build(deps): bump boto3-stubs from 1.43.87 to 1.43.89

[dependabot]

Bumps boto3-stubs from 1.43.87 to 1.43.89.

Commits

• See full diff in compare view

---

Note

Low Risk
Dev-only typing stub bump with no runtime or application logic changes.

Overview
Raises the optional dev dependency floor for boto3-stubs from >=1.43.18 to >=1.43.89 in pyproject.toml and refreshes poetry.lock so the locked package moves 1.43.87 → 1.43.89 (wheel/tarball hashes and lock content-hash).

This only affects type-checking when installing dev extras (boto3-stubs[essential]); runtime boto3 constraints are unchanged.

^{Reviewed by Cursor Bugbot for commit 18fa6c2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​boto3-stubs@​1.43.87 ⏵ 1.43.89

View full report

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review this Dependabot bump against the malware scan, lockfile/manifest diffs, and upstream tags to judge whether 1.43.86 looks like a real release or a supply-chain compromise.Verdict: benign

This is a routine boto3-stubs patch (1.43.79 → 1.43.86) for generated AWS typing stubs. PyPI publishes 1.43.86 with the same author (Vlad Emelianov <vlad.emelianov.nz@gmail.com>), it tracks real boto3==1.43.86, and poetry.lock SHA-256s match the PyPI wheel/sdist. Usage is optional dev typing only (boto3-stubs[essential]). No install scripts, unexpected hosts, Unicode/IOC hits, or workflow changes.

Scanner disagreement: ghost_version_or_missing_tag and maintainer_drift are false positives. The scanner could not resolve git refs (unresolved, 0 upstream files) because Dependabot pointed at youtype/mypy_boto3_builder (builder 8.12.0), while stub versions follow boto3 and are not tagged as 1.43.86 on that repo. Maintainer identity is unchanged; the npm-style drift heuristic does not apply.

No supply-chain malware indicators. Safe to merge from a malware-review standpoint.

Compatibility Analysis

I'll inspect how boto3-stubs is used here and what changed upstream between 1.43.79 and 1.43.86.Recommendation: merge-with-caveats

Patch bump of a dev-only typing package. No runtime surface. Caveat is lockfile skew with boto3, not a reason to hold.

1) Where it is used

Location	Role
pyproject.toml	Optional boto3-stubs >= 1.43.86; extra dev installs boto3-stubs[essential]
poetry.lock	boto3-stubs 1.43.86; mypy-boto3-s3 still 1.43.14 (>=1.43.0,<1.44.0)
chia/data_layer/s3_plugin_service.py	Only application import: TYPE_CHECKING from mypy_boto3_s3 import S3ServiceResource

Runtime AWS usage is boto3, not the stubs: boto3.resource("s3", ...), Bucket(), upload_file, download_file, ObjectSummary(...).size, objects.all(). Locked runtime SDK remains boto3 1.43.79.

No tests import boto3-stubs / mypy_boto3_s3.

2) Intersection with changed APIs

Dependabot pointed at youtype/mypy_boto3_builder (generator 8.12.0). That repo does not version as 1.43.86; boto3-stubs versions follow boto3. Local .upstream-dependency is the generator, not the published stub wheel. upstream_changed_files.txt is empty for that reason.

boto3 1.43.80–1.43.86 changelogs are botocore api-change entries for other services (Lambda, EC2, RDS, GuardDuty, …). No S3 client/resource model changes. The Lambda note about S3 access is the Lambda API, unused here.

Chia’s S3 resource methods are the long-lived injected stubs (download_file / upload_file in the builder S3 map). They do not intersect this patch range.

mypy-boto3-s3 staying at 1.43.14 is consistent: service packages republish only when that service’s model changes.

3) Risks / unknowns

• Runtime/build: none. Package is optional = true, extra == "dev", typing-only.
• mypy: low. Types for unused essential extras (lambda, rds, …) may tighten; Chia only types S3ServiceResource.
• Stub vs SDK: stubs now describe boto3 1.43.86 while runtime stays 1.43.79. Same pattern as before; S3 types did not move.
• Scan ghost_version / maintainer_drift: expected mismatch (PyPI stub version vs builder git tags), not a compatibility issue.

4) Verdict

merge-with-caveats — safe for this repo. Confirm CI mypy if it runs with dev extras. Do not treat this as a boto3 runtime upgrade.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 0
• Resolution strategy: unresolved
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved refs: from=n/a to=n/a
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 2

Top findings

• boto3-stubs:0 ghost_version_or_missing_tag :: 1.43.86
• boto3-stubs:0 maintainer_drift :: 1.43.79->1.43.86

[coveralls-official]

Coverage Report for CI Build 34415771209

Coverage increased (+0.03%) to 90.235%

Details

• Coverage increased (+0.03%) from the base build.
• Patch coverage: No coverable lines changed in this PR.
• 6 coverage regressions across 3 files.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

6 previously-covered lines in 3 files lost coverage.

File	Lines Losing Coverage	Coverage
chia/simulator/setup_services.py	3	94.43%
chia/data_layer/data_layer.py	2	85.84%
chia/wallet/wallet_node.py	1	84.92%

---

Coverage Stats

Relevant Lines:	126813
Covered Lines:	116981
Line Coverage:	92.25%
Relevant Branches:	24906
Covered Branches:	19923
Branch Coverage:	79.99%
Branches in Coverage %:	Yes
Coverage Strength:	1.84 hits per line

---

💛 - Coveralls

[emlowe]

@dependabot rebase

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

Verdict: benign

I'll review the boto3-stubs bump against the malware scan, lockfile/manifest diffs, and upstream tags for integrity issues.

This is a routine patch bump of the generated AWS type-stub package (boto3-stubs 1.43.79 → 1.43.87), used here as an optional/dev extra for mypy. PyPI has a real, unyanked 1.43.87 with the same author (Vlad Emelianov <vlad.emelianov.nz@gmail.com>) and project URLs as 1.43.79. poetry.lock sha256 values match PyPI for both the wheel and sdist. Versioning tracks boto3 (not the generator), which is the documented scheme.

Scanner report (status warn, warn_only: true) found no unicode/GlassWorm, confusable, or IOC hits, 0 upstream files changed, and resolution_strategy: unresolved. The two heuristics do not indicate compromise:

• ghost_version_or_missing_tag: expected. Dependabot pointed at youtype/mypy_boto3_builder, whose git tags are builder releases (8.x, e.g. 8.12.0), not boto3-stubs 1.43.87. The stubs package is generated and published to PyPI; it is not tagged as 1.43.87 on the builder repo.
• maintainer_drift / npm-maintainers: false positive. This is PyPI, not npm. Publisher identity is unchanged across the two versions.

No install/lifecycle scripts, no unexpected hosts, no lockfile hash mismatch, no workflow changes, and no evidence of a new runtime payload. Treat the scanner warnings as unresolved-ref noise, not malware.

Compatibility Analysis

I'll inspect how boto3-stubs is used in this repo and what changed upstream between 1.43.79 and 1.43.87, then give a merge recommendation.Recommendation: merge-with-caveats

boto3-stubs 1.43.79 → 1.43.87 is a dev-only typing bump. It does not change production runtime. Chia’s S3 usage does not sit on APIs that changed in this range.

1) Where it is used

• Declared: optional dev extra in pyproject.toml (boto3-stubs[essential], >=1.43.87). Locked in poetry.lock.
• Runtime AWS SDK is separate: boto3 >= 1.43.8, lock still boto3 1.43.79.
• Only application import: chia/data_layer/s3_plugin_service.py (Data Layer S3 plugin). Under TYPE_CHECKING: from mypy_boto3_s3 import S3ServiceResource. Runtime: boto3.resource("s3", ...).
• Called S3 surface: Bucket(...), upload_file, download_file, ObjectSummary(...).size.
• Not a runtime dependency of node/farmer/wallet. Console script chia_data_layer_s3_plugin uses boto3, not stubs.
• mypy-boto3-s3 (from [essential]) remains 1.43.14 in the lock.

2) Intersection with upstream / boto3 API changes

Dependabot pointed at youtype/mypy_boto3_builder. That repo is the generator (mypy-boto3-builder 8.12.0), not the published boto3-stubs tree. Stub versions track boto3, so tags like 1.43.87 are absent on the builder (matches the “ghost version” heuristic). Both 1.43.79 and 1.43.87 stubs are generated with the same builder 8.12.0. .upstream-dependency has no stub-package diff for this bump.

boto3 1.43.80–1.43.87 changelogs: service model updates for many AWS APIs; no s3 api-change in that window. Chia does not type-check those other services.

So usage sites do not intersect likely changed APIs.

3) Risks / unknowns

Risk	Severity
Runtime / installer / PyInstaller	None. Optional dev extra; not on the production import path.
Typecheck vs runtime skew (boto3 1.43.79 vs stubs 1.43.87)	Low. Stubs can mention APIs the locked SDK lacks; Chia only uses stable S3 resource helpers that did not change here.
mypy-boto3-s3 still 1.43.14	Expected if S3 models were unchanged; the meta-package bump is mostly extras/metadata.
mypy CI	Real gate. Pre-commit/mypy on s3_plugin_service.py should be green before merge.
Heuristics (ghost_version, maintainer_drift)	Not a compatibility signal for this versioning model.

Python: stubs >=3.9, Chia >=3.10 — fine.

4) Action

Merge once the PR’s mypy/pre-commit job is green. No runtime test of the S3 plugin is required for this stubs-only bump. Do not treat a later boto3 bump as already covered; that would be a separate runtime review.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 0
• Resolution strategy: unresolved
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved refs: from=n/a to=n/a
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 2

Top findings

• boto3-stubs:0 ghost_version_or_missing_tag :: 1.43.87
• boto3-stubs:0 maintainer_drift :: 1.43.79->1.43.87

[emlowe]

@dependabot rebase

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

Verdict: benign

I'll review this boto3-stubs bump against the malware checklist, local usage, lockfile/upstream diffs, and the scanner findings.

This is a routine two-patch bump of an optional dev typing extra (boto3-stubs[essential] in pyproject.toml / poetry.lock), not runtime code.

Checklist

• Classic obfuscation: No evidence. Upstream clone is youtype/mypy_boto3_builder (generator tagged 8.12.0), not the published stub tree. The PyPI artifact is type stubs generated with the same builder as 1.43.87. No install/lifecycle scripts apply (Python wheel, not npm).
• Invisible Unicode / GlassWorm: Scanner unicode/confusable/IOC counts were 0. No upstream file diff was resolved to scan.
• Dependency integrity: PyPI 1.43.89 exists, is not yanked, and is authored by Vlad Emelianov with the same project URLs as 1.43.87. Wheel/sdist sizes are essentially unchanged. requires_dist is identical after the expected boto3==1.43.89 extra pin (872 entries both sides). Lockfile hashes match PyPI: be8217bbc3… (wheel) and f172322f8c… (sdist). Transitive typing extras (botocore-stubs, types-s3transfer, mypy-boto3-*) are the usual stub graph, not a sudden new runtime tree.
• Dependabot context: Manifest/lock bump only. No node_modules/vendor trees, no workflow files.

Scanner vs this review: Status was warn with resolution_strategy: unresolved and 0 changed files scanned. ghost_version_or_missing_tag for 1.43.89 is expected: stub versions track boto3, while mypy_boto3_builder tags are 8.x (no 1.43.89 tag). maintainer_drift used pattern npm-maintainers on a PyPI package; PyPI author/URLs are unchanged. Those heuristics are false positives, not compromise evidence.

Compatibility Analysis

I'll inspect how this repo uses boto3-stubs, then compare upstream 1.43.87→1.43.89 for API impact and compatibility risk.I'll now search chia source for boto3 usage and inspect upstream tags versus the stub version bump.Recommendation: merge-with-caveats

boto3-stubs 1.43.87 → 1.43.89 is a generated typing-only bump. It does not change Chia runtime behavior. Caveats are version skew vs locked boto3 and the fact that the cloned “upstream” tree is the generator (mypy-boto3-builder 8.12.0), not the published boto3-stubs artifact.

1) Where it is used

Site	Role
pyproject.toml	Optional dep boto3-stubs >= 1.43.89; dev extra installs boto3-stubs[essential]
poetry.lock	Locked at 1.43.89; extra pulls mypy-boto3-{s3,ec2,...}
chia/data_layer/s3_plugin_service.py	Only consumer: TYPE_CHECKING import of S3ServiceResource; runtime uses boto3.resource("s3")

Runtime SDK is separate: boto3 >= 1.43.8, lock 1.43.87. Production nodes do not need boto3-stubs.

S3 plugin calls: Bucket(), upload_file, download_file, ObjectSummary(...).size. Those types come from mypy-boto3-s3, still locked at 1.43.14.

2) Intersection with changed APIs

• Dependabot had no stub changelog. boto3 1.43.88 / 1.43.89 change Bedrock, EC2, MediaTailor, Service Quotas, Connect, ECS, EKS, etc. No S3 entries.
• S3 Object Lock “variable retention” appears in a newer boto3 than 1.43.89, not in this bump.
• .upstream-dependency is the builder (youtype/mypy_boto3_builder), versioned 8.12.0, not boto3-stubs 1.43.x. Empty upstream_changed_files.txt and missing tag 1.43.89 are expected for this packaging model.

Chia’s S3 usage does not intersect APIs that changed in 1.43.88–1.43.89.

3) Risks / unknowns

• Runtime / install: none for default installs. Stubs are optional = true / extra == "dev".
• Typecheck: low. mypy-boto3-s3 and botocore-stubs stay at 1.43.14; wrapper-only bump is unlikely to break S3ServiceResource / Bucket typing. Residual risk is a mypy delta on boto3.resource(...) if the wrapper’s overloads changed (cannot confirm from the builder checkout).
• Skew: stubs advertise boto3 1.43.89; runtime boto3 is still 1.43.87. Harmless unless someone installs extra boto3-stubs[boto3] (pins boto3==1.43.89).
• Tests: no _tests hits for this plugin; CI signal is mypy, not pytest.
• Malware heuristics (ghost_version_or_missing_tag, maintainer_drift) are not compatibility blockers here.

4) Action

Merge for compatibility. Optional follow-ups (not blockers): bump runtime boto3 in lockstep later; treat builder-repo tags as unrelated to boto3-stubs PyPI versions; rely on mypy CI as the real check.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 0
• Resolution strategy: unresolved
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved refs: from=n/a to=n/a
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 2

Top findings

• boto3-stubs:0 ghost_version_or_missing_tag :: 1.43.89
• boto3-stubs:0 maintainer_drift :: 1.43.87->1.43.89

[dependabot]

Superseded by #21408.