3 people 07b33185ea fix: reject credential-bearing Git dependencies (#8542) ...

## Description
Reject Git HTTP dependency URLs containing userinfo before Docker
generation so credentials cannot persist in Dockerfiles or image layers.
Validation now covers local requirement/package metadata and uv
pyproject/lock inputs while keeping errors token-free.

## Test Plan
- [x] Validate credentialed raw, local-manifest, and uv-managed Git URLs
are rejected without echoing secrets
- [x] Validate credential-free HTTPS and SSH Git URLs remain supported

Made by [Open
SWE](https://openswe.vercel.app/agents/81b07455-ece4-3ddc-9955-d7a5bea78d2c)

---------

Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>

2026-09-27 21:34:53 +00:00

..

schema.json

fix: reject credential-bearing Git dependencies (#8542)

2026-09-27 21:34:53 +00:00

schema.v0.json

fix: reject credential-bearing Git dependencies (#8542)

2026-09-27 21:34:53 +00:00

version.schema.json

feat: [CLI] Add arg to retain build deps (setuptools, pip, wheel) (#5404)

2025-07-08 19:41:47 +00:00