Repository navigation
build(deps): bump hatchling 1.32.4, rfc3161-client 1.0.9, msgpack 1.2.3, platformdirs 4.12.2 - #966
Merged
Merged
Conversation
Bumps [rfc3161-client](https://github.com/trailofbits/rfc3161-client) from 1.0.8 to 1.0.9. - [Release notes](https://github.com/trailofbits/rfc3161-client/releases) - [Changelog](https://github.com/trailofbits/rfc3161-client/blob/main/CHANGELOG.md) - [Commits](trailofbits/rfc3161-client@v1.0.8...v1.0.9) --- updated-dependencies: - dependency-name: rfc3161-client dependency-version: 1.0.9 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> (cherry picked from commit 0c2e340)
Bumps [msgpack](https://github.com/msgpack/msgpack-python) from 1.2.2 to 1.2.3. - [Release notes](https://github.com/msgpack/msgpack-python/releases) - [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md) - [Commits](msgpack/msgpack-python@v1.2.2...v1.2.3) --- updated-dependencies: - dependency-name: msgpack dependency-version: 1.2.3 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> (cherry picked from commit 072cd99)
Bumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.11.11 to 4.12.2. - [Release notes](https://github.com/tox-dev/platformdirs/releases) - [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst) - [Commits](tox-dev/platformdirs@4.11.11...4.12.2) --- updated-dependencies: - dependency-name: platformdirs dependency-version: 4.12.2 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> (cherry picked from commit 8efacb4)
Dependabot's #953 moved the version string without the lock behind it: * constraints/build-backend.txt pinned hatchling==1.32.4 while keeping 1.32.0's two --hash digests, so every hash-checked install failed (all suite and MCP jobs failed in ~20 s at install time). * Its regeneration of constraints/release-seal.txt dropped the PyPy markers on cffi and pycparser, dropped Windows-only colorama, and rewrote `pydantic==2.13.5` as `pydantic[email]==2.13.5`, which scripts/verify_dependency_lock.py cannot parse. This bumps the three declaration sources (pyproject.toml's build-system floor, constraints/release-build.txt, constraints/release-seal.in) and changes only the hatchling pin, its hashes and its `declares:` line in the two locks hatchling feeds. Each lock body is byte-identical to a pinned uv 0.12.9 `uv pip compile --universal --generate-hashes` run that keeps the existing pins as preferences, so no unrelated pin moves. Both digests match PyPI, and requires_dist is unchanged between 1.32.0 and 1.32.4, so the closure does not widen. 1.32.3/1.32.4 only change CalVer version preservation and revert a BuildHookInterface type parameter; neither affects this project's metadata or hatch_build.py. Bumping the backend changes the wheel's `Generator:` stamp, so a wheel qualified before this change will not match a rebuild after it (see constraints/release-build.txt). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
rfc3161-client 1.0.9 fixes GHSA-87gx-4x38-2j9q (high): its Verifier trusted certificates embedded in a timestamp token, so a token under an unrelated self-signed root verified against any configured root. constraints/dev.txt already moves to 1.0.9 (#954), but the sealing and publication toolchains, which run `sigstore sign` / `sigstore verify`, still pinned 1.0.8. sigstore 4.5.0 admits it (`>=1.0.3,<1.1.0`). Both lock bodies are byte-identical to a pinned uv 0.12.9 compile that keeps every other existing pin as a preference (`-P rfc3161-client`); the hashes equal dev.txt's, which equal PyPI's. Also refresh the ci.yml comment that still quoted the old hatchling floor. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Applies four open Dependabot bumps (#953, #954, #955, #956) in one change, so they share one CI run under the strict up-to-date rule. It also carries the rfc3161-client security fix into the release toolchains.
constraints/dev.txtonly). Each is a transitive dev pin within its parents' caps:sigstore 4.5.0requiresrfc3161-client>=1.0.3,<1.1.0andplatformdirs~=4.2, andcachecontrol 0.14.4requiresmsgpack>=0.5.2,<2.requires_distis unchanged for every bumped version, so no closure widens.constraints/build-backend.txtpinned 1.32.4 with 1.32.0's hashes, which is why every suite and MCP job failed at install in about 20 s. Its regeneration ofconstraints/release-seal.txtalso dropped the PyPy markers oncffiandpycparser, dropped Windows-onlycolorama, and wrotepydantic[email]==2.13.5, whichscripts/verify_dependency_lock.pycannot parse. This version bumps the three declaration sources: thepyproject.tomlbuild-system floor,constraints/release-build.txtandconstraints/release-seal.in. In the two locks it changes only the hatchling pin, its hashes and itsdeclares:line.rfc3161-client1.0.9 also moves inconstraints/release-seal.txtandconstraints/release-publish.txt. It fixes GHSA-87gx-4x38-2j9q (high): the verifier trusted certificates embedded in a timestamp token. These are the toolchains that runsigstore signandsigstore verifyduring release.Every lock body here is byte-identical to a pinned uv 0.12.9
uv pip compile --universal --generate-hashesrun that keeps the existing pins as preferences, so no unrelated pin moves. All hashes match PyPI. hatchling 1.32.3 and 1.32.4 only change CalVer version preservation and revert aBuildHookInterfacetype parameter.hatch_build.pysubclasses the interface unsubscripted, so neither change affects this project. A hatchling bump does change the wheel'sGenerator:stamp, so the next release must be qualified after this change, not before.Validation:
scripts/verify_dependency_lock.pypasses for all four locks. Locally,tests/test_release_pipeline.py,tests/test_release_engine_smoke.pyandtests/test_wheel_candidate_build.pypass. An independent review re-derived every lock with uv 0.12.9 and checked every hash against PyPI.Supersedes Dependabot PRs #953, #954, #955 and #956, which will be closed by hand after merge. #957 (the
claude-agent-sdkharness floor) is not included.harness/requirements.txtasks for a smoke run and a paid Sonnet cell before that floor moves.🤖 Generated with Claude Code