Bump python dependencies - #426
Conversation
Consolidated update of python-wrapper dependencies via `uv lock --upgrade`, plus bumps to exact-pinned dev tools: ruff 0.15.17->0.16.3, mypy 2.1.0->2.3.0, pytest 9.0.3->9.1.1, selenium 4.44.0->4.47.0. streamlit (floor pin) and sphinx (capped for py3.10/enum_tools compat) are intentionally left as-is. Also switch the dependabot python-wrapper ecosystem from `pip` to `uv` so it keeps uv.lock in sync going forward, and set open-pull-requests-limit to 10. Supersedes dependabot PRs #421 #420 #415 #408 #405 #402 #401 #400 #390 #386 #385 #381 #380 #378 #377 #362 #356. Co-Authored-By: Claude <noreply@anthropic.com>
| - package-ecosystem: "uv" | ||
| directory: "/python-wrapper" | ||
| schedule: | ||
| interval: "weekly" | ||
| open-pull-requests-limit: 10 | ||
| groups: | ||
| python-patch-and-minor: | ||
| update-types: |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a cooldown block with default-days: 3 to each package-ecosystem entry under updates to wait 3 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown
To resolve this comment:
✨ Commit fix suggestion
- Add a
cooldownblock to thisuventry underpackage-ecosystem. - Set the cooldown to at least 3 days by adding
default-days: 3. - Place it alongside the other top-level keys for that update entry, for example after
package-ecosystem:
cooldown:
default-days: 3 - Keep the value numeric, not quoted, so Dependabot reads it correctly as
3.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by dependabot-missing-cooldown-copy.
To get more information about secure coding and some most popular vulnerabilities, check our secure coding guidelines
You can view more details about this finding in the Semgrep AppSec Platform.
Consolidated update of python-wrapper dependencies via
uv lock --upgrade,plus bumps to exact-pinned dev tools: ruff 0.15.17->0.16.3, mypy 2.1.0->2.3.0,
pytest 9.0.3->9.1.1, selenium 4.44.0->4.47.0. streamlit (floor pin) and sphinx
(capped for py3.10/enum_tools compat) are intentionally left as-is.
Also switch the dependabot python-wrapper ecosystem from
piptouvso itkeeps uv.lock in sync going forward, and set open-pull-requests-limit to 10.
Supersedes dependabot PRs #421 #420 #415 #408 #405 #402 #401 #400 #390 #386
#385 #381 #380 #378 #377 #362 #356.
Co-Authored-By: Claude noreply@anthropic.com