[devin-ai-integration]

Opened by fix-vulnerable-deps

Note

The Certora workflow installs Python with python-version: ">=3.11". The setup step takes whichever matching version the runner already has cached, and on 2026-11-02 that was CPython 3.15.1. That version carries a critical advisory (PSF-2026-46, the ssl denylist of compromised certificates) and a medium one (PSF-2026-45, a tarfile.tar_filter bypass). Those jobs run certora-cli with the CERTORAKEY secret. This PR pins Python to 3.15.2, the first 3.15 release that fixes both. Two newer advisories, PSF-2026-47 and PSF-2026-48, have no fixed 3.15 release yet and stay open.

Context

• Fixes: CPython 3.15.1 → 3.15.2 for PSF-2026-46 / CVE-2026-115557 / GHSA-x547-2835-q547 (critical) and PSF-2026-45 / CVE-2026-114583 / GHSA-mw29-5qxh-rr87 (medium).
• The range was resolved from the runner cache, not by downloading the newest release, so >=3.11 gave no guarantee that a patched version would be used.
• Mathis approved bumping CI versions for Protocol repositories. This PR changes CI only. The contracts, the solc 0.8.27 pin, the Foundry config and the submodule pins are untouched, so the bytecode is unchanged.

Impact of merging

• The Certora verify jobs install CPython 3.15.2 from actions/python-versions instead of the cached 3.15.1. Nothing else changes, including Foundry CI.
• Until a 3.15 release ships fixes for PSF-2026-47 (CVE-2026-103995, low) and PSF-2026-48 (CVE-2026-116566, medium), the pin needs another bump to pick them up.

Special things to note

• An exact pin also blocks automatic patch updates. That trade-off was accepted so CI uses a known, vetted version.
• Off the stack: no other dependency PR is open.

Change outline

• .github/workflows/certora.yml: python-version: ">=3.11" → "3.15.2".

Evidence

• Baseline: the main-branch Certora job log (run of 2026-11-02, job 125574089407) shows Successfully set up CPython (3.15.1).
• Applicability: OSV lists PSF-2026-45/46 for the v3.15.1 tag of cpython and nothing for v3.15.2. v3.15.1...v3.15.2 contains the backports gh-160097 (tarfile) and gh-160040 (CVE-2026-115557).
• Fix check: the workflow's single Python pin names 3.15.2, which is outside the affected ranges.
• vet: pass. The build comes from the official actions/python-versions release 3.15.2-40340363276, uploaded by github-actions[bot] on 2026-10-26 (more than 3 days ago). The linux-26.04-x64 asset digest is sha256:2c5bc846…f43e. PSF-2026-47/48 also affect 3.15.1, so they are residual.
• CI: Certora and Foundry checks on this PR.

Link to Devin session: https://app.devin.ai/sessions/93ce87e5244d42248f1f0db9cc798fe0
Open in Devin Desktop: https://app.devin.ai/desktop/session/93ce87e5244d42248f1f0db9cc798fe0?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring