Skip to content

backport CVE-2026-115557 fix (distrust compromised eMudhra CA keys) - #279

Merged
SC426 merged 2 commits into
main-3.10from
update-python-3.10-cve-2026-115557
Oct 29, 2026
Merged

SC426 merged 2 commits into
main-3.10from
update-python-3.10-cve-2026-115557

Conversation

@SC426

@SC426 SC426 commented Oct 29, 2026 •

Copy link
Copy Markdown

python 3.10.22 - backport fix for CVE-2026-115557

Destination channel: defaults

Links

Explanation of changes:

  • Backports the 3.11 fix (commit 7dd8b4736a1419750b94a388e6d158be15836fe6) to 3.10 as source patch 0030. 3.10 is end-of-life and has no upstream fixed release for this CVE.
  • Adds a denylist of compromised eMudhra intermediate CA SPKI digests (Modules/_ssl/distrusted_spki.h) and a verify callback in Modules/_ssl.c that rejects chains containing them.
  • Adds a regression test using the upstream distrusted-cert fixture, shipped as the encrypted archive upstream uses.
  • Adds anaconda.yaml for version tracking.
  • Skips win-arm64: it ships Python >=3.12 only, so Python 3.10 is not built there.
  • Bumps build_number to 1.

SC426 added 2 commits October 29, 2026 11:20
Python 3.10 reached end of life without a fixed release for
CVE-2026-115557 (gh-160040), so backport the 3.11 fix
(7dd8b4736a1419750b94a388e6d158be15836fe6) as a source patch: distrust
compromised eMudhra intermediate CA keys.

Adds a regression test that checks a peer chain signed by a distrusted
intermediate is rejected with X509_V_ERR_CERT_REJECTED.
win-arm64 is now part of the default build matrix (package-build-platform#3947,
AnacondaRecipes/aggregate#703), but it ships Python >=3.12 only. Skip both
outputs so the 3.10 recipe does not attempt win-arm64.
@anaconda-package-review-v2

Copy link
Copy Markdown

🔴 Mergeability confidence: 0/100 (concern) — 2 reviewers recommended

66 checks · 31 passed · 6 warnings · 4 critical

Categorization

  • 🟡 no-setup-py-script — Package 'libpython-static' has no inline build script; external build scripts (build.sh/bld.bat) were not analyzed.
    Evidence

(truncated — see full report)

- 🟡 **no-setup-py-script** — Package 'python' has no inline build script; external build scripts (build.sh/bld.bat) were not analyzed.
Evidence

(truncated — see full report)

- 🟡 **pure-python** — Package 'libpython-static' has native compilation signals: compiler deps ['gcc', 'gxx'], build script indicators ['compiler() reference in recipe'].
Evidence

(truncated — see full report)

- 🟡 **pure-python** — Package 'python' is not pure Python: no `python` build/host requirement; native compilation signals: compiler deps ['gcc', 'gxx'], native build tools ['libtool', 'make', 'pkg-config'], native host libs ['zlib', 'readline', 'ncurses', 'xz', 'sqlite', 'openssl', 'bzip2', 'libffi'], build script indicators ['compiler() reference in recipe'].
Evidence

(truncated — see full report)

- 🟡 **version-only-bump** — PR modifies 4 non-recipe file(s) — not a version-only bump
Evidence

(truncated — see full report)

Needs attention

libpython-static

  • 🟡 win-arm64-on-main — win-arm version detected on main: Please ensure a win-arm version is tested and released
    Evidence

(truncated — see full report)

python

  • 🔴 abi-symbol-comparison — Failed on 1/4 artifact(s). win-64 (hb00fc5c_1): 130 ABI symbols removed (potential breakage): PyABIInfo_Check, PyBuffer_FillContiguousStrides, PyBuffer_FillInfo, PyBuffer_FromContiguous, PyBuffer_GetPointer, … and 125 more (comparing 3.15.2 → 3.10.22)
    Evidence

(truncated — see full report)

- 🔴 **not-cbc-pinned** — Package 'python' is pinned in the aggregate conda_build_config.yaml. Changes to CBC-pinned packages can cascade across the ecosystem and require careful review.
Evidence

(truncated — see full report)

- 🔴 **not-miniconda-member** — Package 'python' is part of the miniconda distribution. Changes to miniconda packages can break the installer bootstrap and require careful review.
Evidence

(truncated — see full report)

- 🟡 **build-log-warnings** — Build log contains 2 unique overdepending warning(s) (2 total occurrences): Declared runtime dependency is never actually used by built binaries Open the build log and confirm warnings are benign.
Evidence

(truncated — see full report)

- 🟡 **cbc-dep-pinning** — Package 'python': 1 dependency has hardcoded versions but is available in CBC: libffi (host: 3.4). Use the CBC pin in host (`pkg {{ pkg }}` or `pin_compatible`); run bounds are not CBC overrides.
Evidence

(truncated — see full report)

- 🟡 **soname-changes** — Failed on 4/4 artifact(s). linux-64 (hd9cb797_1): ⚠️ Shared-library name changes detected for 'python' (linux-64): +77 added, -76 removed, 0 renamed — +_asyncio.cpython-310-x86_64-linux-gnu.so, +_bisect.cpython-310-x86_64-linux-gnu.so, +_blake2.cpython-310-x86_64-linux-gnu.so, +_bz2.cpython-310-x86_64-linux-gnu.so, +_codecs_cn.cpython-310-x86_64-linux-gnu.so, … and 148 more (comparing 3.15.2 → 3.10.22).; linux-aarch64 (h6e24c03_1): ⚠️ Shared-library name changes detected for 'python' (linux-aarch64): +77 added, -76 removed, 0 renamed — +_asyncio.cpython-310-aarch64-linux-gnu.so, +_bisect.cpython-310-aarch64-linux-gnu.so, +_blake2.cpython-310-aarch64-linux-gnu.so, +_bz2.cpython-310-aarch64-linux-gnu.so, +_codecs_cn.cpython-310-aarch64-linux-gnu.so, … and 148 more (comparing 3.15.2 → 3.10.22).; osx-arm64 (h478e877_1): ⚠️ Shared-library name changes detected for 'python' (osx-arm64): +76 added, -78 removed, 0 renamed — +_asyncio.cpython-310-darwin.so, +_bisect.cpython-310-darwin.so, +_blake2.cpython-310-darwin.so, +_bz2.cpython-310-darwin.so, +_codecs_cn.cpython-310-darwin.so, … and 149 more (comparing 3.15.2 → 3.10.22).; win-64 (hb00fc5c_1): ⚠️ Shared-library name changes detected for 'python' (win-64): +2 added, -10 removed, 0 renamed — +_msi.pyd, +python310.dll, -_remote_debugging.pyd, -_testclinic.pyd, -_testclinic_limited.pyd, … and 7 more (comparing 3.15.2 → 3.10.22).
Evidence

(truncated — see full report)

- 🟡 **static-libraries** — Failed on 1/4 artifact(s). win-64 (hb00fc5c_1): Output 'python' (win-64 (hb00fc5c_1)) ships 3 static libraries (.a/.lib) but is not a devel/dev/static-named output (libs/_tkinter.lib, libs/python3.lib, libs/python310.lib). Static archives belong in a dedicated -devel/-static output.
Evidence

(truncated — see full report)

- 🟡 **win-arm64-on-main** — win-arm version detected on main: Please ensure a win-arm version is tested and released
Evidence

(truncated — see full report)

unknown

  • 🔴 patch-files-changed — PR modifies upstream patches for 'unknown'. 1 new patch file added: recipe/patches/0030-Distrust-compromised-eMudhra-intermediate-CA-keys.patch. Patches are the hardest component to review — verify no subtle bugs or security issues. Review the patch for upstream relevance and re-baseline.
    Evidence

(truncated — see full report)

- 🟡 **build-log-warnings** — Build log contains 1 unique network-access-during-build warning(s) (1 total occurrences): Network access detected during build (unreproducible builds) Open the build log and confirm warnings are benign.
Evidence

(truncated — see full report)

- 🟡 **new-platform-selectors** — ⚠️ PR introduces new platform selector(s) for 'unknown': [win and arm64]. Platform-conditional logic is error-prone and hard to test across all platforms. Confirm the platform selector / variant matrix is intended.
Evidence

(truncated — see full report)

- 🟡 **no-ddb-impact** — Downstream packages require action: rebuild: ['absl-py', 'adagio', 'aenum', 'affine', 'agate', 'agate-dbf', 'agate-excel', 'agate-sql', 'aiobotocore', 'aiofiles', 'aiohappyeyeballs', 'aiohttp', 'aiohttp-jinja2', 'aiorwlock', 'aiosqlite', 'alabaster', 'alembic', 'allure-behave', 'allure-nose2', 'allure-pytest', 'allure-pytest-bdd', 'allure-python-commons', 'allure-robotframework', 'altgraph', 'altair', 'anaconda-anon-usage', 'anaconda-catalogs', 'anaconda-clean', 'anaconda-cli-base', 'anaconda-client', 'anaconda-cloud', 'anaconda-cloud-cli', 'anaconda-navigator', 'anaconda-project', 'annotated-types', 'ansi2html', 'antlr4-python3-runtime', 'anyio', 'anyqt', 'apache-libcloud', 'apispec', 'apptools', 'apscheduler', 'argcomplete', 'argh', 'argon2-cffi', 'argon2-cffi-bindings', 'arrow', 'arviz', 'asgiref', 'asn1crypto', 'astor', 'astroid', 'astropy', 'astropy-iers-data', 'asv', 'async-lru', 'asyncpg', 'atom', 'attrs', 'authlib', 'autograd', 'autograd-gamma', 'automat', 'autopep8', 'autovizwidget', 'aws-sam-translator', 'aws-xray-sdk', 'azure-core', 'azure-functions', 'azure-storage-blob', 'babel', 'backoff', 'basemap', 'basemap-data', 'basemap-data-hires', 'bcrypt', 'beautifulsoup4', 'behave', 'billiard', 'biopython', 'bitarray', 'black', 'bleach', 'blessings', 'blessed', 'blinker', 'bokeh', 'boolean.py', 'boltons', 'boto3', 'botocore', 'bottleneck', 'brotli-python', 'brotlicffi', 'bsdiff4', 'btrees', 'bytecode', 'cachecontrol', 'cachecontrol-with-filecache', 'cachecontrol-with-redis', 'cached-property', 'cachelib', 'cachetools', 'calver', 'capturer', 'captum', 'cartopy', 'cassandra-driver', 'catalogue', 'catboost', 'category_encoders', 'cattrs', 'cchardet', 'certifi', 'cffi', 'cfgv', 'cftime', 'cgroupspy', 'chameleon', 'chardet', 'cheroot', 'cherrypy', 'chex', 'ciso8601', 'cleo', 'click', 'clickhouse-cityhash', 'clickhouse-driver', 'clickhouse-sqlalchemy', 'cloudpathlib', 'cloudpathlib-all', 'cloudpathlib-azure', 'cloudpathlib-gs', 'cloudpathlib-s3', 'cloudpickle', 'clr_loader', 'cmaes', 'cmarkgfm', 'cmdstanpy', 'cmyt', 'colorama', 'colorcet', 'colorspacious', 'comm', 'composeml', 'conda', 'conda-auth', 'conda-build', 'conda-content-trust', 'conda-index', 'conda-libmamba-solver', 'conda-pack', 'conda-lock', 'conda-package-handling', 'conda-package-streaming', 'conda-souschef', 'confection', 'configargparse', 'configobj', 'configparser', 'configspace', 'cons', 'constantly', 'constructor', 'contextlib2', 'contourpy', 'cookiecutter', 'coremltools', 'coverage', 'cppy', 'cramjam', 'crashtest', 'cron-descriptor', 'croniter', 'cryptography-vectors', 'cssselect', 'csvkit', 'ctypesgen', 'cuda-gdb', 'cupy', 'cvxopt', 'cycler', 'cymem', 'cython', 'cython-blis', 'cytoolz', 'dacite', 'dash', 'dash_cytoscape', 'dask', 'dask-core', 'dask-expr', 'dask-glm', 'dask-image', 'dask-jobqueue', 'dask-ml', 'databricks-cli', 'datasets', 'datashader', 'dateparser', 'dateutils', 'dawg-python', 'dbf', 'dbt-extractor', 'dbus-python', 'debugpy', 'decorator', 'deepdiff', 'deprecated', 'dicttoxml', 'diffusers', 'diffusers-torch', 'diffusers-base', 'dill', 'distconfig3', 'distlib', 'distributed', 'distro', 'django', 'dm-tree', 'dnspython', 'docker-py', 'docopt', 'docstring-to-markdown', 'docutils', 'doit', 'drmaa', 'dropbox', 'dulwich', 'dunamai', 'ecdsa', 'ecos', 'editables', 'editdistance', 'elasticsearch', 'elementpath', 'email-validator', 'emfile', 'enaml', 'ensureconda', 'entrypoints', 'ephem', 'et_xmlfile', 'etuples', 'evaluate', 'eventlet', 'exceptiongroup', 'expandvars', 'extension-helpers', 'faker', 'farama-notifications', 'fast-histogram', 'fastapi', 'fastavro', 'fastcache', 'fastcluster', 'fastcore', 'fastdownload', 'fastparquet', 'fastrlock', 'favicon', 'featuretools', 'feedparser', 'filelock', 'findpython', 'flake8', 'fiona', 'flake8-import-order', 'flask', 'flask-apscheduler', 'flask-appbuilder', 'flask-admin', 'flask-caching', 'flask-compress', 'flask-json', 'flask-cors', 'flask-jwt-extended', 'flask-login', 'flask-openid', 'flask-restful', 'flask-restx', 'flask-session', 'flask-socketio', 'flask-sqlalchemy', 'flask-wtf', 'flit', 'flit-core', 'flit-scm', 'folium', 'formulaic', 'fonttools', 'frozendict', 'frozenlist', 'fs', 'fsspec', 'ftfy', 'fugue-sql-antlr', 'furl', 'gast', 'gdal', 'gdb', 'gensim', 'genson', 'geographiclib', 'geopandas', 'geopandas-base', 'geopy', 'geoviews-core', 'gevent', 'geventhttpclient', 'gi-docgen', 'gitpython', 'glue-core', 'glue-vispy-viewers', 'glueviz', 'gluonts', 'gmpy2', 'gobject-introspection', 'google-api-core', 'google-api-core-grpc', 'google-auth', 'google-cloud-core', 'google-auth-oauthlib', 'google-cloud-storage', 'google-resumable-media', 'googleapis-common-protos', 'googleapis-common-protos-grpc', 'gpustat', 'graphene', 'graphql-relay', 'grayskull', 'greenlet', 'graphql-core', 'grpcio', 'grpcio-status', 'grpcio-tools', 'gunicorn', 'gymnasium', 'h11', 'h2', 'h5netcdf', 'h5py', 'hatch-nodejs-version', 'hatch-fancy-pypi-readme', 'hatch-jupyter-builder', 'hatch-requirements-txt', 'hatch-vcs', 'hatchling', 'hdijupyterutils', 'hdmedians', 'hiredis', 'holidays', 'holoviews', 'hpack', 'hsluv', 'htbuilder', 'httpcore', 'httptools', 'httpx', 'huggingface_hub', 'humanize', 'hvplot', 'hyperframe', 'hypothesis', 'icalendar', 'identify', 'idna', 'ijson', 'imagecodecs', 'imagehash', 'imageio', 'imagesize', 'imbalanced-learn', 'iminuit', 'immutables', 'importlib-metadata', 'importlib_metadata', 'importlib_resources', 'impyla', 'infinity', 'inflate64', 'inflect', 'inflection', 'inquirer', 'intake', 'intake-xarray', 'interface_meta', 'intervals', 'invoke', 'ipykernel', 'ipyleaflet', 'ipympl', 'ipyparallel', 'ipython', 'ipywidgets', 'iso8601', 'isodate', 'isort', 'itsdangerous', 'itemloaders', 'jaraco.classes', 'jaraco.text', 'jax', 'jax-jumpy', 'jedi', 'jellyfish', 'jinja2', 'jinxed', 'jmespath', 'joblib', 'joserfc', 'jpype1', 'js2py', 'jschema-to-python', 'jsondiff', 'jsonpatch', 'jsonpickle', 'jsonschema', 'jsonpath-ng', 'jsonschema-path', 'jsonschema-specifications', 'jupyter', 'jupyter-lsp-python', 'jupyter-lsp', 'jupyter-packaging', 'jupyter-server-proxy', 'jupyter-server-mathjax', 'jupyter_bokeh', 'jupyter_client', 'jupyter_console', 'jupyter_core', 'jupyter_events', 'jupyter_kernel_gateway', 'jupyter_server', 'jupyter_server_fileid', 'jupyter_server_terminals', 'jupyter_server_ydoc', 'jupyter_ydoc', 'jupyterhub', 'jupyterhub-base', 'jupyterhub-singleuser', 'jupyterlab', 'jupyterlab-geojson', 'jupyterlab-git', 'jupyterlab-variableinspector', 'jupyterlab_code_formatter', 'jupyterlab_launcher', 'jupyterlab_pygments', 'jupyterlab_server', 'jupyterlab_widgets', 'jupytext', 'kagglehub', 'keras', 'keyring', 'keyrings.alt', 'kiwisolver', 'knit', 'kmodes', 'kombu', 'lark', 'lazy-object-proxy', 'lazy_loader', 'leb128', 'libcst', 'libmambapy', 'libpysal', 'license-expression', 'lightgbm', 'lightning-utilities', 'lightning-cloud', 'line_profiler', 'linkify-it-py', 'lit', 'llvmlite', 'locket', 'logbook', 'logical-unification', 'loguru', 'loky', 'luigi', 'lxml', 'lz4', 'm2cgen', 'macholib', 'mako', 'mapclassify', 'markdown', 'markdown-it-py', 'markdown2', 'markdownlit', 'markupsafe', 'marshmallow', 'marshmallow-oneofschema', 'mashumaro', 'matplotlib', 'matplotlib-base', 'matplotlib-inline', 'maturin', 'mccabe', 'mdit-py-plugins', 'mayavi', 'mdurl', 'medspacy_quickumls', 'menuinst', 'meson', 'meson-python', 'metakernel', 'minikanren', 'mistune', 'mizani', 'mkl-service', 'mkl_fft', 'mkl_random', 'ml_dtypes', 'mlflow', 'mlxtend', 'mmh3', 'mockupdb', 'mockito', 'modin', 'modin-all', 'modin-core', 'modin-dask', 'modin-ray', 'more-itertools', 'moto', 'mpi4py', 'mpl-scatter-density', 'mpld3', 'mpmath', 'msal', 'msgpack-numpy', 'msgpack-python', 'msrest', 'multidict', 'multimethod', 'multipart', 'multipledispatch', 'multiprocess', 'munch', 'murmurhash', 'mypy', 'mypy-protobuf', 'mypy_extensions', 'mypyc', 'mysql-connector-python', 'mysqlclient', 'namex', 'natsort', 'navigator-updater', 'nb_conda_kernels', 'nbclassic', 'nbclient', 'nbconvert', 'nbdime', 'nbformat', 'nbgrader', 'nbsmoke', 'neo4j-python-driver', 'neotime', 'netcdf4', 'networkx', 'nltk', 'nodeenv', 'nose2', 'notebook', 'notebook-shim', 'numba', 'nuitka', 'numcodecs', 'numexpr', 'numpy', 'numpy-base', 'numpydoc', 'nvidia-ml-py', 'oauthenticator', 'oauthlib', 'onnx', 'onnxconverter-common', 'onnxmltools', 'onnxruntime', 'onnxruntime-novec', 'openai', 'openapi-schema-validator', 'openapi-spec-validator', 'opencensus-context', 'opencv', 'openpyxl', 'opentelemetry-api', 'opentelemetry-instrumentation', 'opentelemetry-proto', 'opentelemetry-semantic-conventions', 'opentsne', 'optimum', 'optax', 'optree', 'oracledb', 'orange-canvas-core', 'orange-widget-base', 'orange3', 'ordered-set', 'orderedmultidict', 'orjson', 'osqp', 'overrides', 'owslib', 'packaging', 'pandarallel', 'pamela', 'pandas-datareader', 'pandas-stubs', 'pandasql', 'pandocfilters', 'panel', 'param', 'parameterized', 'paramiko', 'parse', 'parse_type', 'parsedatetime', 'parsel', 'parso', 'partd', 'passlib', 'pastedeploy', 'path', 'pathable', 'pathos', 'pathspec', 'pathy', 'patsy', 'pbkdf2', 'pbr', 'pdm-backend', 'pdm-pep517', 'pefile', 'pegen', 'pendulum', 'pep8-naming', 'persistent', 'petl', 'pexpect', 'phik', 'phonenumbers', 'picklable-itertools', 'pillow', 'pims', 'pip', 'pivottablejs', 'pipenv', 'pkce', 'pkgconfig', 'pkginfo', 'pkgutil-resolve-name', 'plac', 'plotly', 'plotly-resampler', 'pluggy', 'ply', 'plyvel', 'pmdarima', 'plotnine', 'poetry-core', 'poetry-dynamic-versioning', 'pomegranate', 'pooch', 'portalocker', 'portend', 'portpicker', 'posix_ipc', 'pox', 'ppft', 'pre-commit', 'preshed', 'pretend', 'prettytable', 'prince', 'prison', 'progress', 'progressbar2', 'prometheus_client', 'prometheus_flask_exporter', 'promise', 'prompt-toolkit', 'prophet', 'proto-plus', 'psutil', 'psycopg2', 'py-cpuinfo', 'py-lief', 'py-partiql-parser', 'py4j', 'py7zr', 'pyamg', 'pyaml', 'pyarrow', 'pyasn1', 'pyasn1-modules', 'pybcj', 'pybind11', 'pybind11-global', 'pycairo', 'pycares', 'pyclipper', 'pycodestyle', 'pycparser', 'pycryptodome', 'pycryptodomex', 'pycryptosat', 'pyct', 'pycurl', 'pydantic-core', 'pydispatcher', 'pydot', 'pyee', 'pydruid', 'pyemd', 'pyerfa', 'pyface', 'pyfastner', 'pyflakes', 'pygments', 'pygraphviz', 'pyhamcrest', 'pyicu', 'pyinstaller', 'pyinstaller-hooks-contrib', 'pyjsparser', 'pyjwt', 'pykdtree', 'pykrb5', 'pylint', 'pymc', 'pymc-experimental', 'pymdown-extensions', 'pygithub', 'pymongo', 'pymorphy3', 'pymorphy3-dicts-ru', 'pymorphy3-dicts-uk', 'pympler', 'pymssql', 'pymysql', 'pynacl', 'pynndescent', 'pyod', 'pyodbc', 'pyopengl-accelerate', 'pyopenssl', 'pyopengl', 'pypandoc', 'pyparsing', 'pypdf-with-crypto', 'pypdf', 'pypdf-with-full', 'pypdf-with-image', 'pyphen', 'pypng', 'pyppmd', 'pyproj', 'pyproject-metadata', 'pyproject_hooks', 'pyqt', 'pyqt-builder', 'pyqt5-sip', 'pyqtgraph', 'pyqtwebengine', 'pyrsistent', 'pyrush', 'pysbd', 'pysal', 'pyserial', 'pyshp', 'pysimstring', 'pysmi', 'pysnmp', 'pysocks', 'pyspark', 'pyspnego', 'pytables', 'pystan', 'pytesseract', 'pytest', 'pytensor', 'pytest-arraydiff', 'pytest-astropy', 'pytest-asyncio', 'pytest-base-url', 'pytest-bdd', 'pytest-benchmark', 'pytest-console-scripts', 'pytest-cov', 'pytest-csv', 'pytest-dependency', 'pytest-describe', 'pytest-doctestplus', 'pytest-flake8', 'pytest-flakefinder', 'pytest-forked', 'pytest-html', 'pytest-httpserver', 'pytest-jupyter', 'pytest-jupyter-client', 'pytest-jupyter-server', 'pytest-metadata', 'pytest-mock', 'pytest-mpi', 'pytest-randomly', 'pytest-qt', 'pytest-remotedata', 'pytest-rerunfailures', 'pytest-selenium', 'pytest-shard', 'pytest-sugar', 'pytest-subprocess', 'pytest-timeout', 'pytest-tornasync', 'pytest-trio', 'pytest-variables', 'pytest-xdist', 'python-bidi', 'python-blosc', 'python-build', 'python-crfsuite', 'python-clang', 'python-dateutil', 'python-dotenv', 'python-engineio', 'python-flatbuffers', 'python-graphviz', 'python-gssapi', 'python-hdfs', 'python-installer', 'python-json-logger', 'python-jose', 'python-kaleido', 'python-fastjsonschema', 'python-kubernetes', 'python-ldap', 'python-libarchive-c', 'python-lmdb', 'python-lsp-black', 'python-louvain', 'python-lsp-server', 'python-memcached', 'python-multipart', 'python-rapidjson', 'python-slugify', 'python-pptx', 'python-snappy', 'python-socketio', 'python-utils', 'python-xxhash', 'python3-openid', 'pythonanywhere', 'pythonnet', 'pythran', 'pytimeparse', 'pytoolconfig', 'pytorch-lightning', 'pyts', 'pytz', 'pyviz_comms', 'pywavelets', 'pyyaml', 'pyzmq', 'pyzstd', 'qasync', 'qdldl-python', 'qpd', 'qrcode', 'qstylizer', 'qtawesome', 'qtconsole', 'qtpy', 'quantecon', 'querystring_parser', 'queuelib', 'quicksectx', 'quilt3', 'rasterio', 'ray-core', 'ray-dashboard', 'ray-data', 'ray-debug', 'ray-default', 'ray-rllib', 'ray-train', 'ray-tune', 're-assert', 'readchar', 'readme_renderer', 'redis-py', 'regex', 'referencing', 'reportlab', 'repoze.lru', 'requests', 'requests-cache', 'requests-file', 'requests-futures', 'requests-kerberos', 'requests-oauthlib', 'requests-toolbelt', 'requests-wsgi-adapter', 'responses', 'rfc3339-validator', 'rfc3986-validator', 'rich', 'rope', 'routes', 'rpds-py', 'rtree', 'ruamel.yaml.jinja2', 'ruff', 's3fs', 's3transfer', 'safetensors', 'salib', 'sarif_om', 'sas7bdat', 'sasl', 'sacrebleu', 'saspy', 'schema', 'scikit-bio', 'scikit-build', 'scikit-build-core', 'scikit-image', 'scikit-learn', 'scikit-rf', 'scipy', 'scons', 'scp', 'scs', 'seaborn', 'secretstorage', 'selenium', 'semver', 'semantic_version', 'send2trash', 'sentencepiece', 'sentry-sdk', 'serverfiles', 'service_identity', 'setproctitle', 'setuptools', 'setuptools-git', 'setuptools-git-versioning', 'setuptools-rust', 'setuptools-scm', 'shap', 'shapely', 'shellingham', 'simpervisor', 'simple-salesforce', 'simplejson', 'singledispatch', 'sip', 'sentencepiece-python', 'six', 'skl2onnx', 'slack-sdk', 'slicer', 'slicerator', 'smart_open', 'smartypants', 'snakeviz', 'sniffio', 'snowballstemmer', 'snowflake-connector-python', 'snowflake-ml-python', 'snowflake-snowpark-python', 'soupsieve', 'spacy', 'spacy-alignments', 'spacy-legacy', 'spacy-pkuseg', 'spacy-loggers', 'spacy-transformers', 'sparkmagic', 'spatialpandas', 'sphinx', 'sphinx-sitemap', 'sphinx-design', 'sphinx_rtd_theme', 'sphinxcontrib-images', 'sphinxcontrib-jquery', 'sphinxcontrib-websupport', 'sphinxcontrib-serializinghtml', 'sphinxcontrib-youtube', 'spin', 'spyder', 'spyder-kernels', 'sqlalchemy', 'sqlalchemy-jsonfield', 'sqlalchemy-utils', 'sqlglot', 'sqlparse', 'squarify', 'srsly', 'st-annotated-text', 'starlette', 'starlette-full', 'starsessions', 'statsmodels', 'stdlib-list', 'stone', 'streamlit', 'streamlit-camera-input-live', 'streamlit-card', 'streamlit-chat', 'streamlit-embedcode', 'streamlit-extras', 'streamlit-faker', 'streamlit-image-coordinates', 'streamlit-keyup', 'streamlit-toggle-switch', 'streamlit-vertical-slider', 'streamz', 'strict-rfc3339', 'stripe', 'stumpy', 'sudachidict-core', 'sudachipy', 'superqt', 'supervisor', 'swagger-ui-bundle', 'sympy', 'tabula-py', 'tabulate', 'tangled-up-in-unicode', 'tbb4py', 'tblib', 'tenacity', 'tensorboard', 'tensorboard-data-server', 'tensorboardx', 'tensorflow', 'tensorflow-base', 'tensorflow-datasets', 'termcolor', 'terminado', 'testfixtures', 'testpath', 'testtools', 'textblob', 'thefuzz', 'thinc', 'threadpoolctl', 'thrift', 'thrift_sasl', 'thriftpy2', 'tifffile', 'tinycss2', 'tldextract', 'tokenizers', 'tomli', 'tomlkit', 'toolz', 'torchmetrics', 'torchvision', 'tornado', 'trace-updater', 'traceback2', 'traitlets', 'traits', 'traitsui', 'traittypes', 'tranquilizer', 'transaction', 'transformers', 'treeinterpreter', 'triad', 'trio', 'trio-websocket', 'trustme', 'truststore', 'twine', 'twisted', 'typeguard', 'typer', 'types-futures', 'types-jsonschema', 'types-protobuf', 'types-psutil', 'types-pytz', 'types-pyyaml', 'types-setuptools', 'types-requests', 'types-toml', 'types-urllib3', 'typing', 'typing-extensions', 'typing_extensions', 'typing_inspect', 'typogrify', 'tzlocal', 'uc-micro-py', 'ujson', 'ukkonen', 'umap-learn', 'unearth', 'unicodedata2', 'unidecode', 'url-normalize', 'unyt', 'urllib3', 'uvicorn', 'uvicorn-standard', 'uvloop', 'uwsgi', 'vcrpy', 'vega_datasets', 'verboselogs', 'versioneer', 'virtualenv', 'virtualenv-clone', 'visions', 'vispy', 'visvis', 'voila', 'vtk', 'vyper-config', 'w3lib', 'waf', 'waitress', 'wasabi', 'watchdog', 'watchfiles', 'weasel', 'wcwidth', 'webencodings', 'webob', 'websocket-client', 'websockets', 'webtest', 'werkzeug', 'whatthepatch', 'wheel', 'widgetsnbextension', 'woodwork', 'wordcloud', 'workerpool', 'wrapt', 'ws4py', 'wsgiproxy2', 'wsproto', 'wtforms', 'wurlitzer', 'xarray', 'xarray-einstats', 'xattr', 'xcb-proto', 'xlsxwriter', 'xmlsec', 'xmltodict', 'xyzservices', 'y-py', 'yapf', 'yarl', 'ydata-profiling', 'yellowbrick', 'yt', 'zarr', 'zc.lockfile', 'zeep', 'zfpy', 'zict', 'zipfile-deflate64', 'zipp', 'zope.event', 'zope.interface', 'zope.sqlalchemy', 'zstandard', 'access', 'aiodns', 'aiohttp-cors', 'aiosignal', 'amqp', 'aniso8601', 'applaunchservices', 'archspec', 'asciitree', 'asttokens', 'bidict', 'beniget', 'baycomp', 'binaryornot', 'bs4', 'cerberus', 'certipy', 'celery', 'charset-normalizer', 'click-didyoumean', 'click-repl', 'colorful', 'conda-repo-cli', 'confuse', 'convertdate', 'datadog', 'dictdiffer', 'echo', 'esda', 'executing', 'expecttest', 'fasteners', 'fastprogress', 'flask-babel', 'freezegun', 'freetype-py', 'geoalchemy2', 'giddy', 'gitdb', 'greyskull', 'hstspreload', 'importlib-resources', 'iniconfig', 'inequality', 'itemadapter', 'jaraco.itertools', 'json-merge-patch', 'json5', 'jsonlines', 'jsonpointer', 'jupyterhub-ldapauthenticator', 'korean_lunar_calendar', 'mando', 'marshmallow-sqlalchemy', 'mgwr', 'missingno', 'openml', 'opt_einsum', 'palettable', 'patch-ng', 'pdoc3', 'pg8000', 'pointpats', 'pure_eval', 'pydata-google-auth', 'pylev', 'pymeeus', 'pyperf', 'pyperformance', 'pytest-astropy-header', 'pytest-filter-subpackage', 'pytest-localserver', 'pytest-replay', 'pytest-subtests', 'python-debian', 'python-jenkins', 'python-nvd3', 'python_http_client', 'pywinrm', 'radon', 'rasterstats', 'requests_ntlm', 'rfc3986', 'protego', 'sacremoses', 'scapy', 'scramp', 'segregation', 'slack_sdk', 'smmap', 'spaghetti', 'spglm', 'sphinxcontrib-jsmath', 'spint', 'splot', 'spreg', 'stack_data', 'tensorflow-hub', 'tensorflow-probability', 'textdistance', 'tensorflow-metadata', 'texttable', 'tobler', 'torch-lr-finder', 'treelib', 'tsfresh', 'vertica-python', 'validators', 'vine', 'win32_setctime', 'yq', 'yacs', 'appnope', 'appscript', 'macfsevents', 'pyobjc-core', 'pyobjc-framework-cocoa', 'pyobjc-framework-coreservices', 'pyobjc-framework-fsevents', 'python.app', 'xlwings', 'comtypes', 'maturin-gnu', 'pyreadline3', 'pywin32', 'pywin32-ctypes', 'pywinpty', 'twisted-iocpsupport', 'win_inet_pton', 'winkerberos', 'makefun', 'opentelemetry-exporter-otlp-proto-grpc', 'opentelemetry-exporter-otlp', 'opentelemetry-exporter-otlp-proto-http', 'opentelemetry-propagator-jaeger', 'opentelemetry-exporter-prometheus', 'opentelemetry-propagator-b3', 'opentelemetry-sdk', 'opentelemetry-opentracing-shim', 'rdkit', 'wandb', 'implicit', 'mlforecast', 'statsforecast', 'torchdata', 'neuralforecast', 'ruptures', 'opencv-python-headless', 'quantlib-python', 'azure-keyvault-secrets', 'python-igraph', 'sentence-transformers', 'optuna', 'pulp', 'great-expectations', 'cvxpy', 'cvxpy-base', 'pypdfium2', 'atpublic', 'langsmith', 'tiktoken', 'pydicom', 'dbt-core', 'dbt-postgres', 'dynaconf', 'omegaconf', 'azure-mgmt-core', 'azure-storage-file-share', 'azure-storage-file-datalake', 'msal_extensions', 'azure-identity', 'pyxlsb', 'utilsforecast', 'funcy', 'langdetect', 'pyreadstat', 'structlog', 'probableparsing', 'requests-mock', 'sparse', 'janus', 'azure-mgmt-storage', 'kneed', 's3path', 'pydantic-settings', 'time-machine', 'hierarchicalforecast', 'opentelemetry-exporter-otlp-proto-common', 'polars', 'python-docx', 'snowflake.core', 'langchain-text-splitters', 'langchain-community', 'tsdownsample', 'momepy', 'rouge-score', 'matplotlib-venn', 'environs', 'torchaudio', 'jiwer', 'st-theme', 'jsonpath-python', 'filetype', 'docstring_parser', 'grpc-google-iam-v1', 'hydra-core', 'tensorflow-text', 'diff-cover', 'sqlfluff', 'backports.tarfile', 'databricks-sdk', 'jaraco.context', 'opentelemetry-distro', 'pyfakefs', 'jaraco.test', 'asynch', 'python-zstd', 'asyncssh', 'pypyodbc', 'jiter', 'rich-click', 'msgspec', 'immutabledict', 'msgspec-toml', 'msgspec-yaml', 'polyfactory', 'uuid6', 'iterative-telemetry', 'bottle', 'kt-legacy', 'litestar', 'litestar-with-annotated-types', 'litestar-with-attrs', 'litestar-with-cryptography', 'litestar-with-jinja', 'litestar-with-jwt', 'litestar-with-full', 'litestar-with-prometheus', 'litestar-with-structlog', 'litestar-with-brotli', 'conda-recipe-manager', 'openapi-pydantic', 'propcache', 'nbconvert-core', 'pytest-codspeed', 'sybil', 'pdf2image', 'geojson', 'unittest-xml-reporting', 'opentelemetry-instrumentation-system-metrics', 'splunk-opentelemetry', 'numba-cuda', 'fpdf2', 'ray-air', 'ray-client', 'ray-observability', 'ray-serve', 'ray-serve-grpc', 'pdfminer.six', 'httpx-sse', 'dbt-common', 'langchain-google-genai', 'pikepdf', 'dbt-adapters', 'rioxarray', 'pytest-socket', 'daff', 'pyfiglet', 'types-python-dateutil', 'gcsfs', 'pdfplumber', 'elastic-transport', 'uuid-utils', 'eval-type-backport', 'sklearn-compat', 'accessible-pygments', 'sphinx-theme-builder', 'pyside6', 'ewah-bool-utils', 'aext-assistant', 'aext-assistant-server', 'aext-core', 'aext-core-server', 'aext-panels', 'aext-panels-server', 'aext-share-notebook', 'aext-project-filebrowser-server', 'aext-share-notebook-server', 'aext-shared', 'anaconda-ident', 'anaconda-mirror', 'anaconda-enterprise-cli', 'anaconda-toolbox', 'conda-anaconda-telemetry', 'conda-anaconda-tos', 'pydata-sphinx-theme', 'playwright-python', 'streamlit-tests', 'pyqt6-sip', 'trubar', 'pytest-xprocess', 'pytest-split', 'pyogrio', 'tf-keras', 'nbconvert-pandoc', 'nbconvert-all', 'simpleeval', 'posthog', 'pandera-base', 'anaconda-auth', 'awscrt', 'awscli', 'donfig', 'triton', 'vtk-io-ffmpeg', 'vtk-base', 'narwhals', 'fredapi', 'hvsampledata', 'psygnal', 'anywidget', 'durationpy', 'jpype1-test-openjdk-11', 'jpype1-test-openjdk-21', 'nanobind', 'evalidate', 'puremagic', 'roman-numerals-py', 'streamlit-avatar', 'sqlite-anyio', 'python-duckdb', 'ipython_pygments_lexers', 'pycrdt', 'anaconda-assistant-sdk', 'pycrdt-websocket', 'limits', 'flask-limiter', 'sse-starlette', 'mcp', 'instructor', 'snowplow-tracker', 'anthropic', 'databricks-sql-connector', 'magika', 'typing-inspection', 'markdownify', 'markitdown', 'webargs', 'allure-python-commons-test', 'aext-environments-server', 'forbiddenfruit', 'backports-datetime-fromisoformat', 'proxyspy', 'griffe', 'logging_tree', 'langchain-openai', 'mistralai', 'pydantic-extra-types', 'handy-archives', 'domdf-python-tools', 'mistletoe', 'deprecation-alias', 'apeye-core', 'dist-meta', 'dom-toml', 'pytest-regressions', 'anaconda-ai', 'consolekit', 'shippinglabel', 'pyproject-parser', 'coincidence', 'whey', 'panel-graphic-walker', 'intake-sql', 'pysimdjson', 'httpstan', 'ormsgpack', 'langgraph-sdk', 'langgraph-checkpoint', 'psycopg', 'psycopg-c', 'langgraph', 'langgraph-prebuilt', 'conda-tree', 'simple-websocket', 'keras-tuner', 'unidist-all', 'unidist-dask', 'unidist-mpi', 'unidist-ray', 'unidist', 'modin-mpi', 'changelog-chug', 'parserator', 'diskcache', 'starlette-context', 'etils', 'simple-parsing', 'grpc-interceptor', 'sqlmodel', 'authzed', 'aiokafka', 'kopf', 'authzed-py', 'conda-self', 'better-optimize', 'pymc-extras', 'snowpark-connect', 'pycountry', 'snakesay', 'cwcwidth', 'mistral-common', 'gguf', 'pythonanywhere-core', 'mamba_gator', 'libboost-python', 'libboost-python-devel', 'anaconda-opentelemetry', 'hf-xet', 'spopt', 'sspilib', 'geomet', 'rdflib-with-all', 'rdflib-with-lxml', 'rdflib-with-networkx', 'rdflib-with-orjson', 'rdflib', 'pyccolo', 'winloop', 'pytest-docker-tools', 'pyscaffold', 'aext-notebook-load-server', 'ansicolors', 'levenshtein', 'assertpy', 'papermill', 'deprecat', 'versioningit', 'biom-format', 'array-api-compat', 'dbt-protos', 'sqlparams', 'dbt-databricks', 'dbt-spark', 'marisa-trie', 'pytest-celery', 'language-data', 'clarabel', 'geoparse', 'periodictable', 'parmed', 'cupy-core', 'orderly-set', 'treescope', 'jupysql-plugin', 'ploomber-core', 'jupysql', 'opentelemetry-semantic-conventions-ai', 'gherkin-official', 'sseclient-py', 'cuid', 'sphinx-book-theme', 'opentelemetry-instrumentation-anthropic', 'dirty-equals', 'opentelemetry-instrumentation-bedrock', 'opentelemetry-instrumentation-alephalpha', 'opentelemetry-instrumentation-chromadb', 'opentelemetry-instrumentation-cohere', 'opentelemetry-instrumentation-crewai', 'opentelemetry-instrumentation-google-generativeai', 'opentelemetry-instrumentation-groq', 'opentelemetry-instrumentation-haystack', 'opentelemetry-instrumentation-lancedb', 'opentelemetry-instrumentation-langchain', 'opentelemetry-instrumentation-llamaindex', 'opentelemetry-instrumentation-marqo', 'opentelemetry-instrumentation-qdrant', 'opentelemetry-instrumentation-sagemaker', 'opentelemetry-instrumentation-sqlalchemy', 'opentelemetry-instrumentation-threading', 'opentelemetry-instrumentation-openai', 'opentelemetry-instrumentation-pinecone', 'opentelemetry-instrumentation-together', 'opentelemetry-instrumentation-vertexai', 'opentelemetry-instrumentation-watsonx', 'opentelemetry-instrumentation-weaviate', 'opentelemetry-instrumentation-writer', 'opentelemetry-instrumentation-replicate', 'opentelemetry-util-http', 'opentelemetry-instrumentation-ollama', 'opentelemetry-instrumentation-openai-agents', 'opentelemetry-instrumentation-logging', 'opentelemetry-instrumentation-milvus', 'opentelemetry-instrumentation-redis', 'opentelemetry-instrumentation-mistralai', 'opentelemetry-instrumentation-transformers', 'opentelemetry-instrumentation-requests', 'asyncer', 'chevron', 'opentelemetry-instrumentation-urllib3', 'syncer', 'gw-dsl-parser', 'id', 'segment-analytics-python', 'opentelemetry-instrumentation-mcp', 'traceloop-sdk', 'audioop-lts', 'chainlit', 'python-quickjs', 'kanaries-track', 'ipylab', 'pygwalker', 'jupyter-rfb', 'mpire', 'semchunk', 'lumen-ai', 'lumen-ai-local', 'lumen-ai-anthropic', 'lumen-ai-mistralai', 'lumen-ai-openai', 'casa_formats_io', 'pyportfolioopt', 'radio-beam', 'spectral-cube', 'pvextractor', 'google-genai', 'glue-qt', 'lsprotocol', 'python-lsp-ruff', 'loro', 'uv-build', 'asv_runner', 'marimo', 'giturlparse', 'rich-argparse', 'litellm', 'pathvalidate', 'requirements-parser', 'pyclibrary', 'pytokens', 'xmod', 'runs', 'editor', 'snowpark-connect-deps-2', 'snowpark-connect-deps-1', 'polars-runtime-64', 'polars-runtime-compat', 'polars-runtime-32', 'zope.proxy', 'zope.deferredimport', 'dlt', 'manuel', 'cucumber-expressions', 'cucumber-tag-expressions', 'pathlib-abc', 'tika-client', 'packageurl-python', 'cuda-bindings', 'cuda-python', 'cuda-core', 'ultralytics-thop', 'qdrant-client', 'nh3', 'fastuuid', 'json-repair', 'madoka', 'magicattr', 'gepa', 'pondpond', 'nvtx', 'sphinx-last-updated-by-git', 'annotated-doc', 'inline-snapshot', 'click-loglevel', 'safehttpx', 'ffmpy', 'groovy-python', 'gradio-client', 'pydub', 'gradio', 'langchain-anthropic', 'dspy', 'panel-material-ui', 'backports.zstd', 'panel-splitjs', 'installer-attribution-bootstrap', 'pyyaml-ft', 'abi3info', 'kaitaistruct', 'pyelftools', 'abi3audit', 'py-rattler', 'roman-numerals', 'typer-cli', 'typer-slim', 'typer-slim-standard', 'google-re2', 'cel-python', 'conda-rattler-solver', 'autokeras', 'protovalidate-python', 'interegular', 'compressed-tensors', 'prometheus-fastapi-instrumentator', 'pycrdt-store', 'airportsdata', 'lm-format-enforcer', 'uv-dynamic-versioning', 'google-cloud-storage-control', 'altex', 'rich-toolkit', 'mupdf', 'pytest-pretty', 'fastapi-cli', 'minify-html', 'fastapi-all', 'fastapi-core', 'pymupdf', 'conda-pypi', 'einops', 'llama-cpp-python', 'seccomp', 'tensorstore', 'apsw', 'langchain-classic', 'apswutils', 'fastlite', 'python-fasthtml', 'pot', 'g-ir-build-tools', 'orbax-checkpoint', 'flax', 'rich-rst', 'cyclopts', 'diagnostic', 'beartype', 'fakeredis', 'banks', 'dirtyjson', 'llama-index-instrumentation', 'llama-cloud', 'striprtf', 'textual', 'tinytag', 'llama-index-workflows', 'memray', 'llama-index-core', 'claude-agent-sdk', 'llama-index-embeddings-openai', 'llama-index-llms-openai', 'depyf', 'pybase64', 'llama-index-indices-managed-llama-cloud', 'outlines-core', 'llama-cloud-services', 'llama-index-readers-file', 'ray-adag', 'streamlit-notify', 'llama-parse', 'vl-convert-python', 'llama-index-readers-llama-parse', 'auditwheel', 'llama-index-cli', 'av', 'ctranslate2', 'blake3', 'highspy', 'partial-json-parser', 'python-librt', 'stanio', 'py-key-value-aio', 'py-key-value-shared', 'outlines', 'peft', 'taskgroup', 'haystack-ai', 'lazy-imports', 'haystack-experimental', 'anaconda-connector-core', 'anaconda-connector-utilities', 'anaconda-connector-conda', 'pyperclip', 'huey', 'skops', 'filecheck', 'pylerc', 'flash-attn', 'flash-attn-fused-dense', 'flash-attn-layer-norm', 'lupa', 'mcp-compose', 'geodatasets', 'gwlearn', 'uncalled-for', 'jsonref', 'nvshmem4py', 'fastmcp', 'environments-mcp-server', 'jwcrypto', 'litestar-htmx', 'anaconda-mcp', 'onnx-ir', 'mpl-probscale', 'delvewheel', 'scikit-base', 'scikit-base-all-extras', 'fast-depends', 'delocate', 'pyautogen', 'rst2pdf', 'ultralytics', 'llguidance', 'lance-namespace', 'lance-namespace-urllib3-client', 'vcs-versioning', 'conda-anaconda-trust-root', 'pylance', 'cronsim', 'lancedb', 'faster-whisper', 'pyre-extensions', 'onnxscript', 'pydocket', 'splink', 'xformers', 'captcha', 'escapism', 'jupyterhub-idle-culler', 'nbgitpuller', 'kubernetes_asyncio', 'num2words', 'fire', 'jupyterhub-kubespawner', 'jupyterhub-traefik-proxy', 'pygeostat', 'py-libnuma', 'xgrammar', 'azure-ai-agents', 'azure-appconfiguration', 'azure-ai-projects', 'azure-batch', 'applicationinsights', 'vllm', 'azure-data-tables', 'azure-datalake-store', 'azure-keyvault-administration', 'azure-keyvault-certificates', 'azure-keyvault-keys', 'azure-keyvault-securitydomain', 'azure-mgmt-advisor', 'azure-mgmt-apimanagement', 'knack', 'microsoft-security-utilities-secret-masker', 'py-deviceid', 'azure-cli-telemetry', 'azure-cli-core', 'azure-mgmt-appconfiguration', 'azure-mgmt-appcontainers', 'azure-mgmt-applicationinsights', 'azure-mgmt-authorization', 'azure-mgmt-batch', 'azure-mgmt-batchai', 'azure-mgmt-botservice', 'azure-mgmt-cdn', 'azure-mgmt-cognitiveservices', 'azure-mgmt-compute', 'azure-mgmt-containerinstance', 'azure-mgmt-containerregistry', 'azure-mgmt-containerregistrytasks', 'azure-mgmt-containerservice', 'azure-mgmt-cosmosdb', 'azure-mgmt-datalake-store', 'azure-mgmt-datamigration', 'azure-mgmt-eventgrid', 'azure-mgmt-eventhub', 'azure-mgmt-extendedlocation', 'azure-mgmt-hdinsight', 'azure-mgmt-imagebuilder', 'azure-mgmt-iotcentral', 'azure-mgmt-iothub', 'azure-mgmt-iothubprovisioningservices', 'azure-mgmt-keyvault', 'azure-mgmt-loganalytics', 'azure-mgmt-sql', 'azure-mgmt-sqlvirtualmachine', 'azure-mgmt-synapse', 'azure-mgmt-trafficmanager', 'azure-mgmt-web', 'azure-mgmt-managementgroups', 'azure-mgmt-maps', 'azure-mgmt-marketplaceordering', 'azure-mgmt-media', 'azure-mgmt-monitor', 'azure-mgmt-msi', 'azure-mgmt-mysqlflexibleservers', 'azure-mgmt-netapp', 'azure-mgmt-policyinsights', 'azure-mgmt-postgresqlflexibleservers', 'azure-mgmt-privatedns', 'azure-mgmt-rdbms', 'azure-mgmt-recoveryservices', 'azure-mgmt-recoveryservicesbackup', 'azure-mgmt-redhatopenshift', 'azure-monitor-query', 'azure-storage-common', 'azure-synapse-accesscontrol', 'azure-synapse-artifacts', 'azure-synapse-managedprivateendpoints', 'azure-synapse-spark', 'javaproperties', 'pycomposefile', 'azure-mgmt-resource', 'azure-mgmt-resource-deployments', 'azure-mgmt-resource-deploymentscripts', 'azure-mgmt-resource-deploymentstacks', 'azure-mgmt-resource-templatespecs', 'azure-mgmt-search', 'azure-mgmt-security', 'azure-mgmt-servicebus', 'azure-mgmt-servicefabric', 'azure-mgmt-servicefabricmanagedclusters', 'azure-mgmt-servicelinker', 'azure-mgmt-signalr', 'azure-storage-queue', 'helion', 'hjson-py', 'azure-mgmt-billing', 'azure-mgmt-redis', 'azure-cli', 'genai-prices', 'logfire-api', 'opentelemetry-instrumentation-asgi', 'pypika', 'chroma-hnswlib', 'fasta2a', 'groq', 'opentelemetry-instrumentation-fastapi', 'py-rust-stemmers', 'griffecli', 'griffelib', 'metaflow-checkpoint', 'metaflow-torchrun', 'ob-metaflow', 'ob-metaflow-extensions', 'ob-metaflow-stubs', 'ob-project-utils', 'chromadb', 'deepeval', 'deepspeed', 'fastembed', 'conda-lockfiles', 'conda-spawn', 'logistro', 'choreographer', 'jupyterlab-eventlistener', 'jupyter-ai-tools', 'jupyter-collaboration-ui', 'jupyter-docprovider', 'jupyterlab-notebook-awareness', 'jupyter-collaboration', 'jupyterlab-commands-toolkit', 'jupyter_server_documents', 'jupyterlab-chat', 'sphinxcontrib-typer', 'jupyter-ai-router', 'jupyter-ai-persona-manager', 'accelerate', 'agent-client-protocol', 'parsy', 'langchain-protocol', 'jupyter-ai-chat-commands', 'treelite', 'nccl4py', 'hf-gradio', 'model-hosting-container-standards', 'jupyter-ai-acp-client', 'opentelemetry-instrumentation-agno', 'opentelemetry-instrumentation-voyageai', 'pyglfw', 'arviz-base', 'caio', 'aiofile', 'arviz-stats', 'arviz-stats-core', 'pytensor-distributions', 'preliz', 'mac_alias', 'ds_store', 'shtab', 'trl', 'tyro', 'arviz-plots', 'jupyter-server-mcp', 'dmgbuild', 'briefcase', 'jupyter-ai', 'keras-hub', 'aext-data-catalog-server', 'aext-events-server', 'aext-lms-notebooks-server', 'aext-notebook-info-server', 'aext-resource-manager-server', 'simplejpeg', 'torchao', 'fastmcp-slim', 'z3-solver', 'z3prover', 'pybreaker', 'ast_canopy', 'numbast', 'pyld', 'python-discovery', 'addict', 'pytrec-eval-terrier', 'fastar', 'adlfs', 'axolotl-contribs-lgpl', 'axolotl-contribs-mit', 'blobfile', 'cbor2', 'fla-core', 'hf-transfer', 'modelscope', 'ollama-python', 'schedulefree', 'warp-lang', 'openai-harmony', 'art', 'openenv-core', 'standard-chunk', 'standard-sunau', 'cut_cross_entropy', 'fastsafetensors', 'liger-kernel', 'mteb', 'soxr-python', 'mlx', 'runtimed', 'pyspark-client', 'standard-aifc', 'audioread', 'flash-linear-attention', 'trackio', 'unsloth_zoo', 'librosa', 'mlx-lm', 'types-certifi', 'word2number', 'jaxtyping', 'wadler-lindig', 'orbax-export', 'sqlitedict', 'apache-tvm-ffi', 'kernels-data', 'synchronicity', 'grpclib', 'mbstrdecoder', 'tcolorpy', 'circuitbreaker', 'anaconda-channel-guide', 'httpcore2', 'typepy', 'httpx2', 'pgvector-python', 'logfire', 'openrouteservice', 'scikit-network', 'looseversion', 'simple-azure-blob-downloader', 'dataproperty', 'modal-client', 'tabledata', 'lumen-ai-bedrock', 'lumen-ai-llama', 'lumen-ai-transformers', 'oci', 'arabic_reshaper', 'coreforecast', 'janitor-rs', 'pandas-flavor', 'qpsolvers', 'datasetsforecast', 'pyjanitor', 'pytablewriter', 'llamafactory', 'ocifs', 'anaconda-env-log', 'google-cloud-secret-manager', 'nexus-rpc', 'panel-core', 'temporalio', 'jupyterlab-git-core', 'lm_eval', 'unsloth', 'torchtune', 'pytest-repeat', 'questionary', 'kagglesdk', 'nest-asyncio2', 'lazy', 'nzpy', 'ast-serialize', 'camelot-py', 'mcp-types', 'nzpyida', 'playa-pdf', 'sqlanydb', 'torchcodec', 'jupyter-builder', 'win-precise-time', 'cachebox', 'gviz-api', 'xprof', 'cvss', 'capstone', 'ml-datasets', 'pypdf-with-fonts', 'pypdf-with-rtl-text', 'pytest-skip-slow', 'human-eval', 'gdstk', 'axolotl', 'torch-c-dlpack-ext', 'pygobject', 'numba-cuda-mlir', 'opentelemetry-instrumentation-litellm', 'sphinxcontrib-mermaid', 'tilelang', 'presidio-analyzer', 'py-cpuinfo2', 'dbt-core-experimental-parser', 'gribberish', 'metricflow', 'protobuf-py-ext', 'ultralytics-platform', 'protobuf-py', 'python-eccodes', 'ag2', 'cython-cmake', 'opendal', 'icechunk', 'pipcl', 'enkryptai-sdk', 'crcmod', 'rapidocr', 'opentelemetry-instrumentation-tornado', 'pywr', 'opentelemetry-instrumentation-httpx', 'meteostat', 'requests-negotiate-sspi', 'spml', 'openai-whisper', 'wslink', 'pyglet', 'torch-geometric', 'pandapower', 'bracex', 'wcmatch', 'dependency-groups', 'conda-pycosat-solver', 'oss-harmony', 'xbuild']; update: ['aiopg', 'bpython', 'branca', 'cfn-lint', 'click-default-group', 'cornac', 'coveralls', 'cryptography', 'datrie', 'dmglib', 'execnet', 'fugue', 'geoviews', 'jaxlib', 'leather', 'mlflow-skinny', 'pandas', 'py-xgboost', 'py-xgboost-cpu', 'pyaudio', 'pydantic', 'pylint-venv', 'pytorch', 'ruamel.yaml', 'ruamel.yaml.clib', 'scrapy', 'tqdm', 'trove-classifiers', 'xgboost', 'aioitertools', 'curio', 'langcodes', 'minio', 'outcome', 'langchain', 'ortools-python', 'faiss', 'evidently', 'llama-index', 'dbt-semantic-interfaces', 'langchain-core', 'python-stdnum', 'pytest-datadir', 'pyproject-examples', 'lumen', 'llama.cpp-tools', 'cuda-pathfinder', 'nvcomp', 'bitsandbytes', 'py-rattler-build', 'cutile-python', 'metaflow', 'outerbounds', 'pydantic-graph', 'pydantic-ai', 'pydantic-ai-slim', 'cccl-python', 'nvmath-python-core', 'python-cudnn-frontend', 'cuquantum-python', 'pydantic-evals'].
Evidence

(truncated — see full report)

Could not determine

  • about-dev-doc-url — Cannot establish complete rendered coverage: about.dev_url and doc_url look present and unique.
  • about-summary-upstream — Cannot establish complete rendered coverage: about.summary looks present and non-placeholder.
  • binary-repack — Cannot establish complete rendered coverage: No explicit prebuilt binary, wheel-install, or binary-repack indicators detected for 'python'.
  • cbc-dep-pinning — Cannot establish complete rendered coverage: Package 'libpython-static': no CBC-available dependencies found in host/run.
  • compiler-version-change — Cannot establish complete rendered coverage: No compiler/toolchain changes detected.
  • dep-version-quality — Cannot establish complete rendered coverage: No exact version pins found in run dependencies.
  • first-time-package — Cannot establish complete rendered coverage: Package 'libpython-static' has 108 prior version(s) on the main channel.
  • first-time-package — Cannot establish complete rendered coverage: Package 'python' has 148 prior version(s) on the main channel.
  • host-run-section-placement — Cannot establish complete rendered coverage: No known host/run/build section misplacements detected.
  • no-new-dependencies — Cannot establish complete rendered coverage: Package 'libpython-static' has no new host/run/run_constrained dependencies.
  • no-new-dependencies — Cannot establish complete rendered coverage: Package 'python' has no new host/run/run_constrained dependencies.
  • not-cbc-pinned — Cannot establish complete rendered coverage: Package 'libpython-static' is not pinned in the aggregate conda_build_config.yaml.
  • osv-cves — Package identity or external query coverage incomplete; passing result withheld.
  • osv-cves — Package identity or external query coverage incomplete; passing result withheld.
  • pypi-yanked-version — Package identity or external query coverage incomplete; passing result withheld.
  • pypi-yanked-version — Package identity or external query coverage incomplete; passing result withheld.
  • test-section-present — Cannot establish complete rendered coverage: Recipe for 'python' declares a runnable test section.

Analysed channel: https://staging.continuum.io/pbp/fs/python-feedstock/pr279/170b742


Automated signals — not an approval. Verify flagged items before merging.
Generated by pkg-review-automation 2026.10.21090543 · trigger: cli · 2026-10-29 19:24 UTC · head 170b742fbbf4
Please submit feedback using this form.
Outerbounds run: https://ui.merced.obp.outerbounds.com/p/distro/PkgReviewFlow/argo-pbc.prod.pkgreviewflow-dc871a153f

@cbouss cbouss left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@SC426
SC426 merged commit 9d589b8 into main-3.10 Oct 29, 2026
14 of 15 checks passed
@SC426
SC426 deleted the update-python-3.10-cve-2026-115557 branch October 29, 2026 20:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants