{"owner":"guardrails-ai","repo":"guardrails","hasSkills":true,"hasMcp":false,"mcpConfig":null,"found":["CLAUDE.md"],"skills":{"CLAUDE.md":"# Guardrails — contributor guidance for Claude\n\n## Dependency strategy (IMPORTANT — always follow)\n\nThis repo separates **compatibility** (what users are allowed to install) from\n**security** (what we actually ship and test against). The two live in different\nfiles and must be managed differently:\n\n- **`pyproject.toml` — keep dependency ranges WIDE.** Floors and ceilings here exist\n  to express genuine compatibility boundaries (a real API break, a known-incompatible\n  major), *not* to pin security-patched versions. Do not raise a floor just to dodge a\n  CVE. Narrow ranges here propagate into every downstream project that installs\n  `guardrails-ai`, causing resolver conflicts for users.\n- **`poetry.lock` — pin the SAFE, patched versions.** Dependabot scans the lock file,\n  so the lock is where security fixes land. Within the wide `pyproject` ranges, the lock\n  should resolve to the latest patched releases.\n\n### How to apply\n\n- To fix a Dependabot/security alert: widen the `pyproject` range only as far as needed\n  to *allow* the patched version (e.g. if the fix is in a new major, raise the ceiling),\n  then update `poetry.lock` to the patched version with `poetry update <pkg>` (or a full\n  `rm poetry.lock && poetry lock` to also re-resolve non-active marker branches —\n  `poetry update` will not re-resolve marker branches like `python_version >= \"3.x\"`).\n- Prefer fixing a transitive cap at its source: if a first-party package (e.g.\n  `guardrails-api`) caps a dependency below a security fix, raise the cap in that package\n  and release it, rather than pinning around it here.\n- Only add an environment marker (e.g. `; python_version < '3.15'`) to a `pyproject`\n  dependency when a transitive constraint makes a version genuinely unresolvable for part\n  of the supported Python range — not as a convenience.\n\n### Gates — all three must pass before any dependency change is \"done\"\n\n```\nmake lint    # ruff check + format --check\nmake type    # pyright guardrails/\nmake test    # pytest tests/\n```\n\nRun them inside the project venv (`source .venv/bin/activate`). Never install into system\nPython; if the venv is broken, recreate it (`make refresh`).\n"},"files":{"CLAUDE.md":"# Guardrails — contributor guidance for Claude\n\n## Dependency strategy (IMPORTANT — always follow)\n\nThis repo separates **compatibility** (what users are allowed to install) from\n**security** (what we actually ship and test against). The two live in different\nfiles and must be managed differently:\n\n- **`pyproject.toml` — keep dependency ranges WIDE.** Floors and ceilings here exist\n  to express genuine compatibility boundaries (a real API break, a known-incompatible\n  major), *not* to pin security-patched versions. Do not raise a floor just to dodge a\n  CVE. Narrow ranges here propagate into every downstream project that installs\n  `guardrails-ai`, causing resolver conflicts for users.\n- **`poetry.lock` — pin the SAFE, patched versions.** Dependabot scans the lock file,\n  so the lock is where security fixes land. Within the wide `pyproject` ranges, the lock\n  should resolve to the latest patched releases.\n\n### How to apply\n\n- To fix a Dependabot/security alert: widen the `pyproject` range only as far as needed\n  to *allow* the patched version (e.g. if the fix is in a new major, raise the ceiling),\n  then update `poetry.lock` to the patched version with `poetry update <pkg>` (or a full\n  `rm poetry.lock && poetry lock` to also re-resolve non-active marker branches —\n  `poetry update` will not re-resolve marker branches like `python_version >= \"3.x\"`).\n- Prefer fixing a transitive cap at its source: if a first-party package (e.g.\n  `guardrails-api`) caps a dependency below a security fix, raise the cap in that package\n  and release it, rather than pinning around it here.\n- Only add an environment marker (e.g. `; python_version < '3.15'`) to a `pyproject`\n  dependency when a transitive constraint makes a version genuinely unresolvable for part\n  of the supported Python range — not as a convenience.\n\n### Gates — all three must pass before any dependency change is \"done\"\n\n```\nmake lint    # ruff check + format --check\nmake type    # pyright guardrails/\nmake test    # pytest tests/\n```\n\nRun them inside the project venv (`source .venv/bin/activate`). Never install into system\nPython; if the venv is broken, recreate it (`make refresh`).\n"},"items":[{"name":"CLAUDE.md","path":"CLAUDE.md","title":"CLAUDE.md","content":"# Guardrails — contributor guidance for Claude\n\n## Dependency strategy (IMPORTANT — always follow)\n\nThis repo separates **compatibility** (what users are allowed to install) from\n**security** (what we actually ship and test against). The two live in different\nfiles and must be managed differently:\n\n- **`pyproject.toml` — keep dependency ranges WIDE.** Floors and ceilings here exist\n  to express genuine compatibility boundaries (a real API break, a known-incompatible\n  major), *not* to pin security-patched versions. Do not raise a floor just to dodge a\n  CVE. Narrow ranges here propagate into every downstream project that installs\n  `guardrails-ai`, causing resolver conflicts for users.\n- **`poetry.lock` — pin the SAFE, patched versions.** Dependabot scans the lock file,\n  so the lock is where security fixes land. Within the wide `pyproject` ranges, the lock\n  should resolve to the latest patched releases.\n\n### How to apply\n\n- To fix a Dependabot/security alert: widen the `pyproject` range only as far as needed\n  to *allow* the patched version (e.g. if the fix is in a new major, raise the ceiling),\n  then update `poetry.lock` to the patched version with `poetry update <pkg>` (or a full\n  `rm poetry.lock && poetry lock` to also re-resolve non-active marker branches —\n  `poetry update` will not re-resolve marker branches like `python_version >= \"3.x\"`).\n- Prefer fixing a transitive cap at its source: if a first-party package (e.g.\n  `guardrails-api`) caps a dependency below a security fix, raise the cap in that package\n  and release it, rather than pinning around it here.\n- Only add an environment marker (e.g. `; python_version < '3.15'`) to a `pyproject`\n  dependency when a transitive constraint makes a version genuinely unresolvable for part\n  of the supported Python range — not as a convenience.\n\n### Gates — all three must pass before any dependency change is \"done\"\n\n```\nmake lint    # ruff check + format --check\nmake type    # pyright guardrails/\nmake test    # pytest tests/\n```\n\nRun them inside the project venv (`source .venv/bin/activate`). Never install into system\nPython; if the venv is broken, recreate it (`make refresh`).\n","category":"root","tokens":542}]}