build(deps): bump types-pyyaml from 6.0.12.20260724 to 6.0.12.20260815

[dependabot]

Bumps types-pyyaml from 6.0.12.20260724 to 6.0.12.20260815.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Dev-only typing stub bump with no runtime or security impact on config/keyring YAML usage.

Overview
Bumps the optional dev dependency types-pyyaml from 6.0.12.20260724 to 6.0.12.20260815 in pyproject.toml and refreshes poetry.lock (package entry and lock content-hash).

This only updates PyYAML typing stubs from typeshed for mypy when installing the dev extras; it does not change the runtime pyyaml dependency or application behavior.

^{Reviewed by Cursor Bugbot for commit b9b493f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​types-pyyaml@​6.0.12.20260724 ⏵ 6.0.12.20260815

View full report

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review this types-pyyaml bump for supply-chain risk: lockfile/manifest changes, upstream stubs, and whether the scanner's missing-tag and maintainer-drift warnings are real or expected for typeshed packages.PyPI hashes match the lockfile and both releases are owned by typeshed_bot. Next I’ll diff the typeshed stubs between those commits so the scanner’s missing-tag warnings can be treated as expected for this package.Verdict: benign

This is a routine typeshed stub bump (types-pyyaml 6.0.12.20260724 → 6.0.12.20260815), optional dev extra only. No runtime payload, no new transitive deps (requires_dist is empty), and no workflow/install-script surface.

Integrity

• Poetry lock hashes match PyPI: wheel sha256:6f332212…5386d3b, sdist sha256:28764110…819858.
• Both releases are published by PyPI owner typeshed_bot, not yanked, generated from typeshed commits 97e83f65… → 6fba3ae73….
• Changelog: [PyYAML] Use _YAMLObject / Incomplete instead of Any (Add option on unsubscribe to retain DAT files  #16197). Stub .pyi files only.

Scanner vs this review
The malware scan is warn, 0 upstream files resolved (resolution_strategy: unresolved). The two heuristics are expected false positives, not compromise:

• ghost_version_or_missing_tag — typeshed does not git-tag stub package versions like 6.0.12.20260815; the version exists on PyPI.
• maintainer_drift (npm-maintainers) — npm-style heuristic; PyPI owner is unchanged (typeshed_bot).

No obfuscation, network/FS/process primitives, Unicode/IOC hits, or new dependencies. Safe to merge from a supply-chain standpoint.

Compatibility Analysis

I'll inspect how types-pyyaml is used here, what changed upstream, and whether that affects compatibility.Recommendation: merge

types-pyyaml is a dev-only typing stub (optional = true, extra == "dev"). It does not ship at runtime. Runtime YAML is still PyYAML 6.0.3. This bump is a typeshed weekly stub refresh (6.0.12.20260724 → 6.0.12.20260815).

1) Where it is used

Declared in pyproject.toml / poetry.lock as a mypy helper. Real import yaml sites (runtime PyYAML) include:

Area	Typical APIs
chia/util/config.py, file_keyring.py	yaml.safe_load / safe_dump
chia/cmds/init_funcs.py, configure.py, dump_keyring.py, dev/gh.py	safe_load / safe_dump / dump
chia/pools/pool_config.py	safe_load, yaml.dump
chia/data_layer/s3_plugin_service.py, data_layer/util/plugin.py	safe_load / safe_dump
chia/util/virtual_project_analysis.py	safe_load
Tests (chia/_tests/core/util/test_config.py, chia/_tests/tools/test_virtual_project.py)	safe_load / safe_dump / dump

No yaml.add_constructor / custom loaders / C-extension APIs.

2) Intersection with upstream stub changes

In .upstream-dependency (python/typeshed), PyYAML stubs in this window:

• 2026-08-14 #16197 — replace Any with _YAMLObject / Incomplete on safe_load/dump/safe_dump and internals. _YAMLObject is TypeAlias = Any in yaml/emitter.pyi, so type-check behavior is unchanged.
• 2026-07-23 #16079 — NoReturn → Never on emitter/representer (almost certainly already in 20260724).

No signature removals, no new required args, no PyYAML 7 API. Repo usage of safe_load/safe_dump/dump does not hit a breaking stub surface.

3) Risks / unknowns

• Runtime/build: none. Stub package only; Python >=3.10 matches requires-python.
• mypy: theoretically stricter internals (Incomplete vs Any) on unused constructor/scanner APIs. Unlikely given current call sites. Residual risk is a CI mypy flake, not production.
• Dependabot had no release-notes section; typeshed does not tag per-stub versions (scanner “ghost tag” is expected noise).

4) Action

Merge. Confirm the existing mypy job on PR 21321 is green; no extra runtime tests are needed for this bump.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 0
• Resolution strategy: unresolved
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved refs: from=n/a to=n/a
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 2

Top findings

• types-pyyaml:0 ghost_version_or_missing_tag :: 6.0.12.20260815
• types-pyyaml:0 maintainer_drift :: 6.0.12.20260724->6.0.12.20260815

[coveralls-official]

Coverage Report for CI Build 32895616588

Warning

No base build found for commit bf2a246 on main.
Coverage changes can't be calculated without a base build.
If a base build is processing, this comment will update automatically when it completes.

Coverage: 90.206%

Details

• Patch coverage: No coverable lines changed in this PR.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

Requires a base build to compare against. How to fix this →

---

Coverage Stats

Relevant Lines:	126621
Covered Lines:	116783
Line Coverage:	92.23%
Relevant Branches:	24920
Covered Branches:	19916
Branch Coverage:	79.92%
Branches in Coverage %:	Yes
Coverage Strength:	1.84 hits per line

---

💛 - Coveralls

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.