build(deps): bump types-psutil from 7.2.2.20260827 to 7.2.2.20260906

[dependabot]

Bumps types-psutil from 7.2.2.20260827 to 7.2.2.20260906.

Commits

• See full diff in compare view

---

Note

Low Risk
Dev-only typeshed stub bump with no application or runtime dependency changes.

Overview
Updates the optional dev dependency types-psutil to >=7.2.2.20260906 in pyproject.toml and refreshes poetry.lock so the resolved stub package is 7.2.2.20260906 (new wheel/tarball hashes and lock content-hash).

This only affects static typing for existing psutil usage (e.g. in utilities); runtime psutil is unchanged.

^{Reviewed by Cursor Bugbot for commit 036d73c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​types-psutil@​7.2.2.20260827 ⏵ 7.2.2.20260906

View full report

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the types-psutil bump against the malware checklist, scanner findings, and local lockfile/upstream evidence.Verdict: benign

This is a date-stamped typeshed stub republish of types-psutil (7.2.2.20260518 → 7.2.2.20260827), not a runtime package change. PyPI still lists Owner: typeshed_bot, Apache-2.0, no requires_dist, and lockfile hashes match PyPI (sha256:62364359… wheel, sha256:3c6067db… sdist). Official changelog for this version is only Add __all__ (typeshed #16259). Stubs are .pyi annotations; no install scripts, no new transitives, no workflow/vendor payload.

Scanner status was warn with two heuristics. Those do not indicate compromise here:

• ghost_version_or_missing_tag — typeshed versions are {psutil}.{YYYYMMDD}, not git tags on python/typeshed. Resolution was unresolved / 0 changed files.
• maintainer_drift (npm-maintainers) — npm-style check on a PyPI stub package; publisher is unchanged (typeshed_bot).

No unicode/confusable/IOC hits. Treat the scanner findings as false positives for this packaging model.

Compatibility Analysis

I'll analyze how types-psutil is used in this repo and what changed upstream between those versions.Recommendation: merge

types-psutil is a dev-only typing stub (optional = true, dev extra). It does not ship in production and does not change psutil runtime behavior (psutil >= 6.1.0 is unchanged).

1) Where it is used

The stub is declared in pyproject.toml / poetry.lock for mypy. Runtime psutil call sites:

Site	APIs
chia/util/cpu.py	Process().cpu_affinity()
chia/util/beta_metrics.py	cpu_count, cpu_percent, cpu_times, cpu_freq, getloadavg, virtual_memory, swap_memory, disk_*, net_io_counters
tools/cpu_utilization.py	Process, cpu_times, children, threads, NoSuchProcess

Callers of available_logical_cores() (harvester, full node, data layer, simulator, benchmarks) do not import psutil directly.

2) Intersection with stub changes

Upstream (typeshed stubs/psutil) between 2026-05-18 and 2026-08-27 has one commit: add __all__ to psutil/__init__.pyi (#16259). No function/class signature, overload, or return-type changes.

This repo does not from psutil import *. Listed APIs are all still present and unchanged.

3) Risks / unknowns

• Runtime / installers / wheels: none. Stub-only, py3-none-any.
• Build / typecheck: only mypy (pre-commit). Additive __all__ is unlikely to fail; if it did, it would show in existing mypy CI, not as a runtime break.
• Typeshed date tags are not git tags on python/typeshed; ignore scan “ghost version” noise for this package.

4) Verdict

Merge. No API overlap with the stub delta. Confirm mypy on the PR as usual; no extra runtime test plan.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 0
• Resolution strategy: unresolved
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved refs: from=n/a to=n/a
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 2

Top findings

• types-psutil:0 ghost_version_or_missing_tag :: 7.2.2.20260827
• types-psutil:0 maintainer_drift :: 7.2.2.20260518->7.2.2.20260827

[coveralls-official]

Coverage Report for CI Build 34415764557

Coverage increased (+0.006%) to 90.212%

Details

• Coverage increased (+0.006%) from the base build.
• Patch coverage: No coverable lines changed in this PR.
• 17 coverage regressions across 7 files.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

17 previously-covered lines in 7 files lost coverage.

File	Lines Losing Coverage	Coverage
chia/full_node/full_node.py	5	84.08%
chia/server/node_discovery.py	3	76.38%
chia/server/server.py	3	80.15%
chia/data_layer/data_layer.py	2	85.84%
chia/timelord/timelord_launcher.py	2	67.74%
chia/_tests/simulation/test_simulation.py	1	93.84%
chia/wallet/wallet_node.py	1	85.14%

---

Coverage Stats

Relevant Lines:	126813
Covered Lines:	116950
Line Coverage:	92.22%
Relevant Branches:	24906
Covered Branches:	19918
Branch Coverage:	79.97%
Branches in Coverage %:	Yes
Coverage Strength:	1.84 hits per line

---

💛 - Coveralls

[emlowe]

@dependabot rebase

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

Verdict: benign

I'll review this types-psutil bump for supply-chain risk: lockfile/manifest changes, upstream package contents, and the malware-scan findings.I'll inspect lockfile hashes, typeshed stub history, and PyPI metadata to see whether the scanner warnings are real or just unresolved tags.

types-psutil is an official typeshed stub package (typeshed_bot on PyPI, Apache-2.0). This bump is a calendar republish of the same psutil==7.2.2 stubs (7.2.2.20260518 → 7.2.2.20260827), optional dev extra only, no runtime install, no new deps (requires_dist is empty).

Integrity

• poetry.lock SHA-256s match PyPI for both the wheel and sdist.
• Both releases are owned by typeshed_bot; not yanked; no advertised vulnerabilities.
• Upstream source commits on python/typeshed are 3402466d → c10142fb. The only stubs/psutil change is PR #16259: add __all__ plus stubtest allowlist tweaks. No executable Python, no new files of concern.

Scanner vs review

• Report status warn, resolution_strategy: unresolved, 0 files scanned.
• ghost_version_or_missing_tag is expected: typeshed does not git-tag types-psutil versions; PyPI exists and hashes match.
• maintainer_drift (npm-maintainers) is a false positive on a PyPI typeshed bot republish, not a publisher change.

Checklist (all clear)

• Classic obfuscation / eval / unexpected network / persistence / install scripts: none (.pyi stubs only; not an npm package).
• Invisible Unicode / GlassWorm: scanner unicode/confusable/IOC = 0.
• Transitive graph / lockfile format / version skip: none; date suffix only.
• Dependabot surface: lock/manifest bump of a known stub extra; no node_modules, no new lifecycle scripts, no .github/workflows in the dependency itself.

Safe to merge from a supply-chain malware perspective.

Compatibility Analysis

I'll inspect how types-psutil is used in this repo and what changed upstream so the compatibility recommendation is grounded in both.Recommendation: merge

types-psutil is a dev-only typing stub (optional = true, extra == "dev"). It is not imported at runtime. Runtime remains psutil>=6.1.0.

1) Usage in this repo

Declared in pyproject.toml / poetry.lock as a mypy helper.

Runtime psutil call sites (typed by these stubs; mypy covers chia, tools, benchmarks):

Site	APIs
chia/util/cpu.py	Process().cpu_affinity()
chia/util/beta_metrics.py	cpu_count, cpu_percent, cpu_times, cpu_freq, getloadavg, disk_io_counters, virtual_memory, swap_memory, disk_partitions, disk_usage, net_io_counters
tools/cpu_utilization.py	Process, is_running, cpu_times, children, threads, NoSuchProcess

available_logical_cores() is used more widely (harvester, full node, data layer, simulator, benchmarks); those files do not import psutil themselves.

2) Intersection with upstream changes

Stub changelog (typeshed-internal/stub_uploader psutil.md):

• 7.2.2.20260827: Add __all__ (typeshed#16259)
• 7.2.2.20260518: Black upgrade only (no API annotation changes)

No signatures used here were changed. Call sites already use public names that belong in __all__.

3) Risks / unknowns

• No runtime or install impact for production extras; wheel is stubs-only, requires_python >= 3.10 matches this repo.
• Pre-existing (not this bump): stubs still target psutil 7.2.2 while runtime is psutil>=6.1.0. Unchanged vs 7.2.2.20260518.
• Residual risk is a mypy false positive from __all__. Unlikely given import psutil + public APIs. CI mypy is the check.

4) Verdict

Merge. Date-only stub republish with __all__; no production code path, no changed APIs at usage sites. Confirm mypy in this PR’s CI.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 0
• Resolution strategy: unresolved
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved refs: from=n/a to=n/a
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 2

Top findings

• types-psutil:0 ghost_version_or_missing_tag :: 7.2.2.20260827
• types-psutil:0 maintainer_drift :: 7.2.2.20260518->7.2.2.20260827

[emlowe]

@dependabot rebase

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

Verdict: benign

I'll review the types-psutil bump against lockfile/upstream changes and the malware-scan findings.

This is a routine typeshed stub republish: types-psutil 7.2.2.20260827 → 7.2.2.20260906 (calendar suffix only; still targeting psutil==7.2.2). PyPI lists the version as the official typeshed stub package (Apache-2.0, python/typeshed, generated from commit dfb509fb0e8a5178b457c40e3ab68d685ee269e2). In this repo it is an optional dev extra for mypy, not runtime code. poetry.lock records the expected wheel/sdist and sha256 hashes; no new transitive dependencies, lifecycle scripts, or workflow changes.

Scanner vs interpretation: the scan status is warn with resolution_strategy: unresolved and 0 upstream files scanned. The two heuristics are false positives for this ecosystem:

• ghost_version_or_missing_tag — typeshed stub versions are upstream.YYYYMMDD and are not git tags on python/typeshed.
• maintainer_drift (npm-maintainers) — npm publisher heuristic applied to a PyPI typeshed package; not evidence of a hijack.

Unicode/IOC/confusable findings were all zero. No obfuscation, unexpected network/FS/process behavior, or lockfile integrity anomalies in the update itself. Safe to merge from a malware/supply-chain standpoint.

Compatibility Analysis

I'll inspect how types-psutil is used in this repo and what changed upstream between those stub versions.Recommendation: merge

types-psutil is a dev-only typing stub (optional = true, dev extra). It does not ship in production and has no runtime import path. Runtime remains psutil (pyproject.toml: psutil = ">=6.1.0", lockfile psutil-7.2.2). This bump stays on stubs for psutil 7.2.2.

Usage in this repo

• Declared: pyproject.toml + poetry.lock only.
• Consumed by mypy (pre-commit / CI), not by tests (no chia/_tests hits).
• Runtime psutil call sites (what mypy would re-check):
  • chia/util/cpu.py — Process().cpu_affinity() (non-macOS)
  • chia/util/beta_metrics.py — cpu_count, cpu_percent, cpu_times, cpu_freq, getloadavg, disk_io_counters, virtual_memory, swap_memory, disk_partitions, disk_usage, net_io_counters
  • tools/cpu_utilization.py — Process, cpu_times, children, threads, NoSuchProcess

None of those sites use Process.memory_maps() or heap namedtuples.

Upstream delta (7.2.2.20260827 → 7.2.2.20260906)

Stub uploader changelog (psutil.md):

• Type memory-map and heap namedtuple fields (typeshed#16261)
• Overloads for Process.memory_maps() (typeshed#16265)

Checked against .upstream-dependency/stubs/psutil: those APIs exist in __init__.pyi / _ntuples.pyi; chia does not call them. No intersection with local usage.

Risks / unknowns

• Runtime / installers: none. Stub-only wheel; Python >=3.10 matches this repo.
• Build / typecheck: possible mypy noise only if unused APIs were used; they are not. Residual risk is a pre-commit mypy flake on cpu.py / beta_metrics.py — low, and CI would catch it.
• Malware-scan ghost_version / maintainer_drift hits are expected for typeshed date-suffix versions (typeshed_bot), not a compatibility issue.

No hold criteria. Merge after the usual mypy/pre-commit green on the PR.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 0
• Resolution strategy: unresolved
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved refs: from=n/a to=n/a
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 2

Top findings

• types-psutil:0 ghost_version_or_missing_tag :: 7.2.2.20260906
• types-psutil:0 maintainer_drift :: 7.2.2.20260827->7.2.2.20260906

[dependabot]

Superseded by #21411.