chore(deps): Update weight-custody-manifest requirement from <0.25.0,>=0.23.0 to >=0.25.0,<0.26.0

[dependabot]

Updates the requirements on weight-custody-manifest to permit the latest version.

Commits

• See full diff in compare view

[imran-siddique]

Holding this one, and it is not a flake. Diagnosed to the bottom:

weight-custody-manifest 0.25.0 requires cryptography>=50,<51. cmcp-runtime 0.4.0 requires agent-governance-toolkit-core>=4.1.0,<5.0, and every agt-core in that range caps cryptography<49.0. The two cannot both be satisfied.

Because cmcp-runtime had no floor in requirements.txt, pip did not report that. It backtracked to cmcp-runtime 0.1.0, the only release with no agt-core dependency, installed it and cryptography 50.0.0 with exit code 0, and the job then failed at Demo 1 - cMCP in action with cMCP Runtime exited with code 1 before listening on :8443. That reads as a gateway bug and is a silent three-version downgrade.

#53 has landed, adding cmcp-runtime>=0.4.0 so this class of failure is a resolver error at install time rather than a crash at startup, and holding weight-custody-manifest<0.25.0 until the cap moves.

Widening cmcp-runtime's agt-core range would not help: agt-core 5.0.0 only moves the cap to cryptography<50.0, which still excludes the >=50 that wcm 0.25.0 needs. The durable fix is upstream, in agt-core allowing cryptography 50, tracked in agentrust-io/cmcp#471.

Leaving this open. It becomes mergeable, and the ceiling in #53 comes off, once that lands.