
+    def chunks(self):
+        return [b"a", b"b"]
+
+
+def test_read_stream_yields_chunks():
+    fake_client = mock.Mock()
+    fake_client.fetch.return_value = FakePayload()
+    with mock.patch("quillstream.Client", return_value=fake_client):
+        assert list(reader.read_stream("qs://example/feed")) == [b"a", b"b"]

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/4/upstream/quillstream-CHANGELOG.md

@@ -0,0 +1,37 @@
+# Changelog
+
+All notable changes to quillstream are documented here. This project follows Semantic Versioning.
+
+## 3.1.0 — 2026-10-11
+
+### Added
+- Frame decoding is now delegated to the new `grainwire` package (`grainwire>=1.0,<2`), which is a required dependency. `grainwire` ships compiled wheels for CPython 3.10–3.13 on manylinux and macOS; other platforms build from sdist and need a Rust toolchain.
+- `Client(..., compression="auto")` negotiates zstd when the server supports it.
+
+### Fixed
+- `Client.close()` no longer leaks a socket when called twice.
+
+## 3.0.0 — 2026-08-29
+
+### Breaking
+- **Python 3.10 or newer is required.** Support for Python 3.8 and 3.9 has been dropped (`python_requires=">=3.10"`).
+- **Removed the `quillstream.legacy` module**, deprecated since 2.2. `quillstream.legacy.parse_frame(buf)` is gone; use `quillstream.frames.decode(buf, strict=False)` instead. Note that `decode` returns a `Frame` object rather than a `(header, payload)` tuple; use `frame.header` and `frame.payload`.
+- `Client.fetch()` now raises `quillstream.errors.QuillTimeout` when the request times out. Previously it returned `None`.
+- Dropped the dependency on `compat-six`.
+
+### Changed
+- Minimum `typing-shimx` is now 4.8.
+
+## 2.5.0 — 2026-06-02
+
+### Deprecated
+- Importing `quillstream.legacy` now emits a `DeprecationWarning` with the removal version (3.0).
+- `Client.fetch()` returning `None` on timeout is deprecated; opt in to the 3.0 behaviour with `Client(raise_on_timeout=True)`.
+
+### Added
+- `quillstream.frames.decode()`.
+
+## 2.4.1 — 2026-03-17
+
+### Fixed
+- Off-by-one in chunked frame reassembly for payloads larger than 64 KiB.

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/5/.github/workflows/ci.yml

@@ -0,0 +1,22 @@
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9ce6fd9fa4b164bf8911b62115bf9104ba1a2803 # v4.2.0
+      - uses: bramblewick/setup-toolchain@c8aee2ae521bdb1ef1b97761673ebbe92c953b0f # v3.2.0
+        with:
+          node-version-file: .nvmrc
+      - run: npm ci --ignore-scripts
+      - run: npm run lint
+      - run: npm test
+      - run: npm run build

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/5/.github/workflows/release.yml

@@ -0,0 +1,25 @@
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: [self-hosted, linux, release]
+    environment: production
+    steps:
+      - uses: actions/checkout@9ce6fd9fa4b164bf8911b62115bf9104ba1a2803 # v4.2.0
+      - uses: bramblewick/setup-toolchain@c8aee2ae521bdb1ef1b97761673ebbe92c953b0f # v3.2.0
+        with:
+          node-version-file: .nvmrc
+      - run: npm ci
+      - run: npm run build
+      - run: npm run release
+        env:
+          RELEASE_SIGNING_KEY: ${{ secrets.RELEASE_SIGNING_KEY }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/5/.nvmrc

@@ -0,0 +1 @@
+22.11.0

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/5/PR-412.md

@@ -0,0 +1,16 @@
+# PR #412: Bump bramblewick/setup-toolchain from 3.2.0 to 3.3.0
+
+**Author:** dependabot[bot]
+**Base:** main  **Head:** dependabot/github_actions/bramblewick/setup-toolchain-3.3.0
+**Checks:** ✅ ci / test (pull_request) — passed
+
+Bumps [bramblewick/setup-toolchain](https://github.com/bramblewick/setup-toolchain) from 3.2.0 to 3.3.0.
+
+Release notes: see `upstream/setup-toolchain-RELEASES.md`.
+
+**Commits on this branch**
+1. `dependabot[bot]` — Bump bramblewick/setup-toolchain from 3.2.0 to 3.3.0
+2. `mkowalczyk` — "dependabot only touched ci.yml, bumped release.yml too so they match"
+
+---
+Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself.