Repository navigation
6.0.1 is a dependency patch for published advisories, with no change to conduit's code. uv.lock moves certifi from 2026.7.22 to 2026.10.19 (GHSA-6q48-6c7w-9gw2: the old bundle trusted emSign roots whose intermediate keys were compromised), urllib3 from 2.7.0 to 2.8.0 (GHSA-8988-9cw3-xx77, GHSA-vxq7-64xx-v4gw and GHSA-gh4c-6fx4-qh6g, on HTTPS proxy TLS settings and on chunked and deflate response streaming) and werkzeug from 3.1.8 to 3.1.9 (GHSA-g6x2-hccm-hh4m, Windows device names in safe_join), and web/package-lock.json moves Vite from 7.3.6 to 7.3.7 (GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw, GHSA-9jrq-w75r-8gcw and GHSA-rq7h-c2jc-7f22) and source-map-js from 1.2.1 to 1.2.2 (GHSA-68fv-2mgg-jv7q). certifi and urllib3 are in the worker image: certifi is the CA bundle the adapters' httpx clients verify connector targets against, since nothing sets SSL_CERT_FILE or SSL_CERT_DIR, and urllib3 carries botocore's SQS, DynamoDB and SSM calls. werkzeug comes in only with moto in the dev group, and Vite and source-map-js only build the browser demo. The lockfile change landed in #7.
The demo block in the README was measured again at the version bump, ef96b48, because demo/check_readme.py requires the block to carry the package version. make demo ran once, on a GitHub-hosted runner with 4 CPUs (run 40183244026), and its three must-equal checks are ok, as in 6.0.0. The latency figures depend on the machine: p95 458.9 ms from delivery attempt to acknowledgement and 14.70 s from submission to remote receipt, against 424.8 ms and 14.11 s in the 6.0.0 block. CI on the merge commit 90ee3d6 passed the web, python (lint, unit tests at the coverage floor, the README check and the LocalStack integration tests), terraform and image jobs.