[qw-in]

update examples to 1.5.0

[arcjet-review]

Arcjet Review — 🟢 Normal Risk

Decision: Approved

Rationale: This is a narrow dependency-version update with no changes to security logic, API contracts, or database structure. The requested extras remain available in the repository's 1.5.0 package metadata. No concrete correctness or security issue was found. Example-level validation would strengthen confidence in the published-package upgrade.

Summary of Changes

Updates the Claude Managed Agents FastAPI example's Arcjet dependency from 1.4.0 to 1.5.0 and aligns the README's version reference.

Escalation Triggers

• Dependency Changes: The example's pyproject.toml updates its pinned Arcjet SDK dependency to 1.5.0.

Review Steps

API Review

Relevancy	Outcome
none	⏭️ Skipped

Data Flow Map

Relevancy	Outcome
none	⏭️ Skipped

Dependency Audit

Relevancy	Outcome
high	✅ Pass

Minor upgrade of the SDK demonstrated by the example; no additional dependency surface is declared.

Docs Review

Relevancy	Outcome
low	✅ Pass

The README version is aligned; this narrow upgrade requires no additional architectural or usage documentation.

Historical ADR Review

Relevancy	Outcome
none	⏭️ Skipped

Migration Safety

Relevancy	Outcome
none	⏭️ Skipped

Security Review

Relevancy	Outcome
low	✅ Pass

No changed authentication, authorization, input-handling, or secrets-handling logic and no security findings.

Test Coverage

Relevancy	Outcome
low	⚠️ Concerns

The example has an existing verification script, but the inspected CI does not run it against the published dependency.

Zero Data Retention

Relevancy	Outcome
none	⏭️ Skipped

WorkOS Audit Logging

Relevancy	Outcome
none	⏭️ Skipped

Notes

Assessment respects the filtered diff and makes no claim that other examples or lockfiles were omitted from the branch. Tests were not executed. The example's uv.lock could not be inspected because it exceeds the file-reading tool's size limit.

Path filtering: 11 files excluded by ignore paths. 2 of 13 files included in review.

_{Review: 03056054 | Model: openai/gpt-6-astra | Powered by Arcjet Review}

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	License policy violation: pypi arcjet-sensitive-info-rampart under CC-BY-4.0 License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (arcjet_sensitive_info_rampart-1.5.0/pyproject.toml) License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (arcjet_sensitive_info_rampart-1.5.0/PKG-INFO) License: LicenseRef-CC-BY-4.0-0c618849 - The applicable license policy does not permit this license (5) (arcjet_sensitive_info_rampart-1.5.0/src/arcjet_sensitive_info_rampart/models/rampart/LICENSE) From: examples/fastapi-claude-managed-agents-guard/uv.lock → pypi/arcjet@1.5.0 → pypi/arcjet-sensitive-info-rampart@1.5.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/arcjet-sensitive-info-rampart@1.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: pypi arcjet-sensitive-info-rampart under CC-BY-4.0 License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (arcjet_sensitive_info_rampart-1.5.0.dist-info/METADATA) License: LicenseRef-CC-BY-4.0-0c618849 - The applicable license policy does not permit this license (5) (arcjet_sensitive_info_rampart/models/rampart/LICENSE) From: examples/fastapi-claude-managed-agents-guard/uv.lock → pypi/arcjet@1.5.0 → pypi/arcjet-sensitive-info-rampart@1.5.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/arcjet-sensitive-info-rampart@1.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: pypi arcjet-sensitive-info-rampart Location: Package overview From: examples/fastapi-claude-managed-agents-guard/uv.lock → pypi/arcjet@1.5.0 → pypi/arcjet-sensitive-info-rampart@1.5.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/arcjet-sensitive-info-rampart@1.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report