Repository navigation
ci(deps): Dependabot ignores the WeasyPrint 70 and Stripe 16 majors until their ports - #205
Merged
Merged
Conversation
…ntil their ports Both majors need code changes first: WeasyPrint 70 reworks the url_fetcher interface the SSRF guard relies on, and stripe 16 pins an API version that rejects payment_method_types on Checkout session creation. Excluded from the python-all group, they arrived as standalone PRs (#191, #204) that could only sit red. Like the existing cyclonedx-bom and pikepdf caps, they are now `ignore`d by version range (>=70, >=16); Dependabot raises floors below a cap and keeps the cap (seen with b75b56c on pikepdf/cyclonedx-bom). Patch and minor releases below the caps now come in the weekly batch. New guard test_dependabot_ignores_sit_on_live_caps: every pip ignore range must match a cap in requirements*.txt, so a port that lifts a cap but forgets the ignore fails CI instead of freezing the package silently (mutation- checked). requirements.txt's cap comments say so too. Two earlier unreleased fragments and the dependabot.yml header are corrected for the new behaviour. Dependabot security updates and alerts are off on this repo, so the ignores suppress nothing security-wise; pip-audit on requirements.lock stays the CVE gate. Verified: full suite 1734 passed / 123 skipped; ruff clean; gitleaks and the pre-commit scope guard clean. Code review done, findings applied. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
WeasyPrint 70 and Stripe 16 both need code changes first: the SSRF
url_fetcherguard, and the Checkoutpayment_method_typescall. Dependabot opened each of them as its own PR (#191, #204), and those could only sit red until someone ported the code.ignoreby version range (weasyprint >=70,stripe >=16), like the existing caps on pikepdf and the SBOM generator. Patch and minor releases below the caps come in the weeklypython-allbatch.test_dependabot_ignores_sit_on_live_capsfails if an ignore outlives its cap, so the port can't forget it and freeze the package silently. Mutation-checked.requirements.txt, thedependabot.ymlheader, and two earlier unreleased fragments are updated for the new behaviour.pip-auditonrequirements.lockremains the CVE gate.After merge, #191 and #204 are closed with a pointer to their port tasks.
Verified: full suite 1734 passed / 123 skipped; ruff clean; gitleaks and the scope guard clean; code review done.
🤖 Generated with Claude Code