Dependency sweep blocked: package feed blob storage unreachable

[Copilot]

Description

Automated dependency sweep to bump all workspace dependencies to their latest versions via the update-deps skill. No changes were made — the sweep is blocked by a sandbox firewall restriction that prevents package downloads.

Related Issues

Automated dependency update sweep.

Proposed Changes

No dependency or lockfile changes could be produced. Investigation findings:

• Feed proxy metadata reachable, downloads blocked. packagefeedproxy.microsoft.io serves the simple index (HTTP 200) but 303-redirects every wheel/sdist download to *.vsblob.vsassets.io, which fails DNS resolution (No address associated with hostname).
• No metadata sidecars. The proxy does not publish PEP 658 data-core-metadata; the .metadata URL 404s, so uv must download full wheels to resolve — which the block prevents.
• Result: uv lock --upgrade fails fetching metadata for any new version (e.g. pandas 3.0.5); uv sync --all-packages fails downloading already-locked deps. Checks/tests cannot run without an installed environment. uv.lock left untouched (no hand-edits, no index overrides).

Unblock: allowlist *.vsblob.vsassets.io (blob CDN backing the MS feed proxy; regional subdomains vary, wildcard required). *.pkgs.visualstudio.com already resolves.

Checklist

• I have tested these changes locally.
• I have reviewed the code changes.
• I have updated the documentation (if necessary).
• I have added appropriate unit tests (if applicable).

Additional Notes

Once *.vsblob.vsassets.io is reachable, the standard sweep can complete: bump specifiers in the root dev group and packages/*/pyproject.toml, uv lock --upgrade, uv sync --all-packages, repair fallout, add a semversioner changelog entry, and verify uv run poe check + uv run poe test_unit.

• Fixes Update Dependencies Sweep #2513