mcli-framework 8.0.54__tar.gz → 8.0.55__tar.gz

{mcli_framework-8.0.54 → mcli_framework-8.0.55}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcli-framework
-Version: 8.0.54
+Version: 8.0.55
 Summary: Portable workflow framework - transform any script into a versioned, schedulable command. Store in ~/.mcli/workflows/, version with lockfile, run as daemon or cron job.
 Author-email: Luis Fernandez de la Vara <luis@lefv.io>
 Maintainer-email: Luis Fernandez de la Vara <luis@lefv.io>
@@ -82,10 +82,18 @@ Requires-Dist: freezegun>=1.4.0; extra == "dev"
 Requires-Dist: pytest-html>=4.1.0; extra == "dev"
 Requires-Dist: pytest-json-report>=1.5.0; extra == "dev"
 Requires-Dist: black<26.0.0,>=25.0.0; extra == "dev"
-Requires-Dist: isort<6.0.0,>=5.12.0; extra == "dev"
-Requires-Dist: mypy<2.0.0,>=1.7.1; extra == "dev"
+Requires-Dist: isort<6.0.0,>=5.13.2; extra == "dev"
+Requires-Dist: mypy<2.0.0,>=1.16.1; extra == "dev"
 Requires-Dist: ruff>=0.1.0; extra == "dev"
+Requires-Dist: pylint>=3.0.0; extra == "dev"
+Requires-Dist: flake8>=7.0.0; extra == "dev"
+Requires-Dist: flake8-docstrings>=1.7.0; extra == "dev"
+Requires-Dist: flake8-bugbear>=24.1.0; extra == "dev"
+Requires-Dist: flake8-comprehensions>=3.14.0; extra == "dev"
+Requires-Dist: flake8-simplify>=0.21.0; extra == "dev"
 Requires-Dist: pre-commit>=4.5.1; extra == "dev"
+Requires-Dist: bandit>=1.7.0; extra == "dev"
+Requires-Dist: safety>=3.0.0; extra == "dev"
 Requires-Dist: build>=1.2.2.post1; extra == "dev"
 Requires-Dist: maturin>=1.9.3; extra == "dev"
 Requires-Dist: twine>=4.0.0; extra == "dev"

{mcli_framework-8.0.54 → mcli_framework-8.0.55}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mcli-framework"
-version = "8.0.54"
+version = "8.0.55"
 description = "Portable workflow framework - transform any script into a versioned, schedulable command. Store in ~/.mcli/workflows/, version with lockfile, run as daemon or cron job."
 readme = "README.md"
  requires-python = ">=3.10"
@@ -102,11 +102,21 @@ dev = [
 
   # Code quality
   "black>=25.0.0,<26.0.0",  # Pin to 25.x to match lockfile, avoid 26.x formatting changes
-  "isort>=5.12.0,<6.0.0",
-  "mypy>=1.7.1,<2.0.0",
+  "isort>=5.13.2,<6.0.0",
+  "mypy>=1.16.1,<2.0.0",
   "ruff>=0.1.0",                  # Fast linter
+  "pylint>=3.0.0",
+  "flake8>=7.0.0",
+  "flake8-docstrings>=1.7.0",
+  "flake8-bugbear>=24.1.0",
+  "flake8-comprehensions>=3.14.0",
+  "flake8-simplify>=0.21.0",
   "pre-commit>=4.5.1",            # Git hooks
 
+  # Security
+  "bandit>=1.7.0",
+  "safety>=3.0.0",
+
   # Build tools
   "build>=1.2.2.post1",
   "maturin>=1.9.3",
@@ -260,20 +270,39 @@ build-backend = "setuptools.build_meta"
 # NOTE: This is the primary dev dependency specification (PEP 735).
 # [project.optional-dependencies] dev is kept for pip compatibility.
 dev = [
+    # Testing
+    "pytest>=8.4.1",
+    "pytest-cov>=4.1.0,<5.0.0",
+    "pytest-mock>=3.14.1",
+    "pytest-asyncio>=1.1.0",
+    "pytest-benchmark>=4.0.0",
+    "pytest-timeout>=2.2.0",
+    "pytest-xdist>=3.5.0",
+    "pytest-html>=4.1.0",
+    "pytest-json-report>=1.5.0",
+    "hypothesis>=6.92.0",
+    "faker>=22.0.0",
+    "responses>=0.24.0",
+    "freezegun>=1.4.0",
+    # Linting / formatting / typing
     "black>=25.0.0,<26.0.0",  # Pin to 25.x to match lockfile
-    "isort>=5.13.2",
-    "mypy>=1.16.1",
+    "isort>=5.13.2,<6.0.0",
+    "mypy>=1.16.1,<2.0.0",
+    "ruff>=0.1.0",
     "pylint>=3.0.0",
-    "pytest>=8.4.1",
-    "pytest-cov>=4.1.0",
-    "pre-commit>=3.6.0",
     "flake8>=7.0.0",
     "flake8-docstrings>=1.7.0",
     "flake8-bugbear>=24.1.0",
     "flake8-comprehensions>=3.14.0",
     "flake8-simplify>=0.21.0",
+    # Security
     "bandit>=1.7.0",
     "safety>=3.0.0",
+    # Pre-commit / build / publish
+    "pre-commit>=4.5.1",
+    "build>=1.2.2.post1",
+    "maturin>=1.9.3",
+    "twine>=4.0.0",
 ]
 
 [tool.setuptools]

{mcli_framework-8.0.54 → mcli_framework-8.0.55}/src/mcli/app/commands_cmd.py

@@ -1135,7 +1135,10 @@ def open_editor_for_command(
     if not editor:
         # Try common editors in order of preference
         for common_editor in ["vim", "nano", "code", "subl", "atom", "emacs"]:
-            if subprocess.run(["which", common_editor], capture_output=True).returncode == 0:
+            if (
+                subprocess.run(["which", common_editor], capture_output=True, timeout=5).returncode
+                == 0
+            ):
                 editor = common_editor
                 break
 

{mcli_framework-8.0.54 → mcli_framework-8.0.55}/src/mcli/app/create_cmd.py

@@ -124,7 +124,10 @@ def open_editor_for_command(
     if not editor:
         # Try common editors in order of preference
         for common_editor in ["vim", "nano", "code", "subl", "atom", "emacs"]:
-            if subprocess.run(["which", common_editor], capture_output=True).returncode == 0:
+            if (
+                subprocess.run(["which", common_editor], capture_output=True, timeout=5).returncode
+                == 0
+            ):
                 editor = common_editor
                 break
 

{mcli_framework-8.0.54 → mcli_framework-8.0.55}/src/mcli/app/init_cmd.py

@@ -217,11 +217,15 @@ Thumbs.db
     # Initialize git if requested
     if git and not (workflows_dir / ".git").exists():
         try:
-            subprocess.run(["git", "init"], cwd=workflows_dir, check=True, capture_output=True)
+            subprocess.run(
+                ["git", "init"], cwd=workflows_dir, check=True, capture_output=True, timeout=30
+            )
             console.print("[green]✓[/green] Initialized git repository in workflows directory")
 
             # Create initial commit
-            subprocess.run(["git", "add", "."], cwd=workflows_dir, check=True, capture_output=True)
+            subprocess.run(
+                ["git", "add", "."], cwd=workflows_dir, check=True, capture_output=True, timeout=30
+            )
             subprocess.run(
                 ["git", "commit", "-m", "Initial commit: Initialize workflows directory"],
                 cwd=workflows_dir,

{mcli_framework-8.0.54 → mcli_framework-8.0.55}/src/mcli/app/sync_cmd.py

@@ -135,12 +135,20 @@ def sync_init(install: bool, foreground: bool):
     else:
         info("Starting IPFS daemon in background...")
 
+        # Detach the daemon from this process group. start_new_session is
+        # POSIX-only; on Windows use CREATE_NEW_PROCESS_GROUP instead so the
+        # call doesn't raise (#190).
+        if sys.platform == "win32":
+            _detach_kwargs = {"creationflags": subprocess.CREATE_NEW_PROCESS_GROUP}
+        else:
+            _detach_kwargs = {"start_new_session": True}
+
         # Start daemon in background
         process = subprocess.Popen(
             ["ipfs", "daemon"],
             stdout=subprocess.DEVNULL,
             stderr=subprocess.DEVNULL,
-            start_new_session=True,
+            **_detach_kwargs,
         )
 
         # Save PID for tracking

{mcli_framework-8.0.54 → mcli_framework-8.0.55}/src/mcli/lib/api/api.py

@@ -389,7 +389,7 @@ def ensure_api_app() -> Optional[FastAPI]:
         # Add CORS middleware
         _api_app.add_middleware(
             CORSMiddleware,
-            allow_origins=["*"],
+            allow_origins=os.environ.get("MCLI_CORS_ORIGINS", "http://localhost:3000").split(","),
             allow_credentials=True,
             allow_methods=["*"],
             allow_headers=["*"],
@@ -455,7 +455,7 @@ def start_api_server(
         # Add CORS middleware
         _api_app.add_middleware(
             CORSMiddleware,
-            allow_origins=["*"],
+            allow_origins=os.environ.get("MCLI_CORS_ORIGINS", "http://localhost:3000").split(","),
             allow_credentials=True,
             allow_methods=["*"],
             allow_headers=["*"],

{mcli_framework-8.0.54 → mcli_framework-8.0.55}/src/mcli/lib/pickles/pickles.py

@@ -20,6 +20,56 @@ class RestrictedUnpickler(pickle.Unpickler):
         raise pickle.UnpicklingError(f"Forbidden class: {module}.{name}")
 
 
+# Allowlist of (module, qualified-name) globals that are safe to reconstruct
+# from untrusted pickle data: builtin containers/scalars plus numpy array
+# primitives. Anything else (callables like os.system/eval, arbitrary classes)
+# is rejected, closing the pickle-RCE vector when deserializing cache data.
+_SAFE_GLOBALS = {
+    ("builtins", "list"),
+    ("builtins", "dict"),
+    ("builtins", "tuple"),
+    ("builtins", "set"),
+    ("builtins", "frozenset"),
+    ("builtins", "str"),
+    ("builtins", "bytes"),
+    ("builtins", "bytearray"),
+    ("builtins", "int"),
+    ("builtins", "float"),
+    ("builtins", "complex"),
+    ("builtins", "bool"),
+    ("builtins", "NoneType"),
+    # numpy array reconstruction primitives (only used when numpy is installed)
+    ("numpy", "ndarray"),
+    ("numpy", "dtype"),
+    ("numpy.core.multiarray", "_reconstruct"),
+    ("numpy.core.multiarray", "scalar"),
+    ("numpy._core.multiarray", "_reconstruct"),
+    ("numpy._core.multiarray", "scalar"),
+}
+
+
+class SafeUnpickler(pickle.Unpickler):
+    """Unpickler restricted to an allowlist of safe builtin/numpy globals.
+
+    Use for deserializing data from untrusted or shared stores (e.g. a Redis
+    cache) where a poisoned entry could otherwise trigger arbitrary code
+    execution via pickle reduce gadgets.
+    """
+
+    def find_class(self, module: str, name: str) -> Type:
+        if (module, name) in _SAFE_GLOBALS:
+            return super().find_class(module, name)
+        raise pickle.UnpicklingError(f"Forbidden global during unpickling: {module}.{name}")
+
+
+def safe_loads(data: bytes):
+    """Deserialize *data* allowing only safe builtin/numpy globals.
+
+    Raises ``pickle.UnpicklingError`` for anything outside the allowlist.
+    """
+    return SafeUnpickler(io.BytesIO(data)).load()
+
+
 class ObjectCache(Generic[T]):
     def __init__(self, class_type: Type[T], app_name: str, factory: Callable[[], T] = None):
         self.class_type = class_type

{mcli_framework-8.0.54 → mcli_framework-8.0.55}/src/mcli/lib/search/cached_vectorizer.py

@@ -19,6 +19,7 @@ except ImportError:
     redis = None  # type: ignore
 
 from mcli.lib.logger.logger import get_logger
+from mcli.lib.pickles.pickles import safe_loads
 
 logger = get_logger(__name__)
 
@@ -315,7 +316,9 @@ class CachedTfIdfVectorizer:
         try:
             cached_data = await self.redis_client.get(cache_key)
             if cached_data:
-                return pickle.loads(cached_data)
+                # Cache is shared/untrusted; restrict deserialization to a safe
+                # allowlist to prevent pickle-RCE from a poisoned entry (#170).
+                return safe_loads(cached_data)
         except Exception as e:
             logger.warning(f"Failed to get from cache: {e}")
 

{mcli_framework-8.0.54 → mcli_framework-8.0.55}/src/mcli/self/release_notes_cmd.py

@@ -87,7 +87,7 @@ class ReleaseNotes:
 
 def _run_git(args: list[str]) -> str:
     """Run a git command and return stdout."""
-    result = subprocess.run(["git"] + args, capture_output=True, text=True, check=True)
+    result = subprocess.run(["git"] + args, capture_output=True, text=True, check=True, timeout=30)
     return result.stdout.strip()
 
 

{mcli_framework-8.0.54 → mcli_framework-8.0.55}/src/mcli/self/self_cmd.py

@@ -343,7 +343,10 @@ def open_editor_for_command(
     if not editor:
         # Try common editors in order of preference
         for common_editor in ["vim", "nano", "code", "subl", "atom", "emacs"]:
-            if subprocess.run(["which", common_editor], capture_output=True).returncode == 0:
+            if (
+                subprocess.run(["which", common_editor], capture_output=True, timeout=5).returncode
+                == 0
+            ):
                 editor = common_editor
                 break
 

{mcli_framework-8.0.54 → mcli_framework-8.0.55}/src/mcli/self/store_cmd.py

@@ -40,7 +40,9 @@ def init_store(path, remote):
         # Initialize git if not already initialized
         git_dir = store_path / ".git"
         if not git_dir.exists():
-            subprocess.run(["git", "init"], cwd=store_path, check=True, capture_output=True)
+            subprocess.run(
+                ["git", "init"], cwd=store_path, check=True, capture_output=True, timeout=30
+            )
             success(f"Initialized git repository at {store_path}")
 
             # Create .gitignore
@@ -132,7 +134,7 @@ def push_commands(message, all):
         success(f"Copied {copied_count} items to store")
 
         # Git add, commit, push
-        subprocess.run(["git", "add", "."], cwd=store_path, check=True)
+        subprocess.run(["git", "add", "."], cwd=store_path, check=True, timeout=30)
 
         # Check if there are changes
         result = subprocess.run(
@@ -145,12 +147,14 @@ def push_commands(message, all):
 
         # Commit with message
         commit_msg = message or f"Update commands {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}"
-        subprocess.run(["git", "commit", "-m", commit_msg], cwd=store_path, check=True)
+        subprocess.run(["git", "commit", "-m", commit_msg], cwd=store_path, check=True, timeout=30)
         success(f"Committed changes: {commit_msg}")
 
         # Push to remote if configured
         try:
-            subprocess.run(["git", "push"], cwd=store_path, check=True, capture_output=True)
+            subprocess.run(
+                ["git", "push"], cwd=store_path, check=True, capture_output=True, timeout=60
+            )
             success("Pushed to remote")
         except subprocess.CalledProcessError:
             warning("No remote configured or push failed. Commands committed locally.")
@@ -169,7 +173,7 @@ def pull_commands(force):
 
         # Pull from remote
         try:
-            subprocess.run(["git", "pull"], cwd=store_path, check=True)
+            subprocess.run(["git", "pull"], cwd=store_path, check=True, timeout=60)
             success("Pulled latest changes from remote")
         except subprocess.CalledProcessError:
             warning("No remote configured or pull failed. Using local store.")
@@ -218,7 +222,9 @@ def sync_commands(message):
         # First pull
         info("Pulling latest changes...")
         try:
-            subprocess.run(["git", "pull"], cwd=store_path, check=True, capture_output=True)
+            subprocess.run(
+                ["git", "pull"], cwd=store_path, check=True, capture_output=True, timeout=60
+            )
             success("Pulled from remote")
         except subprocess.CalledProcessError:
             warning("No remote or pull failed")
@@ -246,12 +252,14 @@ def sync_commands(message):
             return
 
         # Commit and push
-        subprocess.run(["git", "add", "."], cwd=store_path, check=True)
+        subprocess.run(["git", "add", "."], cwd=store_path, check=True, timeout=30)
         commit_msg = message or f"Sync commands {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}"
-        subprocess.run(["git", "commit", "-m", commit_msg], cwd=store_path, check=True)
+        subprocess.run(["git", "commit", "-m", commit_msg], cwd=store_path, check=True, timeout=30)
 
         try:
-            subprocess.run(["git", "push"], cwd=store_path, check=True, capture_output=True)
+            subprocess.run(
+                ["git", "push"], cwd=store_path, check=True, capture_output=True, timeout=60
+            )
             success("Synced and pushed to remote")
         except subprocess.CalledProcessError:
             success("Synced locally (no remote configured)")

{mcli_framework-8.0.54 → mcli_framework-8.0.55}/src/mcli/workflow/ci/act_runner.py

@@ -18,6 +18,11 @@ _RATE_LIMIT_MARKERS = (
     "pull rate limit",
 )
 
+# act emits this when no job matches the requested event (e.g. a
+# workflow_dispatch-only workflow queried for pull_request). That is a no-op,
+# not a failure, so the gate must treat it as PASS rather than block the push.
+_NO_STAGES_MARKERS = ("could not find any stages to run",)
+
 # Backoff (seconds) between docker rate-limit retries; the last value repeats.
 _RETRY_BACKOFF = (15, 45)
 _MAX_RETRIES = 2
@@ -34,6 +39,11 @@ def _is_docker_rate_limited(output: str) -> bool:
     return any(marker in low for marker in _RATE_LIMIT_MARKERS)
 
 
+def _has_no_stages(output: str) -> bool:
+    low = (output or "").lower()
+    return any(marker in low for marker in _NO_STAGES_MARKERS)
+
+
 def act_available() -> bool:
     return shutil.which("act") is not None
 
@@ -91,6 +101,15 @@ def run_act(
         if proc.returncode == 0:
             return PreflightResult.PASS
 
+        # No job matches this event (e.g. workflow_dispatch-only) — nothing to
+        # validate, so this is a pass, not a gate failure.
+        if _has_no_stages(output):
+            sys.stdout.write(
+                "ℹ️  No act stages for this event (workflow_dispatch-only?); "
+                "nothing to validate — treating as pass.\n"
+            )
+            return PreflightResult.PASS
+
         if _is_docker_rate_limited(output):
             if attempt < retries:
                 delay = backoff[min(attempt, len(backoff) - 1)]

{mcli_framework-8.0.54 → mcli_framework-8.0.55}/src/mcli/workflow/ci/ci.py

@@ -134,7 +134,7 @@ def pr():
         raise SystemExit(1)
     if slug and has_online_runner(slug):
         click.echo("act unreachable; pushing so the runner can validate.")
-        subprocess.run(["git", "push", "-u", "origin", "HEAD"], check=False)
+        subprocess.run(["git", "push", "-u", "origin", "HEAD"], check=False, timeout=120)
         subprocess.run(["gh", "pr", "create", "--fill", "--base", "main"], check=False)
         return
     click.echo("act unreachable and no runner; refusing to open an unvalidated PR.")

{mcli_framework-8.0.54 → mcli_framework-8.0.55}/src/mcli/workflow/doc_convert.py

@@ -349,7 +349,7 @@ def init():
 
     # Check if Homebrew is installed
     try:
-        subprocess.run(["brew", "--version"], capture_output=True, check=True)
+        subprocess.run(["brew", "--version"], capture_output=True, check=True, timeout=10)
         success("✅ Homebrew is installed")
     except (subprocess.CalledProcessError, FileNotFoundError):
         error("❌ Homebrew is not installed. Install it from https://brew.sh")
@@ -360,11 +360,13 @@ def init():
     # Install pandoc
     info("📥 Installing pandoc...")
     try:
-        result = subprocess.run(["brew", "install", "pandoc"], capture_output=True, text=True)
+        result = subprocess.run(
+            ["brew", "install", "pandoc"], capture_output=True, text=True, timeout=300
+        )
         if result.returncode == 0:
             success("   ✅ pandoc installed successfully")
         else:
-            check = subprocess.run(["which", "pandoc"], capture_output=True)
+            check = subprocess.run(["which", "pandoc"], capture_output=True, timeout=10)
             if check.returncode == 0:
                 info("   ℹ️  pandoc is already installed")
             else:
@@ -378,7 +380,9 @@ def init():
     info("📥 Installing Jupyter & nbconvert (for notebook conversion)...")
     try:
         # Check if already installed
-        check = subprocess.run(["jupyter", "nbconvert", "--version"], capture_output=True)
+        check = subprocess.run(
+            ["jupyter", "nbconvert", "--version"], capture_output=True, timeout=10
+        )
         if check.returncode == 0:
             info("   ℹ️  jupyter nbconvert is already installed")
         else:
@@ -425,7 +429,7 @@ def init():
             info("   sudo tlmgr install collection-fontsrecommended")
             info("   sudo mktexlsr")
         else:
-            check = subprocess.run(["which", "pdflatex"], capture_output=True)
+            check = subprocess.run(["which", "pdflatex"], capture_output=True, timeout=10)
             if check.returncode == 0:
                 info("   ℹ️  LaTeX is already installed")
             else:
@@ -512,7 +516,7 @@ def convert(from_format, to_format, path, output_dir, pandoc_args, no_fallback):
     # Check if pandoc is installed (primary tool)
     has_pandoc = False
     try:
-        subprocess.run(["pandoc", "--version"], capture_output=True, check=True)
+        subprocess.run(["pandoc", "--version"], capture_output=True, check=True, timeout=10)
         has_pandoc = True
     except (subprocess.CalledProcessError, FileNotFoundError):
         pass
@@ -520,7 +524,9 @@ def convert(from_format, to_format, path, output_dir, pandoc_args, no_fallback):
     # Check if nbconvert is available
     has_nbconvert = False
     try:
-        subprocess.run(["jupyter", "nbconvert", "--version"], capture_output=True, check=True)
+        subprocess.run(
+            ["jupyter", "nbconvert", "--version"], capture_output=True, check=True, timeout=10
+        )
         has_nbconvert = True
     except (subprocess.CalledProcessError, FileNotFoundError):
         pass

{mcli_framework-8.0.54 → mcli_framework-8.0.55}/src/mcli_framework.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcli-framework
-Version: 8.0.54
+Version: 8.0.55
 Summary: Portable workflow framework - transform any script into a versioned, schedulable command. Store in ~/.mcli/workflows/, version with lockfile, run as daemon or cron job.
 Author-email: Luis Fernandez de la Vara <luis@lefv.io>
 Maintainer-email: Luis Fernandez de la Vara <luis@lefv.io>
@@ -82,10 +82,18 @@ Requires-Dist: freezegun>=1.4.0; extra == "dev"
 Requires-Dist: pytest-html>=4.1.0; extra == "dev"
 Requires-Dist: pytest-json-report>=1.5.0; extra == "dev"
 Requires-Dist: black<26.0.0,>=25.0.0; extra == "dev"
-Requires-Dist: isort<6.0.0,>=5.12.0; extra == "dev"
-Requires-Dist: mypy<2.0.0,>=1.7.1; extra == "dev"
+Requires-Dist: isort<6.0.0,>=5.13.2; extra == "dev"
+Requires-Dist: mypy<2.0.0,>=1.16.1; extra == "dev"
 Requires-Dist: ruff>=0.1.0; extra == "dev"
+Requires-Dist: pylint>=3.0.0; extra == "dev"
+Requires-Dist: flake8>=7.0.0; extra == "dev"
+Requires-Dist: flake8-docstrings>=1.7.0; extra == "dev"
+Requires-Dist: flake8-bugbear>=24.1.0; extra == "dev"
+Requires-Dist: flake8-comprehensions>=3.14.0; extra == "dev"
+Requires-Dist: flake8-simplify>=0.21.0; extra == "dev"
 Requires-Dist: pre-commit>=4.5.1; extra == "dev"
+Requires-Dist: bandit>=1.7.0; extra == "dev"
+Requires-Dist: safety>=3.0.0; extra == "dev"
 Requires-Dist: build>=1.2.2.post1; extra == "dev"
 Requires-Dist: maturin>=1.9.3; extra == "dev"
 Requires-Dist: twine>=4.0.0; extra == "dev"

{mcli_framework-8.0.54 → mcli_framework-8.0.55}/src/mcli_framework.egg-info/requires.txt

@@ -45,10 +45,18 @@ freezegun>=1.4.0
 pytest-html>=4.1.0
 pytest-json-report>=1.5.0
 black<26.0.0,>=25.0.0
-isort<6.0.0,>=5.12.0
-mypy<2.0.0,>=1.7.1
+isort<6.0.0,>=5.13.2
+mypy<2.0.0,>=1.16.1
 ruff>=0.1.0
+pylint>=3.0.0
+flake8>=7.0.0
+flake8-docstrings>=1.7.0
+flake8-bugbear>=24.1.0
+flake8-comprehensions>=3.14.0
+flake8-simplify>=0.21.0
 pre-commit>=4.5.1
+bandit>=1.7.0
+safety>=3.0.0
 build>=1.2.2.post1
 maturin>=1.9.3
 twine>=4.0.0