chore(deps): bump importlib-metadata from 8.9.0 to 9.0.0

[dependabot]

Bumps importlib-metadata from 8.9.0 to 9.0.0.

Changelog

Sourced from importlib-metadata's changelog.

v9.0.0

Deprecations and Removals

• Added MetadataNotFound (subclass of FileNotFoundError) and updated Distribution.metadata/metadata() to raise it when the metadata files are missing instead of returning Nonepython/cpython#143387#532)

Commits

• a9f883f Finalize
• 9b0dfdf Raise an exception when no metadata file is found (#532)
• 0f2229c Merge branch 'main' into feature/no-metadata-exception
• 2f4088e Remove news fragments about internal details.
• 0ac2720 Add news fragment.
• 07389c4jaraco/skeleton#193
• 16fb289 Bump pytest-checkdocs to >= 2.14 to resolve deprecation warnings (jaraco/...
• d9b029b Don't install (nor run) mypy on PyPy (librt build failures) (jaraco/skeleton#...
• d5c6862jaraco/skeleton#183
• 18a6764 Re-use ExceptionTrap for trapping exceptions.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[opencode-agent]

OpenCode Review Overview

• Head SHA: 7fb268e8b600c57677966c6aafc657d09bc22538
• Workflow run: 31394161021
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (exit 0)

B['pip install --require-hashes -r requirements-strix-ci-hashes.txt'] --> C['ResolutionImpossible: litellm 1.94.1 requires importlib-metadata <9.0 (line 1068)']; C --> D['Strix Security Scan Install Strix step exit 1']; C --> E['Python Security pip-audit -r requirements-strix-ci-hashes.txt exit 1']; B -. 'verification: python3 -m pip install --dry-run --require-hashes -r requirements-strix-ci-hashes.txt' .-> F['resolution must succeed after revert or coordinated litellm bump']. PoC/execution: no OPENCODE_EXECUTION_RECEIPT lines exist in this run; trusted failed-check logs are the execution evidence (execute nothing inside the review). DDD/domain: not applicable - lockfile-only change, no domain code. CDD/context: not applicable - no consumer context code changed. Similar issues: this lockfile has a history of refreshes (7616fd8 fix(security): refresh vulnerable Strix lock snapshot; dependabot bumps #602, #597, #717, #630, #614), so a coordinated litellm+importlib-metadata refresh is the expected pattern. Claim/concept check: PR title claims a bump to 9.0.0; the pin at line 935 confirms the claim, but it contradicts litellm 1.94.1 metadata recorded in the same file (log-quoted). Standards search: pip --require-hashes resolution semantics evidenced directly from the trusted ResolutionImpossible log. Compatibility/convention: no schema/API/config identifiers added or renamed, so naming/reserved-word review does not apply to a hashes lockfile; pin format matches repository convention. Breaking-change/backcompat: install-breaking - 9.0.0 violates litellm 1.94.1's <9.0 upper bound and is a major-version jump. Performance: not applicable. Developer experience: DX surface is the CI install gate (Strix Install Strix step) and pip-audit outputs; evidence is the failed-check logs. User experience: not applicable (no UI); the non-web interaction surface reviewed is CI install/audit output. Visual/DOM: no web UI change; non-web surface reviewed is the lockfile and CI logs. Accessibility/i18n: not applicable. Supply-chain/license: both new sha256 hashes are present and the --require-hashes format is intact, but the entry is unusable because resolution aborts; no license/source change. Packaging: requirements-strix-ci-hashes.txt is the pinned build contract for the Strix CI environment; this change breaks that packaging contract. Security/privacy: the Strix security scan's own toolchain cannot be installed at head, so the security gate is effectively skipped until the resolver conflict is fixed - a security-posture regression.","adversarial_validation":{"status":"failed","probes":[{"path":"requirements-strix-ci-hashes.txt","line":935,"hypothesis":"The bumped pin importlib-metadata==9.0.0 (added at line 935) resolves cleanly against the rest of the hashes lockfile, so the Strix CI environment still installs.","attack_or_counterexample":"Dependency/runtime mismatch: pip must resolve importlib-metadata==9.0.0 together with litellm==1.94.1 (same file, line 1068 per pip) under --require-hashes in the Strix Install Strix step and the pip-audit dry-run install.","evidence":"Trusted failed-check logs at requirements-strix-ci-hashes.txt:935: observed 'ERROR: Cannot install -r requirements-strix-ci-hashes.txt (line 1068) and importlib-metadata==9.0.0 because these package versions have conflicting dependencies', 'litellm 1.94.1 depends on importlib-metadata<9.0 and >=8.0.0', 'ERROR: ResolutionImpossible ... Process completed with exit code 1' (failed-check-evidence.md lines 215-229) for Strix Security Scan/strix check run 93471643577, and the identical conflict for pip-audit check run 93471835672 (failed-check-evidence.md lines 299-302); both checks concluded FAILURE at head 7fb268e. source-line-sha256=cceac243341c2ea60e4e6a8a662e2acd1067019a326abacc4a8fd6db97eaf9a1","outcome":"confirmed"},{"path":"requirements-strix-ci-hashes.txt","line":937,"hypothesis":"The newly pinned sha256 hashes for importlib-metadata 9.0.0 (line 937) integrate into the lockfile and the safe-install gate reaches hash verification.","attack_or_counterexample":"Boundary/rollback behavior: with --require-hashes, pip must fail safe before installing anything when the lockfile is internally inconsistent with the resolver graph.","evidence":"Trusted failed-check logs at requirements-strix-ci-hashes.txt:937: the resolver aborted at the dependency-resolution stage ('ERROR: ResolutionImpossible ... Process completed with exit code 1', failed-check-evidence.md lines 215-229 for Strix and lines 299-302 for pip-audit) before any wheel of importlib-metadata 9.0.0 was downloaded and before any sha256 comparison could occur; no hash-validation stage was reached, and both gating checks (93471643577, 93471835672) ended in FAILURE at head 7fb268e. source-line-sha256=b03ef8de51beb545f49f1dd2f4ed0f3cd6b11827c7a63dabf70f1db6fedd7218","outcome":"confirmed"}],"residual_risk":"After the conflict is fixed (revert to 8.9.0, or a coordinated litellm bump whose metadata permits importlib-metadata >=9 with a regenerated consistent lockfile), both checks must be rerun; bounded residual risk is that another transitive pin in this large lockfile (2400+ lines) imposes an analogous cap, which the dry-run resolution command will surface."},"findings":[{"title":"importlib-metadata 9.0.0 bump makes the Strix CI lockfile unresolvable (litellm 1.94.1 caps importlib-metadata <9.0)","severity":"P1","path":"requirements-strix-ci-hashes.txt","line":935,"problem":"The dependabot bump replaces the importlib-metadata==8.9.0 pin with importlib-metadata==9.0.0 (line 935) while the same lockfile pins litellm==1.94.1 (pip-reported line 1068), whose metadata requires importlib-metadata<9.0 and >=8.0.0. pip --require-hashes therefore cannot install this environment: the Strix Security Scan/strix 'Install Strix' step (check run 93471643577) and the Python Security pip-audit gate (check run 93471835672) both fail with 'ERROR: ResolutionImpossible' and 'Process completed with exit code 1' at every head commit (failed-check-evidence.md lines 215-229 and 299-302). Observable impact: the Strix security scan cannot install its pinned toolchain and the pip-audit hard gate fails on requirements-strix-ci-hashes.txt, so the dependency-security CI posture for the branch is broken and the security scan is effectively skipped until fixed.","root_cause":"importlib-metadata 9.0.0 (with its two new sha256 hashes at lines 936-937) violates litellm 1.94.1's installed dependency cap 'importlib-metadata<9.0 and >=8.0.0' recorded in the same requirements-strix-ci-hashes.txt lockfile; the bump updated only the importlib-metadata entry without a coordinated litellm update, producing an internally inconsistent resolver graph.","fix_direction":"Either revert the bump back to importlib-metadata==8.9.0 with its original hashes (suggested_diff below) and let dependabot re-run once litellm relaxes its <9.0 upper bound, or, in the same PR, also bump litellm to a release whose metadata allows importlib-metadata 9.x and regenerate the complete hashes lockfile consistently via pip-compile; then rerun both failed CI checks.","regression_test_direction":"Run 'python3 -m pip install --disable-pip-version-check --no-cache-dir --require-hashes --dry-run -r requirements-strix-ci-hashes.txt' and require exit code 0, then rerun the Strix Security Scan/strix and Python Security/pip-audit workflows (check runs 93471643577 and 93471835672) and require PASS.","suggested_diff":"-importlib-metadata==9.0.0 \\\n- --hash=sha256:2d21d1cc5a017bd0559e36150c21c830ab1dc304dedd1b7ea85d20f45ef3edd7 \\\n- --hash=sha256:a4f57ab599e6a2e3016d7595cfd72eb4661a5106e787a95bcc90c7105b831efc\n+importlib-metadata==8.9.0 \\\n+ --hash=sha256:58850626cef4bd2df100378b0f2aea9724a7b92f10770d547725b047078f99ee \\\n+ --hash=sha256:e0f761b6ea91ced3b0844c14c9d955224d538105921f8e6754c00f6ca79fba7f","evidence":"requirements-strix-ci-hashes.txt:935 (added pin) confirmed against trusted failed-check logs: 'ERROR: Cannot install -r requirements-strix-ci-hashes.txt (line 1068) and importlib-metadata==9.0.0 because these package versions have conflicting dependencies' / 'litellm 1.94.1 depends on importlib-metadata<9.0 and >=8.0.0' / 'ERROR: ResolutionImpossible' / exit code 1 (failed-check-evidence.md lines 215-229, 299-302); active check failures at head SHA 7fb268e with annotations .github:312-312 and .github:64-65."}]}

-->

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: requirements-strix-ci-hashes.txt"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: requirements-strix-ci-hashes.txt"]
  R1 --> V1["required checks"]

Loading