chore(tests): refresh fixture lockfiles to clear Dependabot alerts#40
Merged
Conversation
Refresh the committed test-fixture uv.lock files (and one requirements.txt) to pull patched versions of the transitive dependencies flagged by Dependabot (urllib3, idna, requests, mistune, jupyter-server, tornado, jupyterlab, bleach, pygments, pytest, black, notebook, soupsieve, setuptools, pymdown-extensions). Surgical uv lock --upgrade-package for only the flagged packages, so commitizen, mkdocs and the other tested tools stay at their current versions. Every lock stays consistent with its pyproject.toml (uv lock --check passes). The fixtures still need committed locks (the actions verify/consume them), so this refreshes rather than removes them. All 107 alerts were in tests/data fixtures only, never in the composite actions.
…3.11 This fixture's pyproject.toml declares no requires-python, so uv lock defaults the floor to the locking machine's Python. The dependency refresh was run on Python 3.12, which narrowed the lock to requires-python >=3.12 and broke the Python 3.11 matrix jobs (uv sync --frozen: 'not compatible with locked >=3.12'). Re-lock with --python 3.11 to restore the >=3.11 floor (matching origin/main) while keeping the security upgrades; uv sync --frozen verified on 3.11 and 3.12.
…to chore/refresh-test-fixture-locks
The fixture's pyproject.toml declared no requires-python, so uv derived it from the locking machine's interpreter: locking on 3.12 narrowed the lock to >=3.12 and broke the Python 3.11 test matrix leg (the symptom fixed by pinning in a5fb561). Declare requires-python = '>=3.11' explicitly so the lock's floor is deterministic regardless of the locking interpreter; uv lock --check now passes on both 3.11 and 3.12, and the manual pin is no longer load-bearing. No package versions change.
This was referenced Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Refresh the committed test-fixture dependency lock files to patched versions, clearing the Dependabot alerts on
main(107 open: 1 critical, 41 high, 54 medium, 11 low). Every alert was in atests/data/**/uv.lock(or onerequirements.txt) — the pinned dependency trees of the minimal test projects that exercise the composite actions inCI. No composite action, workflow, or shipped artifact is changed; the actions bundle no dependencies, so nothing
here reaches consumers.
The fixtures must keep committed lock files (the actions consume them via
uv sync --frozen), so this refreshesthem rather than removing them.
What changed:
uv lock --upgrade-packagefor only the flagged packages (urllib3,idna,requests,mistune,jupyter-server,tornado,jupyterlab,bleach,pygments,pytest,black,notebook,soupsieve,setuptools,pymdown-extensions), socommitizen,mkdocsand the other tested tools stay at their currentversions. Patched versions include the critical
jupyter-server2.20.0, plusurllib32.7.0,requests2.34.2,idna3.18,pygments2.20.0.requestsin the onerequirements.txtfixture.test-custom-configurationfor Python 3.11 to keep itsrequires-pythonfloor (that fixture declares norequires-python, so an unconstraineduv locknarrowed it to the locking machine's Python).On merge, Dependabot re-scans the default branch and the alerts auto-close.
Issues
The Dependabot alerts themselves also resolve automatically once the patched locks are on
main.Type of change
Check relevant points.
How Has This Been Tested?
Verified on the branch via the repo's own CI workflows:
test-mkdocs-deploy— 42/42 jobs pass (incl. the notebook fixture that executes Jupyter with the newjupyter-server, and the Python 3.11/3.12 custom-configuration + version-matrix jobs).test-release/github— pass (the release fixtures,czbump/changelog with the upgraded transitive deps).test-python-setup/pip(therequirements.txtfixture) andtest-python-setup/pixi— pass.test-release/pypi— intentionally not dispatched (itsworkflow_dispatchpath performs real TestPyPI uploads);it runs on merge to
main.pyproject.toml(uv lock --check), anduv sync --frozenwas verified on Python 3.11 and 3.12 for the re-locked fixture.
Checklist:
test-*.ymlsuitesalready exercise every fixture; they pass with the upgraded locks. No new tests needed.