build(deps-dev): bump skylos from 3.2.0 to 4.3.1

[dependabot]

Bumps skylos from 3.2.0 to 4.3.1.

Release notes

Sourced from skylos's releases.

v4.3.1

4.3.1 (2026-04-08)

Bug Fixes

• upload: support large scan uploads via artifact transport (#179) (7f1641f)

v4.3.0

4.3.0 (2026-04-08)

Features

• cli: add explicit project selection flow (#171) (3eb3001)

Bug Fixes

• core: honor root ignores and actionable clean edits (#165) (358dd1f)
• release: align release-please bootstrap with 4.2.1 (8fb330f)
• summary: include Java in language analysis summary (#175) (433c0e8)
• ts: align Next.js convention coverage (#164) (05264b2)

Internal cleanup

• narrow refactors across logic-rule helpers, verification output/finalization, AST compatibility, server rendering, API normalization, CLI parser wiring, and defend output handling

v4.2.1: Faster agent review, repo-aware context, and benchmark guards

Changed

• skylos agent scan now defaults to the fast review path. Slow dead-code verification is opt-in via --verify-dead-code
• Agent review is more repo-aware, with better file selection and context for quality, security, and debt-style issues
• Added agent benchmarks and Codex comparison runs with token reporting

Fixed

• Agent scans now fail cleanly on missing API keys instead of crashing
• Review output is clearer when dead-code verification is still running
• LLM provider and runtime settings now propagate correctly through the agent path

v4.2.0: Technical debt hotspots and CLI architecture cleanup

Added

• skylos debt <path> for technical debt hotspot analysis
• separate structural debt scoring and hotspot priority_score

Changed

• CLI entrypoint cleanup by extracting command handlers into dedicated modules
• CLI helper extraction and rules command extraction
• agent ranking and payload helpers extracted out of agent_center.py

... (truncated)

Changelog

Sourced from skylos's changelog.

4.3.1 (2026-04-08)

Bug Fixes

• upload: support large scan uploads via artifact transport (#179) (7f1641f)

4.3.0 (2026-04-08)

Features

• cli: add explicit project selection flow (#171) (3eb3001)

Bug Fixes

• core: honor root ignores and actionable clean edits (#165) (358dd1f)
• release: align release-please bootstrap with 4.2.1 (8fb330f)
• summary: include Java in language analysis summary (#175) (433c0e8)
• ts: align Next.js convention coverage (#164) (05264b2)

[Unreleased]

Added

• Added a Simplified Chinese README (README_CN.md)
• Added configurable web UI port support for skylos run via --port or SKYLOS_PORT

Changed

• SKY-L030: Lint rule for except Exception/except BaseException with trivial handler (CWE-396)
• Continue CLI cleanup by extracting command boundaries, lazy-loading heavy analysis paths.Expanded regression guardrails around dispatch, output, and exit-code behavior

Fixed

• Browser login callback now validates state and verifies the returned token metadata via whoami
• Fixed local web UI rendering to avoid unsafe HTML insertion patterns
• Sync credentials are written with stricter file and dir permissions

[4.2.1] - 2026-04-03

Changed

• skylos agent scan now defaults to the fast review path. Slow dead-code verification is opt-in via --verify-dead-code
• Agent review is more repo-aware, with better file selection and context for quality, security, and debt-style issues
• Added agent benchmarks and Codex comparison runs with token reporting

Fixed

• Agent scans now fail cleanly on missing API keys instead of crashing
• Review output is clearer when dead-code verification is still running
• LLM provider and runtime settings now propagate correctly through the agent path

[4.2.0] - 2026-03-30

... (truncated)

Commits

• 05133d1 chore(main): release 4.3.1 (#180)
• 7f1641f fix(upload): support large scan uploads via artifact transport (#179)
• 731a59d chore(main): release 4.3.0 (#156)
• 0737ab8 test(cli): make doctor version guardrail release-safe (#178)
• 43c457d refactor(logic): split narrow rule checks into helpers (#176)
• 433c0e8 fix(summary): include Java in language analysis summary (#175)
• 6711f55 refactor(ast): remove deprecated string-node fallbacks (#172)
• 3eb3001 feat(cli): add explicit project selection flow (#171)
• 983ea72 refactor(verify): extract output and feedback finalization (#170)
• 73abc30 refactor(api): normalize result section mappings (#169)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Assignees

The following users could not be added as assignees: peaky76. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Superseded by #378.