Repository navigation
v0.3.1036 — boto3/numpy floors + recompiled lock (closes #277, #288) - #325
Conversation
Dependabot #288 (boto3 >=1.34 -> >=1.43.68) and #277 (numpy >=2.5.1 -> >=2.5.2) cannot merge as they stand: both raise a floor ABOVE what requirements.lock pins (boto3==1.43.46, numpy==2.5.1), and test_lock_satisfies_requirements checks the lock against BOTH requirements.in and services/data/requirements.txt. Merging either alone turns main red. numpy is raised in requirements.in TOO, not only in services/data/requirements.txt where Dependabot proposed it. pip-compile's only input is requirements.in, so a floor raised solely in the data service cannot move the resolution - the lock would stay at 2.5.1 and the gate would still fail. The comment beside it records that, since the two files are easy to treat as interchangeable and are not. The lock is regenerated by lockfile.yml in python:3.12-slim (the prod base image), never on a dev box, and committed from that run's artifact in the next commit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Compiled by lockfile.yml in python:3.12-slim (the prod base image), never on a dev box, and committed from that run's artifact. Moved: boto3 1.43.46 -> 1.43.75, botocore 1.43.46 -> 1.43.75, numpy 2.5.1 -> 2.5.2. Nothing else moved, which is what compiling without --upgrade is for. Verified the gate actually enforces this rather than assuming it: with the OLD lock restored, test_lock_satisfies_requirements exits 1 on "the lock satisfies every floor"; with the new one it passes, 51 declared floors against 110 pins. test_lock_advisories, test_license_lock_gate, test_supply_chain, test_licence_allowlist, test_file_sizes, test_reachable and ruff all green. Closes #277 and #288. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ing what it did not ship Two corrections to the same file. The 1036 entry was missing: its insertion anchor assumed a (2026-08-20) date and the heading it targeted carried (2026-08-19), inherited from the renumbered v0.3.987 entry. The script asserted, failed, and the version bump plus lock committed without it - a reminder that an anchored edit which throws leaves the OTHER half of the change committed. The 1035 heading read "honest empty canvas, Place ticks, named Analyse destinations, element cards". The named Analyse destinations were deliberately NOT taken - v0.3.994 had already closed that item the other way, and the body of the entry says so. A heading advertising a feature the release does not contain is the kind of prose nothing checks and everyone believes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
|
Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here. So far, Strix has reviewed 28 pull requests, surfaced 3 security issues (1 critical/high) and blocked 2 risky merges across this workspace. |
|
Warning Review limit reached
Next review available in: 38 minutes Limit details: You’ve used all 2 included reviews currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (5)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Supersedes #277 and #288, which cannot merge alone: each raises a floor above what
requirements.lockpins, andtest_lock_satisfies_requirementschecks the lock against bothrequirements.inandservices/data/requirements.txt.>=1.43.68, numpy>=2.5.2— numpy in both files, becausepip-compileonly readsrequirements.in.lockfile.ymlinpython:3.12-slimand committed from its artifact.Closes #277
Closes #288