Skip to content

build(deps): bump the github-app-minor-patch group in /integrations/github-app with 5 updates - #90

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/integrations/github-app/github-app-minor-patch-1b1c7f1d91
Open

build(deps): bump the github-app-minor-patch group in /integrations/github-app with 5 updates#90
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/integrations/github-app/github-app-minor-patch-1b1c7f1d91

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-app-minor-patch group in /integrations/github-app with 5 updates:

Package From To
synapse-channel 0.99.21 0.99.24
ruff 0.16.5 0.16.6
ast-serialize 0.8.0 0.9.0
filelock 3.32.4 3.32.5
platformdirs 4.11.5 4.11.7

Updates synapse-channel from 0.99.21 to 0.99.24

Release notes

Sourced from synapse-channel's releases.

v0.99.24

Fixed

  • Keep managed Codex pane bridges waiter-reachable while an already-running provider is blocked by an update chooser, report the pending wake and pane compatibility state explicitly, and coalesce later routing hints until the same live pane becomes safe to submit. New Synapse-managed Codex sessions disable provider-owned startup update prompts because package updates are centrally managed; existing terminals are never restarted or rewritten.
  • Keep the real OpenCode 1.17.20 editor lifecycle deterministic by isolating its configuration and data roots, disabling automatic registry bootstrap and project rediscovery, and loading the audited local claim-guard plugin explicitly.
  • Update vulnerable documentation and VS Code dependency surfaces, including mkdocs-material, fast-uri, fflate, and transitive qs, and advance the reviewed CodeQL and SBOM actions to immutable upstream commit pins.

Artifact checksums (SHA-256)

1f4d139600e805ab2868570bc7d45eb64ee56c2b1c35477a95635262a97500ec  synapse_channel-0.99.24-py3-none-any.whl
bd2572643a02fc2f84ab374704bc8e18333f5a270e750c15c1f3f2121ddf6512  synapse_channel-0.99.24.tar.gz
d14eacd811d47728a6ea158952defb2754457d02c183ff7a4e17fc93a5268aa5  synapse-channel-v0.99.24-sbom.cdx.json

v0.99.23

Fixed

  • Canonicalize direct receiver aliases before liveness, durable delivery, and receipt handling. Sending to a worker's base identity now reaches its live -rx endpoint instead of producing a false no_live_receiver verdict, dead-lettering the message, or replaying it under the wrong identity.
  • Treat waiter-only owners as reachable seats in roster output, while excluding *-presence holders and the doctor's transient self-probe from deaf-agent diagnostics. Healthy agents no longer appear unavailable merely because the durable waiter is their only persistent connection.
  • Report expected hub construction failures as concise CLI startup errors and close any durable stores already opened during partial initialization.
  • Refuse certificate-pin serving policy at startup when the optional cryptography-backed certificate parser is unavailable, with the exact remedy reported before the hub accepts clients.

Artifact checksums (SHA-256)

175993fef4eb26aff11d9b30fdfc692e52ad278e286c08d1ba0b0d3bde1d1357  synapse_channel-0.99.23-py3-none-any.whl
</tr></table>

... (truncated)

Changelog

Sourced from synapse-channel's changelog.

[0.99.24] - 2026-09-04

Fixed

  • Keep managed Codex pane bridges waiter-reachable while an already-running provider is blocked by an update chooser, report the pending wake and pane compatibility state explicitly, and coalesce later routing hints until the same live pane becomes safe to submit. New Synapse-managed Codex sessions disable provider-owned startup update prompts because package updates are centrally managed; existing terminals are never restarted or rewritten.
  • Keep the real OpenCode 1.17.20 editor lifecycle deterministic by isolating its configuration and data roots, disabling automatic registry bootstrap and project rediscovery, and loading the audited local claim-guard plugin explicitly.
  • Update vulnerable documentation and VS Code dependency surfaces, including mkdocs-material, fast-uri, fflate, and transitive qs, and advance the reviewed CodeQL and SBOM actions to immutable upstream commit pins.

[0.99.23] - 2026-09-01

Fixed

  • Canonicalize direct receiver aliases before liveness, durable delivery, and receipt handling. Sending to a worker's base identity now reaches its live -rx endpoint instead of producing a false no_live_receiver verdict, dead-lettering the message, or replaying it under the wrong identity.
  • Treat waiter-only owners as reachable seats in roster output, while excluding *-presence holders and the doctor's transient self-probe from deaf-agent diagnostics. Healthy agents no longer appear unavailable merely because the durable waiter is their only persistent connection.
  • Report expected hub construction failures as concise CLI startup errors and close any durable stores already opened during partial initialization.
  • Refuse certificate-pin serving policy at startup when the optional cryptography-backed certificate parser is unavailable, with the exact remedy reported before the hub accepts clients.

[0.99.22] - 2026-08-31

Fixed

  • Correlate every one-shot directed CLI send with a unique client_msg_id and accept only the matching delivery receipt. A pending receipt replayed when a sender identity reconnects can no longer be mistaken for the verdict of its new message or print the old message's target as the current failure.
  • Make synapse status prefer the current worktree's configured exact identity over conflicting ambient shell state, and use an agreeing SYN_PROJECT/SYN_IDENTITY pair outside a configured worktree. Missing or malformed roster/state replies now render as unavailable and carry explicit JSON availability flags instead of presenting unmeasured zero counts.
  • Keep synapse wait --timeout 0 alive after an established socket drops. The

... (truncated)

Commits
  • 31f6c15 chore(release): prepare 0.99.24 (#85)
  • 1275993 fix: resolve dependency alerts and restore green automation (#84)
  • dd65c89 fix: keep provider bridges compatibility-aligned
  • 37dadb1 chore(release): prepare 0.99.23
  • 2f84870 fix: exclude the doctor probe from liveness
  • 812fcae fix: resolve waiter-only agent availability
  • 2e1887a test(e2e): delete the JetBrains prompt primer
  • 59d749e fix: report hub construction failures
  • 63d542c fix: fail fast without certificate pin support
  • 983fe63 test(e2e): stabilise JetBrains prompt entry
  • Additional commits viewable in compare view

Updates ruff from 0.16.5 to 0.16.6

Release notes

Sourced from ruff's releases.

0.16.6

Release Notes

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.6

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

Commits

Updates ast-serialize from 0.8.0 to 0.9.0

Commits
  • e2c661e Bump version to 0.9.0
  • 789d1fa Fix bytes escaping logic to match old parser (#81)
  • beaec7e Support sys.platform membership checks (#80)
  • 3fdffbc Bump Ruff crates to 0.16.3 (#79)
  • 969b630 Fix panics while searching type comments in function with syntax error (#78)
  • fc05930 Set custom version for vendored crates (#77)
  • See full diff in compare view

Updates filelock from 3.32.4 to 3.32.5

Release notes

Sourced from filelock's releases.

3.32.5

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.32.4...3.32.5

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

3.32.5 (2026-08-31)

  • SoftFileLease.token and AsyncSoftFileLease.token now read None after a failed acquisition, so a contender turned away by a live holder no longer reports a token for a claim it never published. :pr:721
  • Document that mode has no setter: unlike poll_interval, timeout, blocking and lifetime, it is fixed at construction and lock.mode = ... raises AttributeError. :pr:716

3.32.4 (2026-08-23)

  • StrictSoftFileLock always retries a claim read whose first attempt reports the claim as pending, so a first read that itself outlasts the retry grace no longer fails closed on a claim it could have read. :pr:705
  • WindowsFileLock waits out a transient STATUS_ACCESS_DENIED from NtCreateFile for up to half a second before raising PermissionError, since a peer unlinking the lock file as it releases can answer that for a moment; a real denial still fails fast. :pr:705
  • Every lock class now escapes the hostname it publishes, so a host whose socket.gethostname() carries a space, a newline or a byte outside UTF-8 no longer writes a marker it reads back as malformed. Such a host used to lose a held SoftReadWriteLock read slot to a peer and could not take a write slot or a StrictSoftFileLock at all. :pr:709

3.32.3 (2026-08-13)

  • The fork-safety audit hook no longer prints Exception ignored in audit hook with a TypeError when an audit event fires during interpreter shutdown, after CPython has already cleared the module globals. :pr:701

3.32.2 (2026-07-29)

  • A SoftReadWriteLock or SoftFileLease acquire whose heartbeat thread fails to start now unlinks its marker and hands the claim back, instead of leaving an unrefreshed marker a peer takes while the caller believes it still holds the lock. :pr:691

3.32.1 (2026-07-26)

  • Canceling an AsyncSoftReadWriteLock acquire now releases the claim instead of leaking a marker whose heartbeat wedges every contender. :pr:686

... (truncated)

Commits
  • 1585dfe Release 3.32.5
  • 00177c3 🐛 fix(lease): clear token after failed acquire (#721)
  • 5aeb9b6 📝 docs: say that mode is read-only in the thread-local section (#716)
  • 2634dd1 [pre-commit.ci] pre-commit autoupdate (#720)
  • 37dccf0 🧪 test(fork): report where a stalled fork stops (#715)
  • See full diff in compare view

Updates platformdirs from 4.11.5 to 4.11.7

Release notes

Sourced from platformdirs's releases.

4.11.7

Full Changelog: tox-dev/platformdirs@4.11.6...4.11.7

4.11.6

What's Changed

Full Changelog: tox-dev/platformdirs@4.11.5...4.11.6

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.11.7 (2026-09-01)

4.11.6 (2026-09-01)

  • Give :func:~platformdirs.user_bin_dir and :func:~platformdirs.user_bin_path the use_site_for_root argument. They took none, so neither could reach the Unix redirect of root to :func:~platformdirs.site_bin_dir. :pr:537

4.11.5 (2026-08-27)

  • Give :func:~platformdirs.user_preference_dir and :func:~platformdirs.user_preference_path the same arguments as :func:~platformdirs.user_config_dir. Added without arguments in :pr:491, they could only return the unscoped base directory even though the property they wrap appends the app name and version. :pr:531
  • Make :func:~platformdirs.site_applications_path return the first entry when multipath=True, matching :func:~platformdirs.site_data_path. On Unix and macOS it passed the whole $XDG_DATA_DIRS list to :class:~pathlib.Path, giving one unusable path such as /first/applications:/second/applications. :pr:532
  • Give :func:~platformdirs.user_applications_dir, :func:~platformdirs.user_applications_path, :func:~platformdirs.site_applications_dir and :func:~platformdirs.site_applications_path the app arguments. Android scopes both applications directories to the app, so without them the functions could only return the unscoped base directory there. On the two site functions they are keyword-only, keeping multipath first positional as it has been since 4.9.0; the two user functions take their boolean options keyword-only. :pr:534
  • Correct the ordering note on the iterator methods. use_site_for_root drops the user directory entirely, so the iterators are documented as yielding the most specific directory first rather than always yielding the user one. :pr:533

4.11.4 (2026-08-24)

  • Stop the iter_*_dirs methods yielding the same directory twice when a site directory resolves to its user equivalent - :pr:520 covered only Unix with use_site_for_root. It also hit :meth:~platformdirs.PlatformDirs.iter_runtime_dirs on Unix with $XDG_RUNTIME_DIR set, on Windows and macOS, and all six iterators on Android. :pr:524
  • Fix the config merging example in the how-to guide. iter_config_paths yields the user directory first, so the config.update loop let the site defaults override the user's config instead of the other way round. :pr:529

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the github-app-minor-patch group
f9a4a6e 
Bumps the github-app-minor-patch group in /integrations/github-app with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [synapse-channel](https://github.com/anulum/synapse-channel) | `0.99.21` | `0.99.24` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.5` | `0.16.6` |
| [ast-serialize](https://github.com/mypyc/ast_serialize) | `0.8.0` | `0.9.0` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.32.4` | `3.32.5` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.11.5` | `4.11.7` |


Updates `synapse-channel` from 0.99.21 to 0.99.24
- [Release notes](https://github.com/anulum/synapse-channel/releases)
- [Changelog](https://github.com/anulum/synapse-channel/blob/main/CHANGELOG.md)
- [Commits](v0.99.21...v0.99.24)

Updates `ruff` from 0.16.5 to 0.16.6
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.5...0.16.6)

Updates `ast-serialize` from 0.8.0 to 0.9.0
- [Commits](mypyc/ast_serialize@v0.8.0...v0.9.0)

Updates `filelock` from 3.32.4 to 3.32.5
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.32.4...3.32.5)

Updates `platformdirs` from 4.11.5 to 4.11.7
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.11.5...4.11.7)

---
updated-dependencies:
- dependency-name: synapse-channel
  dependency-version: 0.99.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-app-minor-patch
- dependency-name: ruff
  dependency-version: 0.16.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: github-app-minor-patch
- dependency-name: ast-serialize
  dependency-version: 0.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: github-app-minor-patch
- dependency-name: filelock
  dependency-version: 3.32.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: github-app-minor-patch
- dependency-name: platformdirs
  dependency-version: 4.11.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: github-app-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 7, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: github-app. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants