Repository navigation
A follow-up to 5.1.1 for the one package its scan still reported; the package code is unchanged. In uv.lock filelock moves from 3.32.6 to 4.2.1, fixing GHSA-567q-5qvw-pf92 and GHSA-9vhv-jxww-xfm5 (low) and GHSA-v4x8-3wr5-3wq8 (high), the three advisories 5.1.1 held back because their only fix is a new major version. Nothing else moved: the uv.lock diff is the filelock entry and spoofline's own version, torch and torchaudio stay at 2.14.0 and 2.11.0, and web/package-lock.json is untouched.
torch 2.14.0 is the only locked package that requires filelock, with no version bound, and spoofline does not import it. The torch wheel check made for 5.1.1, a scan of the Python sources in the locked torch 2.14.0 macOS wheel, found only FileLock, BaseFileLock and Timeout imported from filelock. filelock's changelog puts the 4.0.0 break in the SoftReadWriteLock on-disk protocol, with validation and fixes from 4.0.1 to 4.2.1, and 4.2.1 needs Python 3.11 or later, which the 3.12 pin meets; SAY-5/rankfault already locks filelock 4.2.1 beside torch 2.14.0 with green CI. CI run 40183777390 (https://github.com/SAY-5/spoofline/actions/runs/40183777390) passed on the merge commit f0d51fd: uv sync --locked installed filelock 4.2.1 and torch 2.14.0+cpu from the PyTorch CPU index, 172 tests passed, the tiny profile pipeline ran end to end, and the web job's self-check matched PyTorch on 374 of 374 assertions before the production bundle.