build(deps-dev): bump filelock from 3.29.0 to 3.29.1#204
build(deps-dev): bump filelock from 3.29.0 to 3.29.1#204dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.29.0 to 3.29.1. - [Release notes](https://github.com/tox-dev/py-filelock/releases) - [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst) - [Commits](tox-dev/filelock@3.29.0...3.29.1) --- updated-dependencies: - dependency-name: filelock dependency-version: 3.29.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
iterwheel-clearance
Bot
added
the
clearance-3-ready-for-approval
Clearance🚦 Stage: 2 - Blocked ( Next: resolve the blocking review state, then rerun Clearance. Details
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c666bef091
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| filelock==3.29.0 \ | ||
| --hash=sha256:69974355e960702e789734cb4871f884ea6fe50bd8404051a3530bc07809cf90 \ | ||
| --hash=sha256:96f5f6344709aa1572bbf631c640e4ebeeb519e08da902c39a001882f30ac258 | ||
| filelock==3.29.1 \ |
There was a problem hiding this comment.
This bumps only the pip fallback, but the normal CI/developer path still installs with make setup, which runs uv sync --locked --dev when uv is available (Makefile:6-10), so it continues resolving filelock from uv.lock where the package is still pinned to 3.29.0. In uv-enabled environments this Dependabot update is therefore not actually applied, while no-uv fallback environments get 3.29.1; please regenerate and commit uv.lock together with requirements-dev.txt so the locked dependency set stays consistent.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
👀 Clearance: still open
🧭 Check: Clearance deterministic verifier
📍 Location: requirements-dev.txt:203
🔖 Head: c666bef09136
💡 Why: no author response and no code change (SWM-1101 step 5)
⏳ Action: left open
Evidence
- Verdict:
OPEN - Rule: SWM-1101 step 4-5
- Thread state:
A - Clearance thread state 'A'.
iterwheel-clearance
Bot
added
clearance-2-blocked
Bumps filelock from 3.29.0 to 3.29.1.
Release notes
Sourced from filelock's releases.
Changelog
Sourced from filelock's changelog.
... (truncated)
Commits
438b6feRelease 3.29.1bfbfa76🐛 fix(soft): refuse to follow symlinks when reading the lock file (#548)c51a72c[pre-commit.ci] pre-commit autoupdate (#547)cc05fd7[pre-commit.ci] pre-commit autoupdate (#546)cb947e5chore: improve filelock maintenance path (#545)e087ca9chore: improve filelock maintenance path (#544)f9dd949chore: improve filelock maintenance path (#542)9200f1fdocs: clarify per-thread scope of FileLock configuration (#543)9d8985f[pre-commit.ci] pre-commit autoupdate (#541)7d1f48cdocs: fix API docs ofrelease()(#540)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)