[wu-sheng]

Bumps locked dependencies to close open Dependabot alerts.

Dependencies (poetry.lock only)

Targeted lock update with Poetry 2.3.3 (the version in the lock header). pyproject.toml is unchanged and the lock content-hash is unchanged.

Package	Group	Old -> New	Advisories
certifi	runtime (transitive, requests extra), dev, plugins	2026.2.25 -> 2026.10.23	GHSA-6q48-6c7w-9gw2
pylint	lint	4.0.5 -> 4.0.10	CVE-2026-114608 / GHSA-22qq-2fwx-7p67
tornado	plugins	6.5.10 -> 6.6 on Python >= 3.11 (Python 3.10 keeps 6.5.10)	CVE-2026-116577 / GHSA-pcg2-g6cj-q92c, CVE-2026-116578 / GHSA-pw9p-v7r6-gx4p, CVE-2026-115927 / GHSA-r4j5-9xpp-3985
dnspython	plugins (transitive, pymongo)	2.8.0 -> 2.9.1 on Python >= 3.11 (Python 3.10 keeps 2.8.0)	CVE-2026-114605 / GHSA-45c3-73f7-pv4m

• certifi 2026.10.23 is the latest CA bundle release.
• pylint 4.0.10 is the latest 4.0.x patch. astroid stays at 4.0.4.
• tornado 6.6 and dnspython 2.9.x require Python >= 3.11, and no fixed release supports Python 3.10. Poetry therefore locks one entry per Python range with markers, the same way it already locks django. The Python 3.10 entries (tornado 6.5.10, dnspython 2.8.0) are still affected, so the tornado and dnspython alerts are expected to stay open until Python 3.10 is dropped from python = ">=3.10, <3.15". This PR does not change the supported Python range. Dependabot's own security updates for tornado and dnspython on master today ended with security_update_not_possible.

Supersedes #431 (certifi 2026.10.18) and #434 (pylint 4.0.9).

Not superseded: #432 (setuptools 81.0.0 -> 84.1.0, alerts CVE-2026-59890 / GHSA-h35f-9h28-mq5c fixed in 83.0.0 and GHSA-xmj3-9gf7-h52w fixed in 84.1.0). setuptools is deliberately left at 81.0.0, as in #433. pyramid 2.1, still the latest release, declares setuptools<82 and imports pkg_resources at module level, and setuptools >= 82 no longer ships pkg_resources. #432 reaches setuptools 84.1.0 only by downgrading pyramid to 2.0.2, which then fails with ModuleNotFoundError: No module named 'pkg_resources'. Fixing this needs a pyramid release without pkg_resources, or dropping pyramid from the dev-only plugins group.

GitHub Actions

No changes. Every uses: in .github/workflows/** was checked against the ASF allowlist:

• actions/checkout@v7, actions/setup-python@v7, actions/upload-artifact@v7, actions/download-artifact@v8 and apache/skywalking-eyes/header a196742 # v0.9.0 are on their latest major.
• docker/login-action 81c6f93 # v4.7.0, docker/setup-qemu-action 9901266 # v4.4.0, docker/setup-buildx-action f87e599 # v4.4.1, dorny/paths-filter ceb8a2b # v4.0.3 and tcort/github-action-markdown-link-check e047c5b # v1.1.3 are pinned to the current approved SHAs, none of which has an expiry.

infra-e2e

Already pinned to apache/skywalking-infra-e2e@56ac8befeb5f910f2dc9339e65d07cd18953f90e since #433. No change. CI, including E2E, passed on master for the #433 merge and the 2026-10-31 and 2026-11-01 scheduled runs.

License

No change. This repo has no generated dist LICENSE, and .licenserc.yaml has no dependency: section, so license-eye dependency resolve resolves no dependencies.

Verified locally

• poetry check --lock (Poetry 2.3.3): passed.
• poetry install --all-extras --with lint on Python 3.10, 3.11 and 3.14: passed.
• flake8 .: passed on Python 3.10 and 3.11 (CI lints on 3.11). On 3.14 the locked flake8 5.x crashes in pyflakes (module 'ast' has no attribute 'Str'); flake8 is not changed by this PR.
• pylint 4.0.10, pylint --disable=all --enable=E0602,E0603,E1101 --ignore=protocol skywalking tests: 10.00/10 on Python 3.10, 3.11 and 3.14. Without --ignore=protocol it reports 186 E1101 on the locally generated skywalking/protocol/*_pb2_grpc.py; pylint 4.0.5 reports the same 186.
• pytest tests/unit on Python 3.10 and 3.14: 135 passed, 1 failed. The failure is test_meter.py::TestMeter::test_counter_timer_decarator, a sleep-timing tolerance on macOS, the same failure seen on Bump dependencies to fix security alerts #433.
• Plugins group, with pymongo 4.18.3: on Python 3.10 (tornado 6.5.10, dnspython 2.8.0) and on 3.11 and 3.14 (tornado 6.6, dnspython 2.9.1), pip check reports nothing broken, and a tornado test server with sw_tornado.install() applied answers a request with 200.
• license-eye header check: passed (0 invalid).

Not verified locally: Docker-based plugin tests and E2E. CI on this PR covers them. Plugin tests install the versions in each plugin's support_matrix, not the locked ones.