From e7360204bbbe6a08f7a67b5560965674950d4dcd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 11 Nov 2026 23:08:52 +0000 Subject: [PATCH 1/3] build(deps-dev): Bump the dev-only group across 4 directories with 3 updates Bumps the dev-only group with 1 update in the /examples/wheel directory: [pypiserver](https://github.com/pypiserver/pypiserver). Bumps the dev-only group with 1 update in the /tests/integration/unified_pypi directory: [colorama](https://github.com/tartley/colorama). Bumps the dev-only group with 1 update in the /tests/multi_pypi/alpha directory: [more-itertools](https://github.com/more-itertools/more-itertools). Bumps the dev-only group with 1 update in the /tests/multi_pypi/beta directory: [more-itertools](https://github.com/more-itertools/more-itertools). Updates `pypiserver` from 2.4.2 to 2.4.3 - [Release notes](https://github.com/pypiserver/pypiserver/releases) - [Changelog](https://github.com/pypiserver/pypiserver/blob/main/CHANGES.rst) - [Commits](https://github.com/pypiserver/pypiserver/compare/v2.4.2...v2.4.3) Updates `colorama` from 0.4.5 to 0.4.6 - [Changelog](https://github.com/tartley/colorama/blob/master/CHANGELOG.rst) - [Commits](https://github.com/tartley/colorama/compare/0.4.5...0.4.6) Updates `more-itertools` from 9.1.0 to 11.2.1 - [Release notes](https://github.com/more-itertools/more-itertools/releases) - [Commits](https://github.com/more-itertools/more-itertools/compare/v9.1.0...v11.2.1) Updates `more-itertools` from 9.0.0 to 11.2.1 - [Release notes](https://github.com/more-itertools/more-itertools/releases) - [Commits](https://github.com/more-itertools/more-itertools/compare/v9.1.0...v11.2.1) --- updated-dependencies: - dependency-name: pypiserver dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dev-only - dependency-name: colorama dependency-version: 0.4.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dev-only - dependency-name: more-itertools dependency-version: 11.2.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: dev-only - dependency-name: more-itertools dependency-version: 11.2.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: dev-only ... Signed-off-by: dependabot[bot] --- examples/wheel/pyproject.toml | 2 +- examples/wheel/uv.lock | 8 ++++---- tests/integration/unified_pypi/requirements_b.txt | 6 +++--- .../unified_pypi/requirements_b_without_six.txt | 6 +++--- tests/multi_pypi/alpha/pyproject.toml | 2 +- tests/multi_pypi/alpha/uv.lock | 8 ++++---- tests/multi_pypi/beta/pyproject.toml | 2 +- tests/multi_pypi/beta/uv.lock | 8 ++++---- 8 files changed, 21 insertions(+), 21 deletions(-) diff --git a/examples/wheel/pyproject.toml b/examples/wheel/pyproject.toml index 0912ccf0d0..fd509bf9e8 100644 --- a/examples/wheel/pyproject.toml +++ b/examples/wheel/pyproject.toml @@ -4,6 +4,6 @@ version = "0.0.0" requires-python = ">=3.14" dependencies = [ # This is for running publishing tests - "pypiserver>=2.2.0", + "pypiserver>=2.4.3", "legacy-cgi; python_version >= '3.13'", ] diff --git a/examples/wheel/uv.lock b/examples/wheel/uv.lock index bb2f46afa4..949963bd9d 100644 --- a/examples/wheel/uv.lock +++ b/examples/wheel/uv.lock @@ -23,7 +23,7 @@ dependencies = [ [package.metadata] requires-dist = [ { name = "legacy-cgi", marker = "python_full_version >= '3.13'" }, - { name = "pypiserver", specifier = ">=2.2.0" }, + { name = "pypiserver", specifier = ">=2.4.3" }, ] [[package]] @@ -55,7 +55,7 @@ wheels = [ [[package]] name = "pypiserver" -version = "2.4.2" +version = "2.4.3" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "defusedxml" }, @@ -63,7 +63,7 @@ dependencies = [ { name = "packaging" }, { name = "pip" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/df/88/bd50f0baa457597df4d475f7db2cd9c8cbc7aa9938adaf874f49b896007e/pypiserver-2.4.2.tar.gz", hash = "sha256:131bc2a31ea1eab0e0104ace799dff139789b215465e3d326c65f56df5c160cb", size = 105738, upload-time = "2026-09-20T11:09:33.069Z" } +sdist = { url = "https://files.pythonhosted.org/packages/63/c8/29abdd9d18d3f0be0c3465124d6e69e701850ee3312bad9645202d996479/pypiserver-2.4.3.tar.gz", hash = "sha256:302737e7182fde89c120c6c53ae9602a55c8bd1449d9c4f364d00ffe602d4535", size = 105806, upload-time = "2026-11-08T21:34:44.534Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/44/56/faa75226948ec5074610f4c4b224a363132a385f304e64501e585e44be4b/pypiserver-2.4.2-py3-none-any.whl", hash = "sha256:c8441d60bbd5f77f5647db8afa3a953e7c155ecd909eb1b6faf42bcc9477ee6a", size = 96258, upload-time = "2026-09-20T11:09:32.008Z" }, + { url = "https://files.pythonhosted.org/packages/44/52/0c9730f66cd1e355c6bd44ff3aa1d1d64d2a284685b704b257fd49e72292/pypiserver-2.4.3-py3-none-any.whl", hash = "sha256:4ce26b6936f80c2b5c685df742dd268ff5ceeef9a3a724c281b0924afccfa806", size = 96311, upload-time = "2026-11-08T21:34:43.263Z" }, ] diff --git a/tests/integration/unified_pypi/requirements_b.txt b/tests/integration/unified_pypi/requirements_b.txt index c69f3631b2..762c3688e1 100644 --- a/tests/integration/unified_pypi/requirements_b.txt +++ b/tests/integration/unified_pypi/requirements_b.txt @@ -1,6 +1,6 @@ -colorama==0.4.5 \ - --hash=sha256:854bf444933e37f5824ae7bfc1e98d5bce2ebe4160d46b5edf346a89358e99da \ - --hash=sha256:e6c6b4334fc50988a639d9b98ae42f5c90ec94cb1495b4fe76c5f72cf7f79435 +colorama==0.4.6 \ + --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \ + --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6 six==1.17.0 \ --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \ --hash=sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81 diff --git a/tests/integration/unified_pypi/requirements_b_without_six.txt b/tests/integration/unified_pypi/requirements_b_without_six.txt index ab5f031951..788f12f818 100644 --- a/tests/integration/unified_pypi/requirements_b_without_six.txt +++ b/tests/integration/unified_pypi/requirements_b_without_six.txt @@ -1,3 +1,3 @@ -colorama==0.4.5 \ - --hash=sha256:854bf444933e37f5824ae7bfc1e98d5bce2ebe4160d46b5edf346a89358e99da \ - --hash=sha256:e6c6b4334fc50988a639d9b98ae42f5c90ec94cb1495b4fe76c5f72cf7f79435 +colorama==0.4.6 \ + --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \ + --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6 diff --git a/tests/multi_pypi/alpha/pyproject.toml b/tests/multi_pypi/alpha/pyproject.toml index f62a0a42eb..13b7cdefc0 100644 --- a/tests/multi_pypi/alpha/pyproject.toml +++ b/tests/multi_pypi/alpha/pyproject.toml @@ -3,5 +3,5 @@ name = "multi-pypi-test-alpha" version = "0.1.0" requires-python = ">=3.14" dependencies = [ - "more-itertools==9.1.0" + "more-itertools==11.2.1" ] diff --git a/tests/multi_pypi/alpha/uv.lock b/tests/multi_pypi/alpha/uv.lock index fc2f1f03bc..2b1abdcf5d 100644 --- a/tests/multi_pypi/alpha/uv.lock +++ b/tests/multi_pypi/alpha/uv.lock @@ -4,11 +4,11 @@ requires-python = ">=3.14" [[package]] name = "more-itertools" -version = "9.1.0" +version = "11.2.1" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/2e/d0/bea165535891bd1dcb5152263603e902c0ec1f4c9a2e152cc4adff6b3a38/more-itertools-9.1.0.tar.gz", hash = "sha256:cabaa341ad0389ea83c17a94566a53ae4c9d07349861ecb14dc6d0345cf9ac5d", size = 107389, upload-time = "2023-02-27T14:43:11.571Z" } +sdist = { url = "https://files.pythonhosted.org/packages/52/b8/c63995bebbb9ac9c059350e0fb8c82c2420c85aeca7d34e40aecf3df9281/more_itertools-11.2.1.tar.gz", hash = "sha256:cbf08fd0af284dc69718b9b76a8e6203df624d70209ea511e4219d350c856f63", size = 154133, upload-time = "2026-10-14T18:50:30.407Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/85/01/e2678ee4e0d7eed4fd6be9e5b043fff9d22d245d06c8c91def8ced664189/more_itertools-9.1.0-py3-none-any.whl", hash = "sha256:d2bc7f02446e86a68911e58ded76d6561eea00cddfb2a91e7019bbb586c799f3", size = 54207, upload-time = "2023-02-27T14:43:09.651Z" }, + { url = "https://files.pythonhosted.org/packages/5d/57/3c4b1c6f2e0cc29ba023802458ea3d2a996f87085559e4a5f2192d549532/more_itertools-11.2.1-py3-none-any.whl", hash = "sha256:35a7377edd1dd6608dcb2cdf534ded55ea32d49448875ad042cd3f879fb1ded0", size = 74405, upload-time = "2026-10-14T18:50:29.116Z" }, ] [[package]] @@ -20,4 +20,4 @@ dependencies = [ ] [package.metadata] -requires-dist = [{ name = "more-itertools", specifier = "==9.1.0" }] +requires-dist = [{ name = "more-itertools", specifier = "==11.2.1" }] diff --git a/tests/multi_pypi/beta/pyproject.toml b/tests/multi_pypi/beta/pyproject.toml index 753b52e849..4dfa60f784 100644 --- a/tests/multi_pypi/beta/pyproject.toml +++ b/tests/multi_pypi/beta/pyproject.toml @@ -3,5 +3,5 @@ name = "multi-pypi-test-beta" version = "0.1.0" requires-python = ">=3.14" dependencies = [ - "more-itertools==9.0.0" + "more-itertools==11.2.1" ] diff --git a/tests/multi_pypi/beta/uv.lock b/tests/multi_pypi/beta/uv.lock index 6ff80a5af3..a84e1656e6 100644 --- a/tests/multi_pypi/beta/uv.lock +++ b/tests/multi_pypi/beta/uv.lock @@ -4,11 +4,11 @@ requires-python = ">=3.14" [[package]] name = "more-itertools" -version = "9.0.0" +version = "11.2.1" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/13/b3/397aa9668da8b1f0c307bc474608653d46122ae0563d1d32f60e24fa0cbd/more-itertools-9.0.0.tar.gz", hash = "sha256:5a6257e40878ef0520b1803990e3e22303a41b5714006c32a3fd8304b26ea1ab", size = 104237, upload-time = "2022-10-18T13:44:44.745Z" } +sdist = { url = "https://files.pythonhosted.org/packages/52/b8/c63995bebbb9ac9c059350e0fb8c82c2420c85aeca7d34e40aecf3df9281/more_itertools-11.2.1.tar.gz", hash = "sha256:cbf08fd0af284dc69718b9b76a8e6203df624d70209ea511e4219d350c856f63", size = 154133, upload-time = "2026-10-14T18:50:30.407Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/5d/87/1ec3fcc09d2c04b977eabf8a1083222f82eaa2f46d5a4f85f403bf8e7b30/more_itertools-9.0.0-py3-none-any.whl", hash = "sha256:250e83d7e81d0c87ca6bd942e6aeab8cc9daa6096d12c5308f3f92fa5e5c1f41", size = 52811, upload-time = "2022-10-18T13:44:41.446Z" }, + { url = "https://files.pythonhosted.org/packages/5d/57/3c4b1c6f2e0cc29ba023802458ea3d2a996f87085559e4a5f2192d549532/more_itertools-11.2.1-py3-none-any.whl", hash = "sha256:35a7377edd1dd6608dcb2cdf534ded55ea32d49448875ad042cd3f879fb1ded0", size = 74405, upload-time = "2026-10-14T18:50:29.116Z" }, ] [[package]] @@ -20,4 +20,4 @@ dependencies = [ ] [package.metadata] -requires-dist = [{ name = "more-itertools", specifier = "==9.0.0" }] +requires-dist = [{ name = "more-itertools", specifier = "==11.2.1" }] From 94cfa4825b38a303cbc7dc09235059e859a12cb4 Mon Sep 17 00:00:00 2001 From: Richard Levasseur Date: Wed, 11 Nov 2026 20:29:31 -0800 Subject: [PATCH 2/3] build(deps-dev): keep distinct multi-hub fixture versions and exclude secondary hubs Dependabot's weekly version scan bumps all manifests to the single newest PyPI release, collapsing the distinct versions needed by the `multi_pypi` and `unified_pypi` cross-hub isolation tests. Upgrade `multi_pypi/alpha` and `multi_pypi/beta` to `11.2.1` and `11.2.0` (updating their version assertions), retain `colorama==0.4.5` in `unified_pypi/requirements_b*.txt` alongside `0.4.6` in `requirements_a.txt`, and exclude those secondary fixture paths in `.github/dependabot.yml`. --- .github/dependabot.yml | 11 +++++++++++ tests/integration/unified_pypi/requirements_b.txt | 6 +++--- .../unified_pypi/requirements_b_without_six.txt | 6 +++--- tests/multi_pypi/beta/pyproject.toml | 2 +- tests/multi_pypi/beta/uv.lock | 8 ++++---- tests/multi_pypi/pypi_alpha/pypi_alpha_test.py | 2 +- tests/multi_pypi/pypi_beta/pypi_beta_test.py | 2 +- 7 files changed, 24 insertions(+), 13 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b1cad6a7d6..0ec79245d6 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -64,11 +64,22 @@ updates: - package-ecosystem: "uv" multi-ecosystem-group: "dev-only" directories: + # keep-sorted start - "/dev" - "/dev/**/*" - "/examples/**/*" - "/gazelle/examples/**/*" - "/sphinxdocs/dev" - "/tests/**/*" + # keep-sorted end + # Secondary multi-hub test fixtures intentionally pin older versions than + # their sibling primary hubs to test cross-hub version isolation. + exclude-paths: + # keep-sorted start + - "/tests/integration/unified_pypi/requirements_b.txt" + - "/tests/integration/unified_pypi/requirements_b_without_six.txt" + - "/tests/multi_pypi/beta" + - "/tests/multi_pypi/beta/**/*" + # keep-sorted end patterns: - "*" diff --git a/tests/integration/unified_pypi/requirements_b.txt b/tests/integration/unified_pypi/requirements_b.txt index 762c3688e1..c69f3631b2 100644 --- a/tests/integration/unified_pypi/requirements_b.txt +++ b/tests/integration/unified_pypi/requirements_b.txt @@ -1,6 +1,6 @@ -colorama==0.4.6 \ - --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \ - --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6 +colorama==0.4.5 \ + --hash=sha256:854bf444933e37f5824ae7bfc1e98d5bce2ebe4160d46b5edf346a89358e99da \ + --hash=sha256:e6c6b4334fc50988a639d9b98ae42f5c90ec94cb1495b4fe76c5f72cf7f79435 six==1.17.0 \ --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \ --hash=sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81 diff --git a/tests/integration/unified_pypi/requirements_b_without_six.txt b/tests/integration/unified_pypi/requirements_b_without_six.txt index 788f12f818..ab5f031951 100644 --- a/tests/integration/unified_pypi/requirements_b_without_six.txt +++ b/tests/integration/unified_pypi/requirements_b_without_six.txt @@ -1,3 +1,3 @@ -colorama==0.4.6 \ - --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \ - --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6 +colorama==0.4.5 \ + --hash=sha256:854bf444933e37f5824ae7bfc1e98d5bce2ebe4160d46b5edf346a89358e99da \ + --hash=sha256:e6c6b4334fc50988a639d9b98ae42f5c90ec94cb1495b4fe76c5f72cf7f79435 diff --git a/tests/multi_pypi/beta/pyproject.toml b/tests/multi_pypi/beta/pyproject.toml index 4dfa60f784..21fc590057 100644 --- a/tests/multi_pypi/beta/pyproject.toml +++ b/tests/multi_pypi/beta/pyproject.toml @@ -3,5 +3,5 @@ name = "multi-pypi-test-beta" version = "0.1.0" requires-python = ">=3.14" dependencies = [ - "more-itertools==11.2.1" + "more-itertools==11.2.0" ] diff --git a/tests/multi_pypi/beta/uv.lock b/tests/multi_pypi/beta/uv.lock index a84e1656e6..97fd4b428a 100644 --- a/tests/multi_pypi/beta/uv.lock +++ b/tests/multi_pypi/beta/uv.lock @@ -4,11 +4,11 @@ requires-python = ">=3.14" [[package]] name = "more-itertools" -version = "11.2.1" +version = "11.2.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/52/b8/c63995bebbb9ac9c059350e0fb8c82c2420c85aeca7d34e40aecf3df9281/more_itertools-11.2.1.tar.gz", hash = "sha256:cbf08fd0af284dc69718b9b76a8e6203df624d70209ea511e4219d350c856f63", size = 154133, upload-time = "2026-10-14T18:50:30.407Z" } +sdist = { url = "https://files.pythonhosted.org/packages/55/e5/8735dc589d9e3571e76cd684e7763dc0fcc940b811f71640410458749689/more_itertools-11.2.0.tar.gz", hash = "sha256:59960f488835254863a857eb501f69e4ec92fdc8822f098c0f48dba530afd487", size = 75940, upload-time = "2026-10-13T16:01:14.428Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/5d/57/3c4b1c6f2e0cc29ba023802458ea3d2a996f87085559e4a5f2192d549532/more_itertools-11.2.1-py3-none-any.whl", hash = "sha256:35a7377edd1dd6608dcb2cdf534ded55ea32d49448875ad042cd3f879fb1ded0", size = 74405, upload-time = "2026-10-14T18:50:29.116Z" }, + { url = "https://files.pythonhosted.org/packages/d4/f7/86f27473377a8ebdbdfedec5e62e87fbc24c4c88ed0a2a5ea0a12ee2229b/more_itertools-11.2.0-py3-none-any.whl", hash = "sha256:e4c522352a24664c974d0be8382944107ae638281a06391a5a538366b5707fe5", size = 74407, upload-time = "2026-10-13T16:01:13.424Z" }, ] [[package]] @@ -20,4 +20,4 @@ dependencies = [ ] [package.metadata] -requires-dist = [{ name = "more-itertools", specifier = "==11.2.1" }] +requires-dist = [{ name = "more-itertools", specifier = "==11.2.0" }] diff --git a/tests/multi_pypi/pypi_alpha/pypi_alpha_test.py b/tests/multi_pypi/pypi_alpha/pypi_alpha_test.py index ff0561a6f4..e505993742 100644 --- a/tests/multi_pypi/pypi_alpha/pypi_alpha_test.py +++ b/tests/multi_pypi/pypi_alpha/pypi_alpha_test.py @@ -5,6 +5,6 @@ ) if __name__ == "__main__": - expected_version = "9.1.0" + expected_version = "11.2.1" if __version__ != expected_version: sys.exit(f"Expected version {expected_version}, got {__version__}") diff --git a/tests/multi_pypi/pypi_beta/pypi_beta_test.py b/tests/multi_pypi/pypi_beta/pypi_beta_test.py index bbb50dd8a8..4a9317024c 100644 --- a/tests/multi_pypi/pypi_beta/pypi_beta_test.py +++ b/tests/multi_pypi/pypi_beta/pypi_beta_test.py @@ -5,6 +5,6 @@ ) if __name__ == "__main__": - expected_version = "9.0.0" + expected_version = "11.2.0" if __version__ != expected_version: sys.exit(f"Expected version {expected_version}, got {__version__}") From cd897e98c390947c68b7910d8c82694551e93f5d Mon Sep 17 00:00:00 2001 From: Richard Levasseur Date: Wed, 11 Nov 2026 20:33:44 -0800 Subject: [PATCH 3/3] fix(dependabot): remove leading slashes from exclude-paths Dependabot requires `exclude-paths` entries to be relative to the repository root without a leading `/`. --- .github/dependabot.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0ec79245d6..24276923fe 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -76,10 +76,10 @@ updates: # their sibling primary hubs to test cross-hub version isolation. exclude-paths: # keep-sorted start - - "/tests/integration/unified_pypi/requirements_b.txt" - - "/tests/integration/unified_pypi/requirements_b_without_six.txt" - - "/tests/multi_pypi/beta" - - "/tests/multi_pypi/beta/**/*" + - "tests/integration/unified_pypi/requirements_b.txt" + - "tests/integration/unified_pypi/requirements_b_without_six.txt" + - "tests/multi_pypi/beta" + - "tests/multi_pypi/beta/**/*" # keep-sorted end patterns: - "*"