[renovate]

Change proposal

Change

Restore the dependency security gate for the interoperability peers.

• Update x/net to 0.60.0 and certifi to 2026.10.19.
• Use mise-action v5.2.0 and Go 1.27.3.
• Use requirements.in and generated requirements.txt files for automatic lock maintenance and complete dependency scans.
• Align lock hashes and provenance paths with the tested peers.
• Add portable license checking and exclude installed peer packages from the source secret scan.

Closes #44.

Evidence

• The Go peer builds with Go 1.27.3.
• The Python environment installs from the generated distribution hashes.
• The dependency scan reads all ten locked Python packages and reports no issues with the existing narrow advisory filter.
• The header compression self-tests and seventeen bidirectional cases pass with the current lock.
• Renovate strict validation and extraction identify the source pins and generated lock.
• Configuration, workflow, spelling, license, secret, and changed README checks pass on Windows.
• Required hosted checks and independent HTTP/3 interoperability pass on the final head.

The Windows check passes 1,343 tests and 1,080 stability executions.

The local common check stops at an existing coverage audit error on path separators.

Security and release scope

This update changes peer dependencies and verification configuration.
It includes no package publication or release tag.

@coderabbitai ignore

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 3e1a0d65-f278-4786-9f60-ce00acd437d7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.