Repository navigation
FailSafe 5.0.3 is a dependency patch for the browser demo. web/package-lock.json moves Vite from 7.3.6 to 7.3.7 (GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw, GHSA-9jrq-w75r-8gcw, GHSA-rq7h-c2jc-7f22) and source-map-js from 1.2.1 to 1.2.2 (GHSA-68fv-2mgg-jv7q), the lowest releases that clear those advisories, and no other locked package moves. The advisories concern the Vite development server and source map parsing in the build toolchain, not the static files the built demo serves.
The gateway's Python dependencies are ranges in pyproject.toml with no lockfile. Resolved for Python 3.12 on 2026-10-25 they gave 32 pinned packages, and neither an OSV query nor pip-audit reported an advisory for any of them. Because nothing pins them, an image built now resolves certifi 2026.10.23, past GHSA-6q48-6c7w-9gw2, while an image built from an earlier release keeps whatever it resolved at the time. The gateway, its resilience policies and its observability defaults are unchanged apart from the version string. The release also contains 4b695fd, which replaced the dash in the heading of docs/releases/v5.0.2.md.
In CI run 40182390899 on the merge commit 7679cf9, all six jobs passed, covering lint, 121 tests and 56 subtests under pytest, 13 observability startup policy tests in the docker job, 4 Grafana runtime tests, 43 web self checks and the bundle, and the compose and Kubernetes chaos runs, each with 4 kills and 0 client-visible failures.