[dependabot]

Updates the requirements on cmcp-runtime to permit the latest version.

Release notes

Sourced from cmcp-runtime's releases.

cmcp 0.7.1

Three security fixes, backported onto 0.7.0 so they ship without the breaking Agent Manifest binding change and the opaque provider removal waiting on main. Full detail in CHANGELOG.

• GHSA-frxc-7f57-6f4r: deny a Cedar Allow that comes with evaluation errors, instead of skipping the errored policy and allowing.
• GHSA-mrcx-xvv4-m7f8: bound the TPM AIA certificate fetch. Each hop resolves the host once, connects only to that checked address, and the hop and byte limits hold.
• GHSA-2p85-666x-xm7x: classify upstream drift against the drifted tool's own catalog entry.

SDK on PyPI as cmcp-runtime 0.7.1.

Changelog

Sourced from cmcp-runtime's changelog.

[0.7.1] - 2026-10-19

Security

• A Cedar Allow reached with evaluation errors was enforced as Allow (GHSA-frxc-7f57-6f4r). Cedar skips a policy whose condition errors, so a forbid reading a context attribute the current phase does not carry could not stop a matching permit. CedarBackend now denies any Allow that comes with evaluation errors, and the error reaches the tool_call or egress_denied audit row. So that a policy written for one phase does not deny in the other, both phases now carry the same context keys: egress adds session_max_sensitivity (the label string), arguments, baa_covered, compliance_domain, server_identity, destination_class and attestation_platform, and ingress adds egress (false), sensitivity_level, injection_events, reset_count and response_size_bytes (0). Without this the shipped BFSi demo denied every response at egress. A policy that reads a key outside that set, or workflow_id when the caller declared none, now denies.
• The TPM AIA certificate fetch was unbounded (GHSA-mrcx-xvv4-m7f8). The chain walk followed redirects to any address and read responses without a limit. It now refuses destinations that do not resolve to global addresses, checks every redirect the same way, follows at most three and ignores responses over 64 KiB. Each hop's host is resolved once and the connection goes to the checked address (the request still names the host, and HTTPS still verifies the certificate against it), so a second DNS answer cannot point the fetch somewhere else. The fetch no longer uses environment proxies. An on-prem CA whose AIA host has a private address falls back to the vendored bundle.
• Upstream drift was classified against the wrong catalog entry (GHSA-2p85-666x-xm7x). The scanner received the server of whichever entry was last in the catalog. Detection and fail-closed denial were not affected; only the classification written to the audit row was.

[0.7.0] - 2026-09-30

Security

• TPM 2.0: verify_tpm_measurement listed a qualifying_data mismatch as unverified but still returned verified, so a genuine quote could be attached to a claim signed by any key. It also never compared the quote's pcrDigest with the claim's measurement, though docs/spec/tpm-security-model.md said it did. Both now fail the check.

Changed

• verify_trace_claim takes expected_launch_measurements, and cmcp verify takes a repeatable --launch-measurement. A hardware claim whose measurement is outside the set fails. With no set, a hardware claim is partially_verified with launch_measurement unverified: genuine hardware says what ran, not that it was approved, and a report from any guest image used to come out verified.

... (truncated)

Commits

• 4a7163a fix(security): cmcp-runtime 0.7.1 backport (Cedar errors, AIA fetch, drift cl...
• See full diff in compare view

[rajnisht7]

@dependabot rebase

[dependabot]

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[carloshvp]

Reviewed current head 471d0ad20ca8d9b86aa7ca77868a266fdea71f3f.

The human-facing dependency floor changes, but the generated CI lock still installs cmcp-runtime==0.7.0. demos/requirements/ci.in includes ../requirements.txt, and the demos workflow installs only the hash-required requirements/ci.txt; its green job therefore does not exercise the dependency change in this PR. Regenerate the CI lock from its input, retain universal platform markers, and rerun the demos plus pip check against the resulting compatible released environment. Do not treat the old locked run as validation of the new floor.

Prepared with OpenAI Codex.

[carloshvp]

[P2] Regenerate the demo CI lock with this floor. CI still installs cmcp-runtime==0.7.0 from demos/requirements/ci.txt, below this new requirement, because the workflow never installs this loose file. Update the generated lock and test that installed environment so users and CI exercise the same dependency contract.

[dinakarjs]

A DCO-signed author-adoption repair is ready: dinakarjs#8, commit d62cd9138a69f2b59a667a29c5e1603a856c8d87. It regenerates the affected lock with the documented universal compiler, preserving the intended dependency upgrades. Fresh hash-required Python 3.11 installation and dependency consistency pass, along with 47 demo tests and all ten demos. Exact environment, initial setup corrections and validation limits are recorded in the companion. Please adopt into this existing PR and rerun the full hosted matrix; independent review remains required. Prepared with Codex.