Skip to content

Update CI and build tooling and patch vulnerable dependencies - #15

Merged
soodoku merged 6 commits into
mainfrom
dependabot/github_actions/gojiplus/py-canon/dot-github/workflows/reusable-ci.yml-6c3fbb04cf3798cae79f2e1067b6a74d8391a4ee
Oct 28, 2026
Merged

soodoku merged 6 commits into
mainfrom
dependabot/github_actions/gojiplus/py-canon/dot-github/workflows/reusable-ci.yml-6c3fbb04cf3798cae79f2e1067b6a74d8391a4ee

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026 •

Copy link
Copy Markdown
Contributor

Update the reusable CI workflow and build tooling, and patch vulnerable transitive dependencies that were failing the security checks. This consolidates the dependency changes from #16 and #17.

  • Update the reusable workflow to the current v1 commit and setup-uv to v10.3.2.
  • Include pre-commit 4.7.0, Ruff 0.17.1, and the uv-build <0.14 range.
  • Patch filelock to 4.2.4, virtualenv to 21.15.1, and pypdf to 6.21.3.

Validation: locked environment installation; make check (lint, format, Pyright, docstrings, 47 tests, package builds, theory controls, committed-result equivalence, and manuscript build); actionlint; pip-audit with no known vulnerabilities.

Bumps [gojiplus/py-canon/.github/workflows/reusable-ci.yml](https://github.com/gojiplus/py-canon) from d5000e704aafc69a4834e606bdff81dc8a6d7804 to 6c3fbb04cf3798cae79f2e1067b6a74d8391a4ee.
- [Release notes](https://github.com/gojiplus/py-canon/releases)
- [Changelog](https://github.com/gojiplus/py-canon/blob/main/CHANGELOG.md)
- [Commits](gojiplus/py-canon@d5000e7...6c3fbb0)

---
updated-dependencies:
- dependency-name: gojiplus/py-canon/.github/workflows/reusable-ci.yml
  dependency-version: 6c3fbb04cf3798cae79f2e1067b6a74d8391a4ee
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 26, 2026
dependabot Bot and others added 5 commits October 26, 2026 03:37
Bumps the python-minor-and-patch group with 3 updates: [pre-commit](https://github.com/pre-commit/pre-commit), [pypdf](https://github.com/py-pdf/pypdf) and [ruff](https://github.com/astral-sh/ruff).


Updates `pre-commit` from 4.6.2 to 4.7.0
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.2...v4.7.0)

Updates `pypdf` from 6.20.0 to 6.21.1
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.20.0...6.21.1)

Updates `ruff` from 0.17.0 to 0.17.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.0...0.17.1)

---
updated-dependencies:
- dependency-name: pre-commit
  dependency-version: 4.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: pypdf
  dependency-version: 6.21.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Updates the requirements on [uv-build](https://github.com/astral-sh/uv) to permit the latest version.
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.12.5...0.13.1)

---
updated-dependencies:
- dependency-name: uv-build
  dependency-version: 0.13.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@soodoku soodoku changed the title Bump gojiplus/py-canon/.github/workflows/reusable-ci.yml from d5000e704aafc69a4834e606bdff81dc8a6d7804 to 6c3fbb04cf3798cae79f2e1067b6a74d8391a4ee Update CI and build tooling and patch vulnerable dependencies Oct 28, 2026
@soodoku
soodoku merged commit f7cf950 into main Oct 28, 2026
11 checks passed
@soodoku
soodoku deleted the dependabot/github_actions/gojiplus/py-canon/dot-github/workflows/reusable-ci.yml-6c3fbb04cf3798cae79f2e1067b6a74d8391a4ee branch October 28, 2026 02:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant