# Pinned toolchain for regenerating the Python SDK (packages/sdk/py/vibedasher).
#
# `scripts/regen.sh` builds a throwaway venv at packages/sdk/py/.venv-gen from
# EXACTLY this file and generates using ONLY that venv's binaries on PATH
# (including its own bundled `ruff`, not api/.venv's or any system ruff) so the
# output depends on nothing but this pin. Bumping the version here is a
# deliberate, reviewed act — it rewrites most of packages/sdk/py/vibedasher/.
#
# 0.29.1 (not 0.29.0): 0.29.1 fixes a real security advisory (arbitrary code
# generation from a malicious OpenAPI document, GHSA-5293-mq8x-g3xj) present
# in 0.29.0. Verified 2026-09-06 that 0.29.0 and 0.29.1 emit the SAME
# `from_dict(cls: type[T], ...) -> T` model signature — neither release, nor
# openapi-python-client's git HEAD past 0.29.1, has ever emitted the
# `-> Self` form the previously-committed tree carried. That form was not
# reproducible from any real build of this tool; see
# GOLIVE_QA/GOAL_MOAT_2026-09-05/slices/python-sdk-regen.md for the
# investigation. Re-verify with generate.sh before ever bumping this pin.
openapi-python-client==0.29.1
