chore: bump dependencies via zaojun #27
marvin8
Loading…
Reference in a new issue
No description provided.
Delete branch "chore/stage2-migration"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Stage-2 migration cleanup for taibai.
The codeberg.org → forge.marvin8.zone source references, docs links, CI
runners, and git remotes were already migrated in a prior change. This PR
finishes the remaining stage-2 dependency work.
Changes:
--format json), applying the~=minimum(aged_version for
too_new, latest for compatible/incompatible updates):cyclopts 4.22.3→4.22.5, longwei 2.0.3→2.1.0, platformdirs 4.11.0→4.11.2,
bump-my-version 1.5.0→1.5.1, complexipy 6.2.0→7.0.0, prek 0.4.11→0.4.13,
ruff 0.16.1→0.16.2, ty 0.0.65→0.0.70, uv 0.12.1→0.12.3.
versions.
uv.lockandpylock.toml.Kept as-is (per the migration tracker):
codeberg.org/git-pages/action@v2) — a separateservice, not tied to Codeberg Pages.
Verification (all green):
ruff check .— passedruff format --check src/ tests/— 50 files formattedty check .— passedcomplexipy .— passednox -s pytest— 5/5 sessions green (373 tests each, coverage >= 90%)nox -s pysentry— 0 vulnerabilities foundWuMing
Found 4 issue(s). See inline comments below.
@ -12,3 +12,3 @@- repo: https://github.com/astral-sh/ruff-pre-commitrev: v0.16.1rev: v0.16.2security [LOW]
A08: Pre-commit hook is pinned to a mutable Git tag rather than an immutable commit SHA. If the upstream tag is moved, CI could execute unaudited code. Pin rev to the full commit hash.
@ -22,3 +22,3 @@- repo: https://github.com/astral-sh/ty-pre-commitrev: v0.0.65rev: v0.0.70security [LOW]
A08: Pre-commit hook is pinned to a mutable Git tag rather than an immutable commit SHA. If the upstream tag is moved, CI could execute unaudited code. Pin rev to the full commit hash.
@ -27,3 +27,3 @@- repo: https://github.com/astral-sh/uv-pre-commitrev: 0.12.1rev: 0.12.3security [LOW]
A08: Pre-commit hook is pinned to a mutable Git tag rather than an immutable commit SHA. If the upstream tag is moved, CI could execute unaudited code. Pin rev to the full commit hash.
@ -34,3 +34,3 @@- repo: https://github.com/rohaquinlop/complexipy-pre-commitrev: v6.2.0rev: v7.0.0security [LOW]
A08: Pre-commit hook is pinned to a mutable Git tag rather than an immutable commit SHA. If the upstream tag is moved, CI could execute unaudited code. Pin rev to the full commit hash.
🔴 Not actioned — pre-commit revs pinned to version tags by convention
.pre-commit-config.yamlline 14 ·.pre-commit-config.yamlline 24 ·.pre-commit-config.yamlline 29 ·.pre-commit-config.yamlline 36Declining these four findings. The project intentionally pins pre-commit
rev:entries to version tags that match the~=version inpyproject.toml— this is a hard constraint in the global AGENTS.md, which requires aligning the pre-commitrev:to the same version tag as the dependency bump. The entire existing.pre-commit-config.yamlalready uses tag revs (pre-commit-hooks v6.0.0, gitleaks v8.30.1, zaojun 1.7.1), so converting only these four changed lines to commit SHAs would introduce an inconsistent mixed convention. These are LOW-severity findings reflecting an established, deliberate convention rather than a defect.WuMing
Found 2 issue(s). See inline comments below.
@ -12,3 +11,1 @@run: |curl -LsSf https://astral.sh/uv/install.sh | shecho "$HOME/.local/bin" >> $GITHUB_PATH- uses: astral-sh/setup-uv@v5config [LOW]
setup-uv@v5 is used without a
versioninput, so it installs the latest uv release instead of the project-pinneduv~=0.12.3. Addwith: { version: '0.12.3' }to keep the workflow reproducible and consistent with the lockfile and pre-commit hook.security [MEDIUM]
The action is pinned to a mutable tag 'v5' rather than a full commit SHA. In a CI/CD pipeline this allows a compromised or changed tag to execute arbitrary code with pipeline secrets. Pin the action to a full-length commit SHA and add the human-readable version as a comment (A08).
🔴 Not actioned —
setup-uv@v5is the documented standard.forgejo/workflows/weekly-checks.ymlline 11 ·.forgejo/workflows/weekly-checks.ymlline 11uses: astral-sh/setup-uv@v5is the documented standard for this project — it is the exact form prescribed in AGENTS.md as the approved replacement forcurl | sh, and is used identically (noversioninput, tag-pinned) in every other repo'sci.yml. Adding aversioninput here would makeweekly-checks.ymlinconsistent with the project's ownci.yml, and pinning the action to a commit SHA is the same A08 class already declined for the pre-commit tags — the tag convention is deliberate.