Skip to content

Dependencies: lock refresh + pre-commit from dependabot - #1499

Merged
TonyXiang8787 merged 11 commits into
mainfrom
pgm/feature/dependabot-on-specific-day
Aug 3, 2026
Merged

Dependencies: lock refresh + pre-commit from dependabot#1499
TonyXiang8787 merged 11 commits into
mainfrom
pgm/feature/dependabot-on-specific-day

Conversation

@mgovers

@mgovers mgovers commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Member
  • Using Dependabot to update python packages has many benefits for both security and dev experience.
  • Dependabot now groups dependency bumps into a single PR where possible
  • Rather than depend on external pre-commit hooks, we can also use the already installed dependencies in the environment. This enables configuring everything exactly as intended.

Stil TBD: what to do with the (p)npm dependencies markdownlint-cli and biome? (see #1502 and #1501 )

@mgovers
experiment with dependabot + precommit
4507b61 
Signed-off-by: Martijn Govers <Martijn.Govers@Alliander.com>
@mgovers mgovers self-assigned this Jul 27, 2026
@mgovers mgovers added dependencies Pull requests that update a dependency file improvement Improvement on internal implementation github_actions Pull requests that update GitHub Actions code labels Jul 27, 2026
power-grid-model-ci-bot Bot and others added 4 commits July 27, 2026 12:54
@power-grid-model-ci-bot
Refresh lock and linter dependencies
9d8ebce 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@mgovers
Refresh lock and linter dependencies
12fedb5 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Apply suggestion from @mgovers

Signed-off-by: Martijn Govers <Martijn.Govers@Alliander.com>
@mgovers
Merge pull request #1500 from PowerGridModel/dependencies/refresh-loc…
bd8b537 
…k-and-linter

Refresh lock and linter dependencies
@mgovers
Merge branch 'main' into pgm/feature/dependabot-on-specific-day
c7d6eae 
Signed-off-by: Martijn Govers <martijn.govers@alliander.com>
mgovers
mgovers commented Jul 27, 2026
View reviewed changes
Comment thread .github/dependabot.yml Outdated
This was referenced Jul 28, 2026
Open
Open
mgovers
mgovers commented Jul 28, 2026
View reviewed changes
Comment thread pyproject.toml
mgovers added 2 commits July 29, 2026 08:13
@mgovers
uv tool exclude newer
c2da57e 
Signed-off-by: Martijn Govers <Martijn.Govers@Alliander.com>
@mgovers
uv sync locked and frozen in correct places
60bfca1 
Signed-off-by: Martijn Govers <Martijn.Govers@Alliander.com>
@mgovers
mgovers force-pushed the pgm/feature/dependabot-on-specific-day branch from 92d5c27 to 60bfca1 Compare July 29, 2026 06:35
mgovers
mgovers commented Jul 29, 2026
View reviewed changes
Comment thread .pre-commit-config.yaml
power-grid-model-ci-bot Bot and others added 2 commits July 29, 2026 08:42
@power-grid-model-ci-bot
Refresh lock and linter dependencies
ab62582 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@mgovers
Merge pull request #1510 from PowerGridModel/dependencies/refresh-loc…
18f8d1d 
…k-and-linter

Refresh lock and linter dependencies
@mgovers mgovers mentioned this pull request Jul 29, 2026
Closed
@mgovers
mgovers marked this pull request as ready for review July 29, 2026 08:51
figueroa1395
figueroa1395 reviewed Jul 29, 2026
View reviewed changes
Comment thread .github/workflows/check-code-quality.yml
Comment thread .github/workflows/sonar.yml
Comment thread .pre-commit-config.yaml
Comment thread package-lock.json
Comment thread pyproject.toml
Comment thread pyproject.toml
Comment thread pyproject.toml
mgovers
mgovers commented Jul 30, 2026
View reviewed changes
Comment thread .github/dependabot.yml Outdated
mgovers
mgovers commented Jul 30, 2026
View reviewed changes
Comment thread .github/dependabot.yml Outdated
mgovers
mgovers commented Jul 30, 2026
View reviewed changes
Comment thread .pre-commit-config.yaml
@mgovers mgovers mentioned this pull request Jul 31, 2026
Merged
mgovers and others added 2 commits July 31, 2026 10:09
@mgovers
update dependabot cron
3d50b22 
Signed-off-by: Martijn Govers <Martijn.Govers@Alliander.com>
@mgovers
Merge branch 'main' into pgm/feature/dependabot-on-specific-day
e5a945b
@sonarqubecloud

sonarqubecloud Bot commented Jul 31, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@mgovers
mgovers enabled auto-merge July 31, 2026 09:47
@mgovers
mgovers added this pull request to the merge queue Aug 3, 2026
@TonyXiang8787
TonyXiang8787 removed this pull request from the merge queue due to a manual request Aug 3, 2026
TonyXiang8787
TonyXiang8787 reviewed Aug 3, 2026
View reviewed changes
Comment thread .github/dependabot.yml
@TonyXiang8787
TonyXiang8787 added this pull request to the merge queue Aug 3, 2026
Merged via the queue into main with commit e432a2e Aug 3, 2026
34 checks passed
@TonyXiang8787
TonyXiang8787 deleted the pgm/feature/dependabot-on-specific-day branch August 3, 2026 10:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@TonyXiang8787 TonyXiang8787 TonyXiang8787 approved these changes
@figueroa1395 figueroa1395 figueroa1395 left review comments

Assignees

@mgovers mgovers

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code improvement Improvement on internal implementation

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@mgovers @TonyXiang8787 @figueroa1395