🔄 Merge development → main (64dfe73) - Review Required

[github-actions]

⚠️ Manual Review Required

This PR is ready to merge but requires manual review due to failed commits in the history.

Summary

• Commits to merge: 5
• Development HEAD: 64dfe73
• Failed commits detected: 64dfe73 84b20ed 4c6f821

Pre-filled Merge Commit Message

When you click "Merge pull request", GitHub will use this default message. Edit it to document what was fixed:

Merge development to main (64dfe73)

5 commits merged after manual review.
Some commits had CI failures but issues were resolved:  64dfe73 84b20ed 4c6f821

Changes:
- [Add your summary of key changes here]
- [Document what was fixed from failed commits]

Instructions

1. Click "Files changed" tab to review the diff
2. Resolve any conflicts if present (shouldn't be any usually)
3. Edit the merge commit message above when merging
4. Click "Merge pull request" when ready

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
omnipkg	Ready	Preview, Comment	Jun 7, 2026 7:30pm

[deepsource-io]

DeepSource Code Review

We reviewed changes in 8eb50cf...4e273a3 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Python		Jun 7, 2026 7:29p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	scipy@​1.12.0
	scipy@​1.13.0
	scipy@​1.15.0
	numpy@​2.2.6
	numpy@​2.3.5
	pandas@​2.2.1
	pandas@​2.2.3
	pandas@​2.3.3

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 11 package(s) with unknown licenses.

See the Details below.

License Issues

requirements.txt

Package	Version	License	Issue Type
aiohttp	3.14.0	Null	Unknown License
cyclonedx-python-lib	11.8.0	Null	Unknown License
filelock	3.29.1	Null	Unknown License
flask-cors	6.0.3	Null	Unknown License
idna	3.18	Null	Unknown License
joserfc	1.7.0	Null	Unknown License
platformdirs	4.10.0	Null	Unknown License
typer	0.26.7	Null	Unknown License
uv	0.11.19	Null	Unknown License
uv-ffi	0.10.8.post15	Null	Unknown License

setup.py

Package	Version	License	Issue Type
omnipkg	3.4.0	Null	Unknown License

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
pip/aiohappyeyeballs	2.6.2	Unknown	Unknown
pip/aiohttp	3.14.0	Unknown	Unknown
pip/attrs	26.1.0	Unknown	Unknown
pip/authlib	1.7.2	Unknown	Unknown
pip/certifi	2026.5.20	🟢 5.8	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Maintained 🟢 7 8 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 7 Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review ⚠️ 0 Found 0/2 approved changesets -- score normalized to 0 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/charset-normalizer	3.4.7	Unknown	Unknown
pip/click	8.4.1	Unknown	Unknown
pip/cryptography	48.0.0	Unknown	Unknown
pip/cyclonedx-python-lib	11.8.0	Unknown	Unknown
pip/filelock	3.29.1	Unknown	Unknown
pip/flask-cors	6.0.3	Unknown	Unknown
pip/idna	3.18	Unknown	Unknown
pip/joserfc	1.7.0	Unknown	Unknown
pip/markdown-it-py	4.2.0	Unknown	Unknown
pip/packaging	26.2	Unknown	Unknown
pip/platformdirs	4.10.0	Unknown	Unknown
pip/propcache	0.5.2	Unknown	Unknown
pip/requests	2.34.2	Unknown	Unknown
pip/rich	15.0.0	Unknown	Unknown
pip/tomli	2.4.1	Unknown	Unknown
pip/typer	0.26.7	Unknown	Unknown
pip/urllib3	2.7.0	Unknown	Unknown
pip/uv	0.11.19	Unknown	Unknown
pip/uv-ffi	0.10.8.post15	🟢 4.5	Details Check Score Reason CI-Tests ⚠️ -1 no pull request found Dependency-Update-Tool 🟢 10 update tool detected Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 10 security policy file detected Dangerous-Workflow ⚠️ 0 dangerous workflow patterns detected CII-Best-Practices ⚠️ 2 badge detected: InProgress SAST 🟢 10 SAST tool detected: CodeQL Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions License 🟢 9 license file detected Vulnerabilities ⚠️ 0 20 existing vulnerabilities detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches Packaging 🟢 10 packaging workflow detected Contributors 🟢 6 project has 2 contributing companies or organizations -- score normalized to 6
pip/werkzeug	3.1.8	Unknown	Unknown
pip/yarl	1.24.2	🟢 6.4	Details Check Score Reason Code-Review ⚠️ 2 Found 4/20 approved changesets -- score normalized to 2 Maintained 🟢 10 30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases 🟢 4 3 out of the last 5 releases have a total of 3 signed artifacts.
pip/omnipkg	3.4.0	Unknown	Unknown

Scanned Files

• requirements.txt
• setup.py