chore(deps): Update weight-custody-manifest requirement from <0.25.0,>=0.23.0 to >=0.25.0,<0.26.0

[dependabot]

Updates the requirements on weight-custody-manifest to permit the latest version.

Commits

• See full diff in compare view

[imran-siddique]

Holding this one, and it is not a flake. Diagnosed to the bottom:

weight-custody-manifest 0.25.0 requires cryptography>=50,<51. cmcp-runtime 0.4.0 requires agent-governance-toolkit-core>=4.1.0,<5.0, and every agt-core in that range caps cryptography<49.0. The two cannot both be satisfied.

Because cmcp-runtime had no floor in requirements.txt, pip did not report that. It backtracked to cmcp-runtime 0.1.0, the only release with no agt-core dependency, installed it and cryptography 50.0.0 with exit code 0, and the job then failed at Demo 1 - cMCP in action with cMCP Runtime exited with code 1 before listening on :8443. That reads as a gateway bug and is a silent three-version downgrade.

#53 has landed, adding cmcp-runtime>=0.4.0 so this class of failure is a resolver error at install time rather than a crash at startup, and holding weight-custody-manifest<0.25.0 until the cap moves.

Widening cmcp-runtime's agt-core range would not help: agt-core 5.0.0 only moves the cap to cryptography<50.0, which still excludes the >=50 that wcm 0.25.0 needs. The durable fix is upstream, in agt-core allowing cryptography 50, tracked in agentrust-io/cmcp#471.

Leaving this open. It becomes mergeable, and the ceiling in #53 comes off, once that lands.

[imran-siddique]

Closing rather than leaving this held. It cannot merge under anything available in this repository, and the diagnosis has not changed since #53 landed.

Re-checked against PyPI today: agent-governance-toolkit-core is at 5.0.0 and still caps cryptography<50.0, weight-custody-manifest 0.25.0 needs cryptography>=50,<51, and cmcp-runtime 0.4.0 pins agent-governance-toolkit-core>=4.1.0,<5.0 so it cannot reach 5.0.0 anyway. Both doors are shut, and widening the range in either direction reaches a version that still caps too low.

The failing Install demo dependencies step is a genuine ResolutionImpossible, which is #53 doing its job: before it, the missing cmcp-runtime floor let pip backtrack to 0.1.0 and exit 0, and the demo died at startup looking like a gateway bug.

Blocked on agentrust-io/cmcp#471. Dependabot will re-propose this once the cap lifts.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.