Skip to content

fix(deps): bump urllib3 to 2.8.0 in requirements-qt #152

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rldyourmnd merged 2 commits into from
Oct 4, 2026
Merged

fix(deps): bump urllib3 to 2.8.0 in requirements-qt #152

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6b35da3
fix(deps): bump urllib3 to 2.8.0 in requirements-qt
rldyourmnd Oct 4, 2026
0d3295f
fix(ci): refresh qt lock sha256 for the regenerated lockfile
rldyourmnd Oct 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/qt-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,7 @@ jobs:
env:
CALLEE_REPOSITORY: ${{ job.workflow_repository }}
CALLEE_SHA: ${{ job.workflow_sha }}
LOCK_SHA256: e8fd018f0ce1d2f8f23d1fe9ce674e384e98e3fc1ac34386e2fa769fede16185
LOCK_SHA256: 4ee004df4493864cc2af167273833df756dac83bd4163f5a5e38de46c85b02bc
PYTHON_VERSION: '3.13'
run: |
set -euo pipefail
Expand Down
3 changes: 3 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@ The project follows Semantic Versioning.

## [Unreleased]

- **Bump urllib3 to 2.8.0 in `requirements-qt.txt`** (recompiled via
`uv pip compile --upgrade-package urllib3`): the osv-scan runtime fixture
flagged PYSEC-2026-4176 and PYSEC-2026-4177 on the pinned 2.7.0.
- **Fix the dependabot-catalog-convergence update-branch guard.** A bound
pull request already current with the base made the API answer
`no new commits`, which matched neither the success pattern nor a real
Expand Down
4 changes: 2 additions & 2 deletions catalog/tools.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ tools:
rather than resolved at run time. Pinning the two top-level names left
everything they pull unbounded.
lock: requirements-qt.txt
lock_sha256: "e8fd018f0ce1d2f8f23d1fe9ce674e384e98e3fc1ac34386e2fa769fede16185"
lock_sha256: "4ee004df4493864cc2af167273833df756dac83bd4163f5a5e38de46c85b02bc"
- id: py7zr
name: py7zr
homepage: https://github.com/miurahr/py7zr
Expand All @@ -30,7 +30,7 @@ tools:
last_verified: "2026-09-21"
notes: aqtinstall's archive backend; locked in the same closure.
lock: requirements-qt.txt
lock_sha256: "e8fd018f0ce1d2f8f23d1fe9ce674e384e98e3fc1ac34386e2fa769fede16185"
lock_sha256: "4ee004df4493864cc2af167273833df756dac83bd4163f5a5e38de46c85b02bc"
- id: actionlint
name: actionlint
homepage: "https://github.com/rhysd/actionlint"
Expand Down
10 changes: 4 additions & 6 deletions requirements-qt.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,5 @@
# GENERATED by `uv pip compile --generate-hashes --universal --python-version 3.13 -o requirements-qt.txt requirements-qt.in`
# Do not hand-edit. See requirements-qt.in for why this file exists.
# This file was autogenerated by uv via the following command:
# uv pip compile --generate-hashes --universal --python-version 3.13 -o /tmp/qt2.txt requirements-qt.in
# uv pip compile --generate-hashes --universal --python-version 3.13 -o requirements-qt.txt requirements-qt.in
aqtinstall==3.3.0 \
--hash=sha256:9c7d85fbe7258be2d7d23fda33f8aff2e8b7536817255eaeaaf4226da8546a31 \
--hash=sha256:e88dbd87226f276fdd5d05347a44578d390d93a7f176e9476fbda0a7c9635f69
Expand Down Expand Up @@ -812,7 +810,7 @@ typing-extensions==4.16.0 \
--hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 \
--hash=sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5
# via beautifulsoup4
urllib3==2.7.0 \
--hash=sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c \
--hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
urllib3==2.8.0 \
--hash=sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3 \
--hash=sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63
# via requests
Loading