chore(repo): batch the remaining dependabot bumps as datascry commits - #288
Merged
Conversation
…r latest pins Applies dependabot #270, #271, #272 and #274 locally so the commits stay datascry-authored: - actions/checkout v7.0.0 -> v7.0.1 - actions/setup-go v6 -> v7.0.0 - actions/setup-python v6.3.0 -> v7.0.0 - astral-sh/setup-uv v8.3.2 -> v9.0.0 Every SHA was verified to resolve to the tag it claims before pinning. The three majors are no-ops for this repo: setup-go v7 is an ESM migration, setup-python v7 drops the `pip-install` input we never used, and setup-uv v9's only breaking change is `prune-cache` defaulting to false — we set `enable-cache: true` explicitly, so only cache size changes, not behaviour.
…modules Applies dependabot #281, #282, #283, #286 and #287 locally so the commits stay datascry-authored: - edge, evaders/go-tls: quic-go v0.60.0 -> v0.61.0, x/net v0.57.0 -> v0.58.0 - arena: x/image v0.44.0 -> v0.45.0 - evaders/h2-rapid-reset: x/net v0.57.0 -> v0.58.0 - evaders/pow: x/crypto v0.54.0 -> v0.55.0 Indirects follow through tidy (x/crypto, x/mod, x/text, x/tools). Each module was verified in golang:1.26-alpine with gofmt, go vet and go test: edge, arena, evaders/pow and evaders/go-tls all pass with coverage unchanged. arena and evaders/pow needed the repo root mounted rather than the module dir, because arena's `replace` points at ../evaders/pow.
Applies dependabot #285 and #284 locally so the commits stay datascry-authored. Resolves to ruff 0.16.4 and mypy 2.3.1 in the lockfile. fleet already declares an explicit `select`, so ruff 0.16's wider defaults don't reach it — the gate is clean with no code changes: ruff check, ruff format --check, mypy --strict and 37 tests at 97.95% coverage all pass.
Applies the remainder of dependabot #267 locally so the commits stay datascry-authored. eslint was already at the PR's ^10.7.0 target from 7534994, so only two ranges move: - prettier ^3.9.5 -> ^3.9.6 - typescript-eslint ^8.64.0 -> ^8.65.0 (resolves to 8.67.0) The postcss >=8.5.23 override still holds at 8.5.26 through the relock. Gate is green on the new lockfile: install --frozen-lockfile, typecheck, eslint, prettier and 62 tests.
…ctor to 2.1.86 Applies dependabot #277 locally so the commits stay datascry-authored. 2.1.82 -> 2.1.86 for both. playwright stays pinned at 1.52.0 — the pin is deliberate and the PR does not touch it; fingerprint-injector 2.1.86 peers on playwright ^1.22.2, which 1.52.0 satisfies. Verified in node:22-alpine that the tree resolves with the pin intact and that both APIs run.mjs imports (FingerprintGenerator, newInjectedContext) are present in the new versions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Applies every open dependabot PR locally as datascry-authored commits, per the repo's single-author history rule.
Covers
chore(ci): bump checkout, setup-go, setup-python and setup-uv…chore(repo): bump quic-go, x/net, x/crypto and x/image…chore(fleet): update ruff to >=0.16.3 and mypy to >=2.3.1chore(collector): bump prettier and typescript-eslint dev depschore(evaders): bump apify fingerprint-generator and fingerprint-injector…#268 (torch 2.13.0 / pillow 12.3.0) needs nothing — already landed in
ebc2354evia #269.Notes
pip-installinput we never used, and setup-uv v9's only breaking change isprune-cachedefaulting to false (cache size, not behaviour — we setenable-cache: trueexplicitly). Every pinned SHA was verified to resolve to the tag it claims.playwright ^1.22.2.postcss >=8.5.23override from chore(repo): batch dependabot security + lint bumps and clear codeql no-op #269 survives the collector relock at 8.5.26.Verified locally
detector 537 passed / 95.20% · harness 390 / 95.91% · fleet 37 / 97.95% (under the new ruff 0.16.4 + mypy 2.3.1) · collector 62 passed + typecheck/eslint/prettier on the new lockfile · edge, arena, evaders/pow, evaders/go-tls, evaders/arena-solver all gofmt/vet/test clean under the bumped modules · arena-solver-ocr 8 passed / 100% · headers clean · all 5 commit messages pass commitlint.