[mmabrouk]

Fixes

Dependabot filelock alerts (<= 4.2.0; HIGH #1855, #1875, plus the LOW/MODERATE ones on the same package) in services/uv.lock and sdks/python/uv.lock. The alerts listed against sdk/poetry.lock point at a file that no longer exists and should auto-close or be dismissed.

Change

filelock 3.29.7 → 4.2.1 (lock diffs identical to Dependabot PRs #7855 and #7902). This is a major-version bump, but filelock is a transitive dependency and both locks resolve cleanly.

Testing (Hetzner)

uv sync --locked && uv run --no-sync python run-tests.py --layer unit

• services: fix 226 passed; main baseline 226 passed.
• sdks/python: fix 3875 passed, 2 skipped, 17 xfailed, 20 errors; main baseline 3875 passed, 2 skipped, 17 xfailed, 20 errors. The 20 errors are the same collection errors on both (test_mcp_policy_ladder_fixture.py: no .git in the tarball-based checkout). Verified identical to the unchanged-main baseline, so pre-existing and environment-related.
• Resolved filelock in sdks/python env: 4.2.1.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 2

• sdks/python/uv.lock is excluded by !**/*.lock
• services/uv.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration

• Source mode: Auto
• Repository: Agenta-AI/agenta
• Branch: fix/deps-filelock-4.2.1
• File: .coderabbit.yaml
• Commit: bd4fba5
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: fa99ff48-b464-4b48-ac31-06c3067d804a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

Railway Preview Environment

Item	Value
Status	stopped
Commit	bd4fba5f6e77f4ea440785cecc6678697a8fdcba
Manual expiry (UTC)	Not granted
CI deadline (UTC)	Not granted
Workflow	https://github.com/Agenta-AI/agenta/actions/runs/42178876842

Dependent tests finished. Post /preview for manual review. Environment absence verified; retained storage requires separate provider accounting.

Post /preview as a new comment to request a one-hour preview. Repeating it while active does not extend the hour.
Preview data is disposable. Expiry is enforced by the next successful cleanup sweep, not an exact timer.
Environment deletion stops its compute. Provider-retained storage and permanent services may still be billed.