Dream dream-2026-07-23.1

[franccesco]

Dream dream-2026-07-23.1 — complete

Field	Value
Dream ID	dream-2026-07-23.1
Base SHA	bc89984bd298383ed16e2a75bfae80871581451a
Scope	major (/dream major)
Mode	github
Depth cap	2
Comment	(none)

Nothing auto-merges. Review each PR/issue linked below.

---

Targets probed

Target	Pinned	Latest	Outcome
httpx	0.28.1	0.28.1	no delta — skip
pydantic	2.11.7	2.13.4	delta → research
pyyaml	6.0.2	6.0.3	packaging-only — no code finding
typing-extensions	4.14.0	4.16.0	unused direct dep → PR
pytest	8.4.0	9.1.1	CVE + major → PR
pytest-asyncio	1.0.0	1.4.0	deprecation config → PR
pytest-cov	6.2.1	7.1.0	clean major (lock hygiene)
ruff	0.11.13	0.16.0	planned upgrade → issue
basedpyright	1.37.1	1.39.9	no code impact
mkdocs	1.6.1	1.6.1	no delta
mkdocs-material	9.6.14	9.7.7	XSS → PR
mkdocstrings	0.29.1	1.0.6	optional polish only
python	3.12 pin	3.14.6	CI 3.14 → PR

Vuln probe: pip-audit degraded (venv/pip); OSV batch used instead. pytest GHSA confirmed; material XSS from maintainer GHSA.

Toolchain checks: ruff check/format, basedpyright — all clean at base.

Practices sweep units

Unit	Outcome
bloomy-core	findings (APIError, form data, populate_by_name, …)
operations-sync	findings (score, params, scorecard mapping)
operations-async	findings (concurrency)
mixins	opportunities (model_validate) → re-dream / follow-up
utils	findings (gather sort, Callable)

PRs opened (17)

Finding	PR
001 populate_by_name	#21
002 pytest CVE	#22
003 material XSS	#23
004 drop typing-extensions	#24
005 httpx form data=	#25
006 score return True	#26
007 todo params=	#27
008 typing.Self	#28
009 asyncio loop scope	#29
010 ruff remove FAST	#30
011 async gather sort	#31
012 Callable bulk sync	#32
013 export bulk models	#33
014 concurrent users.details	#34
015 PEP 695 type aliases	#35
016 Path.open	#36
017 CI Python 3.14	#37

Issues opened (3)

Finding	Issue
018 APIError contract	#38
019 Material → Zensical	#39
020 ruff 0.16 plan	#40

Skipped / no-impact (selected)

• httpx, mkdocs up to date
• pyyaml 6.0.3 packaging-only
• basedpyright 1.37→1.39 no code impact
• pytest-cov 6→7 no code migration needed for this suite
• Many pydantic 2.12/2.13 features unused

Degraded

• uvx pip-audit failed against uv venv (no pip); used OSV.dev instead
• Workflow tool first launch used placeholder args (ignored); research used parallel dream:researcher / dream:verifier subagents

Ledger

.claude/dream/findings/ — 20 findings (local; gitignored under .claude/dream/)