From b4578d8b0584963305b86d36a93e3f3f4bf3b10f Mon Sep 17 00:00:00 2001 From: Richard Hope Date: Sat, 4 Jul 2026 10:41:13 +1000 Subject: [PATCH] Keep incidental fixture pins alert-free The dependency-review fixture's planted defect is the git-fork left-pad dependency; the requests pin is incidental context, but its old version raised four Dependabot alerts on the default branch (the dependency graph indexes fixture manifests regardless of dependabot config). Pin the clean version so the alerts resolve; the eval is unaffected. Co-Authored-By: Claude Fable 5 --- evals/fixtures/dependency-review/base/requirements.txt | 2 +- evals/fixtures/dependency-review/change/requirements.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/evals/fixtures/dependency-review/base/requirements.txt b/evals/fixtures/dependency-review/base/requirements.txt index 33650e4..ba286ea 100644 --- a/evals/fixtures/dependency-review/base/requirements.txt +++ b/evals/fixtures/dependency-review/base/requirements.txt @@ -1,2 +1,2 @@ click==8.1.7 -requests==2.32.3 +requests==2.33.0 diff --git a/evals/fixtures/dependency-review/change/requirements.txt b/evals/fixtures/dependency-review/change/requirements.txt index ef08fc3..f0f219f 100644 --- a/evals/fixtures/dependency-review/change/requirements.txt +++ b/evals/fixtures/dependency-review/change/requirements.txt @@ -1,3 +1,3 @@ click==8.1.7 -requests==2.32.3 +requests==2.33.0 left-pad @ git+https://github.com/someuser/left-pad@main