mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-08-14 00:38:42 +00:00
Dependabot security update #3620 bumped cryptography to 48.0.1 in uv.lock but left the harness manifest at >=43.0.0, since the dependency lives in the workspace member packages/harness, not backend/pyproject.toml. The drift caused 'uv lock' to keep rewriting the recorded specifier. Align the source constraint with the locked version.