build(deps): name RankWeave by its canonical release

[seonghobae]

Summary

• Name the RankWeave direct requirement by the owner release v0.18.0. That lightweight tag points at 61c49c50d3b4a24fc9bd7c6d3a7f2f4ba19d7be6, the commit the lock already recorded.
• Keep that commit in uv.lock, so a later tag move cannot change an install without a lock update.
• Cover the requirement and the locked commit with tests/test_rankweave_dependency_pin.py.

Test plan

• uv lock --check
• .venv/bin/pytest tests/test_rankweave_dependency_pin.py -q

Summary by CodeRabbit

• 변경 사항
  • RankWeave 의존성 기준을 특정 커밋에서 v0.18.0 릴리스로 변경했습니다.
• 테스트
  • 설정과 잠금 정보가 동일한 릴리스 태그 및 해당 버전을 가리키는지 확인하는 검증을 추가했습니다.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: c0d07afc-50fb-4c60-96fd-0304e68782d2

📥 Commits

Reviewing files that changed from the base of the PR and between 83eba56 and 1420a73.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• pyproject.toml
• tests/test_rankweave_dependency_pin.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

RankWeave의 Git 의존성 기준을 특정 커밋 해시에서 v0.18.0 태그로 변경했습니다. 프로젝트 선언과 잠금 파일의 의존성 정보를 검증하는 테스트를 추가했습니다.

Changes

RankWeave 버전 핀

Layer / File(s)	Summary
의존성 핀과 잠금 정보 검증 pyproject.toml, tests/test_rankweave_dependency_pin.py	pyproject.toml에서 RankWeave 의존성 기준을 v0.18.0 태그로 변경했습니다. 추가된 테스트는 프로젝트 의존성 선언과 uv.lock의 요구 태그, 패키지 버전 및 커밋 해시를 확인합니다.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 1420a

Locked installs retain the reviewed commit, and pull-request CI checks that resolution. No actionable merge-blocking risk remains.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 1420a

The committed lock still selects the same RankWeave commit, and CI checks that binding. The release tag introduces a limited future supply-chain risk if an installation or lock refresh resolves it without those controls.

Retained concerns

• Low · security · inferred: The manifest now delegates future unlocked dependency resolution to a movable upstream tag rather than fixing the commit. An upstream retag could select different code during an unlocked install or lock refresh; the committed lock and its CI assertion limit the demonstrated exposure.

Security review details

Security Blast Radius

• inferred — The plausible affected scope is an environment that resolves RankWeave without the committed lock, or refreshes that lock after an upstream tag move. No such production path is established.

Trust Boundaries and Controls

• inferred — Control of the upstream release tag could influence future resolution. The committed resolved SHA, frozen CI installation, and test assertion constrain the inspected locked path; the test does not independently authenticate the remote tag.

Hardening Proposals

• proposed — If installations outside CI are security-sensitive, require them to consume the reviewed lock and retain commit verification on lock updates, or keep an immutable commit in the direct declaration.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 RankWeave 의존성을 특정 커밋에서 정식 릴리스 태그 v0.18.0으로 변경하는 주요 내용을 정확하게 요약합니다.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 1 files. (1 skipped: 1 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}