Skip to content

Bump python dependencies - #426

Merged
FlorentinD merged 2 commits into
mainfrom
deps/bump-python-dependencies
Aug 14, 2026
Merged

Bump python dependencies#426
FlorentinD merged 2 commits into
mainfrom
deps/bump-python-dependencies

Conversation

@FlorentinD

Copy link
Copy Markdown
Collaborator

Consolidated update of python-wrapper dependencies via uv lock --upgrade,
plus bumps to exact-pinned dev tools: ruff 0.15.17->0.16.3, mypy 2.1.0->2.3.0,
pytest 9.0.3->9.1.1, selenium 4.44.0->4.47.0. streamlit (floor pin) and sphinx
(capped for py3.10/enum_tools compat) are intentionally left as-is.

Also switch the dependabot python-wrapper ecosystem from pip to uv so it
keeps uv.lock in sync going forward, and set open-pull-requests-limit to 10.

Supersedes dependabot PRs #421 #420 #415 #408 #405 #402 #401 #400 #390 #386
#385 #381 #380 #378 #377 #362 #356.

Co-Authored-By: Claude noreply@anthropic.com

Consolidated update of python-wrapper dependencies via `uv lock --upgrade`,
plus bumps to exact-pinned dev tools: ruff 0.15.17->0.16.3, mypy 2.1.0->2.3.0,
pytest 9.0.3->9.1.1, selenium 4.44.0->4.47.0. streamlit (floor pin) and sphinx
(capped for py3.10/enum_tools compat) are intentionally left as-is.

Also switch the dependabot python-wrapper ecosystem from `pip` to `uv` so it
keeps uv.lock in sync going forward, and set open-pull-requests-limit to 10.

Supersedes dependabot PRs #421 #420 #415 #408 #405 #402 #401 #400 #390 #386
#385 #381 #380 #378 #377 #362 #356.

Co-Authored-By: Claude <noreply@anthropic.com>
@FlorentinD
FlorentinD requested a review from a team as a code owner August 14, 2026 09:07
@FlorentinD
FlorentinD enabled auto-merge August 14, 2026 09:07
Comment thread .github/dependabot.yml
Comment on lines +8 to 15
- package-ecosystem: "uv"
directory: "/python-wrapper"
schedule:
interval: "weekly"
open-pull-requests-limit: 10
groups:
python-patch-and-minor:
update-types:

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:
This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a cooldown block with default-days: 3 to each package-ecosystem entry under updates to wait 3 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown

To resolve this comment:

✨ Commit fix suggestion
  1. Add a cooldown block to this uv entry under package-ecosystem.
  2. Set the cooldown to at least 3 days by adding default-days: 3.
  3. Place it alongside the other top-level keys for that update entry, for example after package-ecosystem:
    cooldown:
    default-days: 3
  4. Keep the value numeric, not quoted, so Dependabot reads it correctly as 3.
💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by dependabot-missing-cooldown-copy.

To get more information about secure coding and some most popular vulnerabilities, check our secure coding guidelines

You can view more details about this finding in the Semgrep AppSec Platform.

@FlorentinD
FlorentinD disabled auto-merge August 14, 2026 09:29
@FlorentinD
FlorentinD merged commit 5781b4e into main Aug 14, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant