chore(deps): bump lizard to 1.24.1 with its own hashes by tobyhede · Pull Request #1322 · cipherstash/stack

tobyhede · 2026-10-21T00:14:15Z

Requested by Toby · project thread

Summary

The advisory "Change impact" CI job installs its analysis tools (ImpactGate and lizard, a code complexity tool) from a pinned file in which every package has a fixed SHA-256 hash. Dependabot's bump in #1152 changed the lizard version to 1.24.1 but kept the 1.23.0 hashes, so pip refused to install it and the job failed. This PR makes the same bump with lizard 1.24.1's real hashes. The blocker freshtonic raised about 1.24.0 no longer applies: ImpactGate 0.4.1 excludes only 1.24.0, and 1.24.1 is allowed.

Changes

.github/impact-gate/requirements.txt: lizard==1.24.1 with its wheel and sdist hashes, regenerated with the uv pip compile command in the file header. That header (the pin list and the regenerate command) now names 1.24.1. No other pin moved.

Verification

uv pip compile (the header's command, now with 1.24.1) changed only the lizard lines. The hashes match PyPI's 746060a3… (wheel) and c022cf1a… (sdist).
In a fresh Python 3.12 venv: pip install --require-hashes --no-deps -r .github/impact-gate/requirements.txt succeeded, pip check reported no broken requirements, and it installed impact-gate 0.4.1 and lizard 1.24.1.
python -m unittest discover -s scripts/tests -p test_impact_gate.py: all 22 tests passed against lizard 1.24.1. This is the same step the job runs after the install.

Review notes

No changeset, because this only changes CI tooling. Two follow-ups from that review are deliberately left out of this PR. First, the .github/dependabot.yml comment that says Dependabot regenerates the hashes, which #1152 shows is not true. Second, the missing supply-chain label.

Generated by Claude Code

Summary by CodeRabbit

Chores
- Updated the documented Lizard dependency version and its integrity hashes.
- Left the Impact Gate and Pygments dependency pins unchanged.

Dependabot's bump in #1152 moved the lizard pin to 1.24.1 but kept the 1.23.0 hashes, so `pip install --require-hashes` refused it and the advisory impact job failed. Regenerated with the command in the file header, which now names 1.24.1 too. ImpactGate 0.4.1 allows 1.24.1 (it excludes only 1.24.0), and lizard's dependencies did not change. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015gYnhFvb3q6ykc5ExKZewS

changeset-bot · 2026-10-21T00:14:21Z

⚠️ No Changeset found

Latest commit: bceca8a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-10-21T00:14:22Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Essentials
Run ID: a8895a6b-743e-4350-a8e1-d55f28644bcd

📥 Commits

Reviewing files that changed from the base of the PR and between d2e4299 and bceca8a.

📒 Files selected for processing: 1

.github/impact-gate/requirements.txt

Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📝 Walkthrough

The impact-gate requirements update the lizard pin from 1.23.0 to 1.24.1 and replace its two distribution hashes. The impact-gate and pygments pins remain unchanged.

Changes: Impact-gate dependency update

Layer / File(s)	Summary
Update lizard pin `.github/impact-gate/requirements.txt`	The requirements header and compile command specify `lizard==1.24.1` and its updated hashes. The other dependency pins remain unchanged.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: auxesis

Merge Risk: ⚪ Minimal · up to bceca

No merge-blocking issue is identified in this dependency-only update.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the dependency update from lizard to 1.24.1 and the associated hash changes.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector · 2026-10-22T00:20:11Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T00:21:29.949064Z	`bceca8a`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

cipherstash-agent

Attestation of review — Claude Code /code-review medium, with findings cross-checked via company-skills:cross-check-review-findings, against head bceca8a.

No critical or blocking issues. No findings.

The lizard==1.24.1 wheel (746060a3…) and sdist (c022cf1a…) hashes match PyPI's published SHA-256 digests.
impact-gate==0.4.1 requires lizard!=1.24.0,>=1.17, so 1.24.1 is allowed.
The header pin list and regenerate command are consistent with the pinned entry. No other pin moved.
No existing review feedback to cross-check (only bot status comments).
No changeset is needed for a CI-tooling-only change.

Generated by Claude Code

tobyhede self-assigned this Oct 21, 2026

tobyhede marked this pull request as ready for review October 22, 2026 00:20

tobyhede requested a review from a team as a code owner October 22, 2026 00:20

cipherstash-agent reviewed Oct 22, 2026

View reviewed changes

tobyhede requested review from auxesis, coderdan and freshtonic October 22, 2026 00:38

freshtonic approved these changes Oct 22, 2026

View reviewed changes

freshtonic merged commit bf49826 into main Oct 22, 2026
31 checks passed

freshtonic deleted the claude/project-thread-tbrbkj branch October 22, 2026 00:49

Navigation Menu

Repository navigation

chore(deps): bump lizard to 1.24.1 with its own hashes - #1322

chore(deps): bump lizard to 1.24.1 with its own hashes#1322
freshtonic merged 1 commit into
mainfrom
claude/project-thread-tbrbkj

tobyhede commented Oct 21, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

changeset-bot Bot commented Oct 21, 2026

Uh oh!

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

cipherstash-agent left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

tobyhede commented Oct 21, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Verification

Related

Review notes

Summary by CodeRabbit

Uh oh!

changeset-bot Bot commented Oct 21, 2026

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

cipherstash-agent left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

tobyhede commented Oct 21, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 22, 2026 •

edited

Loading