fix(deps): update all non-major dependencies - #227
Merged
Conversation
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
August 11, 2026 01:10
8127744 to
4341703
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
August 12, 2026 19:10
4787061 to
42affc9
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #227 +/- ##
==========================================
+ Coverage 84.07% 84.45% +0.37%
==========================================
Files 39 40 +1
Lines 2129 2193 +64
Branches 91 99 +8
==========================================
+ Hits 1790 1852 +62
- Misses 324 325 +1
- Partials 15 16 +1
Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
August 13, 2026 22:45
dc2729c to
2074c03
Compare
Syndic
added a commit
that referenced
this pull request
Aug 14, 2026
#227 failed when github.com release assets served 503s and `bazel mod deps` could not fetch buildozer, toml.bzl, rules_apple and pybind11_bazel. Bazel had already retried each URL (--experimental_repository_downloader_retries defaults to 5), so the lever is not more attempts -- it is not needing the network. Add `external-cache: true`, which restores the materialized `external/` dir. Measured locally on Bazel 9.2.0 with `--repository_disable_download` as an outage simulation: with the caches warm, none of the four archives that took #227 down needed fetching. Two things this does NOT do, both deliberate to record: - It does not make the step network-free. rules_python's pip extension is reproducible, so it re-evaluates on every invocation and reaches files.pythonhosted.org no matter what is cached; under `--repository_disable_download` it is the one remaining failure. Different provider from the one that broke #227, so the correlated-failure surface still shrinks -- but "immune to outages" is not on offer here. - It does not explain #227 fully. That run restored a repository cache (key ...b95723c6, 471MB) and downloaded those archives anyway, which the local measurement says it should not have needed to. That cache entry was created 2026-08-08 and Actions cache keys are immutable, so stale-but-hitting content is the leading theory. Unconfirmed. `disk-cache` stays off: `mod deps` executes no actions, so it would be inert. Cache state does not affect the pip `facts` refresh in either direction (see the preceding commit). Not yet exercised in CI: the job is gated on `github.actor == 'renovate[bot]'`, so this runs for the first time on the next Renovate PR that moves a manifest. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Syndic
added a commit
that referenced
this pull request
Aug 14, 2026
Replaces the `external-cache` approach from the previous commit, which would not have prevented #227: `external-cache` is keyed the same way and saved by whoever wins the same race, so the re-derive job would have restored a partial `external/` and downloaded the same four archives. The defect is not stale cache content. Two GitHub behaviours compose badly: - setup-bazel derives the repository-cache key from MODULE.bazel/WORKSPACE contents, and the base key `setup-bazel-<cache-version>-<os>-<arch>` carries no workflow component, so every workflow shares one entry. - Actions cache entries are immutable per key: first writer wins, later saves are silent no-ops. So the job that finishes first freezes its own repo footprint under a key every other job then restores, and the narrowest job reliably wins. On the 2026-08-08 main run `Gazelle BUILD file check` finished 21:48:03 and wrote the entry; `Build and test (linux_x86_64)` started 21:48:07 and logged a cache hit, so its far richer cache was never saved. The key is MODULE.bazel-derived and that file did not move again until 08-13, so every job restored gazelle's 471MB footprint for four days -- including the re-derive job on #227. Reproduced locally: priming a repository cache with exactly `bazel run //:gazelle -- -mode=diff`, then running `bazel mod deps --repository_disable_download` against it, fails on exactly buildozer, pybind11_bazel, rules_apple and toml.bzl -- the four archives whose GitHub 503s broke the job. `cache-version` is the only lever that can fix this. It reads as a version knob but is the base key's namespace, and unlike `disk-cache` -- which takes a separator string of its own -- `repository-cache`'s string form names files to hash, not a namespace. Setting it to `github.workflow` at both call sites gives CI, Devcontainer and Renovate their own entries, each written by a job whose footprint matches its consumer. `disk-cache` drops to `true` since the base key now separates it. Cost is one set of entries per workflow against the 10GB repo budget. Eviction under pressure is graceful -- a miss downloads, which is today's behaviour. This narrows network exposure rather than removing it: rules_python's pip extension is reproducible, so it re-evaluates and reaches files.pythonhosted.org on every invocation regardless of caching. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
August 15, 2026 09:56
0d9608f to
0ee7f2e
Compare
Syndic
added a commit
that referenced
this pull request
Aug 16, 2026
Reworks the previous commit, which namespaced by `github.workflow` and was wrong in three ways, all raised in review on #229 and all confirmed: - It does not separate the jobs the measurement came from. Gazelle, the lock freshness check, build-and-test and coverage are jobs of ONE workflow (CI), so `github.workflow` put all four back under a single key and the measured gazelle-vs-build-and-test race survived verbatim. - It made the Renovate re-derive job permanently cold. That workflow triggers on pull_request only; PR-run cache saves are scoped to refs/pull/N/merge, so a namespace no main-branch run ever writes can never be restored. The job went from restoring a partial entry to restoring nothing -- and re-downloaded bazelisk from GitHub releases too, the same asset class as the #227 outage. - It weakened Devcontainer, whose Bazel jobs are all gated on base-image changes, so its namespace would be seeded only by the rare base-touching push to main and evicted after 7 days. The defect was never "workflows share a cache" -- it is a consumer restoring a producer's mismatched footprint. So the namespace now names the footprint class: `gazelle`, `mod`, `build`, `devcontainer-base`. `setup-bazel-remote` takes a required `cache-namespace` input rather than deriving one, so a new call site cannot silently inherit someone else's class. Two rules govern the values, both recorded in .claude/CLAUDE.md: jobs sharing a class must fetch the same repos, and every class needs a producer that runs on main. The re-derive job uses `mod`, seeded by ci.yml's freshness job on every push to main. That is deliberately an imperfect fit and the docs say so: the producer runs `bazel mod tidy`, the consumer `bazel mod deps`, which evaluates every module extension including ones no build target needs. Measured against the four archives whose 503s broke #227, by priming a repository cache with one command and running `bazel mod deps --repository_disable_download` against it: primed by buildozer toml.bzl pybind11_bazel rules_apple gazelle (570M) no no no no mod tidy (81M) YES YES no no fetch //... (1.7G) no YES no no So `mod` covers half, against none today, and no existing main-running job covers `mod deps` fully. Closing the rest needs a main-running producer that runs `mod deps` itself; not added here. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
August 16, 2026 21:42
0db7d6e to
368e961
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
August 18, 2026 07:16
bd7c1ff to
5089589
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==3.4.9→==3.5.10.12.3→0.12.5v8.15.1→v8.15.2v4.37.6→v4.37.71.26.5→1.26.6==3.18→==3.194.6.1→4.6.20.16.2→0.16.30.62.0→0.63.02.2.0→2.3.11.172.0→1.173.00.0.69→0.0.72Release Notes
jawah/charset_normalizer (charset-normalizer)
v3.5.1Compare Source
Changed
Fixed
Only impacted large content input >1M bytes.
v3.5.0Compare Source
Added
Fixed
Changed
pure Python fallback. The previous engine (mypyc) started to hit rough limit around
the optimization of our noise/coherence detector while Cython allows us to
steer the engine toward the right generated optimized sources.
This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are
immediately discoverable (i.e. not hidden import like mypyc did).
Moreover, a long wished distribution is the abi3 wheels, this will allow us
to no longer rush each year when a new Python interpreter is released.
We still distribute the interpreter specific wheels for faster performance.
Misc
astral-sh/uv (ghcr.io/astral-sh/uv)
v0.12.5Compare Source
Released on 2026-08-14.
Python
Enhancements
Preview features
--indexand--default-indexto select configured package indexes by name with theindex-by-namepreview feature (#17455)cache-physical-spaceon filesystems that do not support physical-space accounting (#21133)Bug fixes
v0.12.4Compare Source
Released on 2026-08-13.
Enhancements
Requires-Python: >= 3.5.*(#21012)Preview features
uv check --no-install-projectand respectUV_NO_INSTALL_PROJECTto install dependencies without building or installing the project (#21085)uv checkhonor uv's color and progress settings, including quiet mode (#21086)Performance
Bug fixes
pythonw.exelaunchers for virtual environments created from managed Python minor-version links (#19235)uv lockto proceed when.venvis an unusable project environment (#21068)fork-strategywhen ordering forks created fromenvironmentsor existing lockfileresolution-markers(#21000)!=3.11.*, !=3.12.*inuv.lock(#21045)uv addupdates it (#21008)PYTHONEXECUTABLEand__PYVENV_LAUNCHER__overrides (#21075)uv version --bumpvalues (#21076)vbauerster/mpb (github.com/vbauerster/mpb/v8)
v8.15.2Compare Source
Full Changelog: vbauerster/mpb@v8.15.1...v8.15.2
github/codeql-action (github/codeql-action)
v4.37.7Compare Source
golang/go (go)
v1.26.6kjd/idna (idna)
v3.19Compare Source
std3_rulesoption, which had no effect since changesto UTS #46 processing in Unicode 16. Note that
uts46_remap()defaults to enabling STD3 rules, so direct callers will see input
containing non-LDH ASCII characters rejected again.
ASCII-only domains.
thread safety.
idna.unicode_version, and show it inidna --version.code,text,codepointandpositionattributes toIDNAErrorso that the failed rule and the offending character canbe identified without parsing the exception message.
transitionalargument toencode()anduts46_remap()is now completely ignored, and gives a deprecation warningfor the latter.
their U-label.
IDNAErrorinstead ofInvalidCodepointContext.IDNAErrorfor empty labels and non-ASCII bytespassed to label helper functions and the incremental codec.
measurement, and CI checks that the data tables match the generator
output.
Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for
contributions to this release.
pre-commit/pre-commit (pre-commit)
v4.6.2Compare Source
==================
Fixes
language: nodehooks that contain"scripts": {"build": ...}withnpm 11.x.
astral-sh/ruff (ruff)
v0.16.3Compare Source
Released on 2026-08-13.
Preview features
pylint] Fix false negatives on negative numbers (PLR6104) (#27251)pyupgrade] Add rule to replacewhile 1withwhile True(UP048) (#27190)Bug fixes
flake8-bandit] Also check keyword arguments (S602,S603,S607,S609) (#27687)pylint] Allowcontinueinfinallyon Python 3.8 (#27626)pylint] FixPLE1307false positive with bools (#27651)pylint] Fix false positives and negatives with%bformat character (PLE1300,PLE1307) (#27560)pylint] Improve handling of concatenated strings (PLE1300) (#27659)Rule changes
numpy] Makenp.chararrayautofix backwards-compatible (NPY201) (#27527)Performance
Exprsize to 64 bytes (#27591)CLI
ruff check --statisticsoutput (#27646)Documentation
ruff] Also suggestasyncio.TaskGroup(RUF006) (#27461)Other changes
Contributors
bazelbuild/rules_go (rules_go)
v0.63.0MODULE.bazelcodeWORKSPACEcodeWhat's Changed
["all"]scope for nogo by @fionera in bazel-contrib#4678New Contributors
Full Changelog: bazel-contrib/rules_go@v0.62.0...v0.63.0
bazel-contrib/rules_python (rules_python)
v2.3.1Compare Source
{#v2-3-1-fixed}
Fixed
experimental repository cache users. This restores the previous behavior
(#3791).
{#v2-3-0}
v2.3.0Compare Source
{#v2-3-0-changed}
Changed
extension selects its standard library list on
is_python_3.14, which earlierversions do not define.
{#v2-3-0-fixed}
Fixed
py_binary_rule_builder()/py_test_rule_builder()(frompython/api/executables.bzl)failing at analysis time with a visibility error when used to construct a custom rule from an
external module.
dataattribute and forward itdirectly to the generated
py_binary, so files passed viadatacan bereferenced from
extra_argsusing$(location ...).coverage.pywheel is no longeremitted as we are now falling back to a pure python wheel
(#3950).
python_version3.13 and 3.14; previously both fell back to the 3.11 list, so modulesadded or removed since then (e.g.
compression.zstd,telnetlib) were misclassified. Thefallback list for unrecognized versions is now the newest available one rather than 3.11
(#3978).
uv_lockto be specified inpip.parsewithout requiringrequirements_lock(or other os-specific requirement file attributes) to beset.
(
pkg[extra]entries in a package's ownRequires-Dist). The loop comparedthe number of extras discovered in the current round against the number known
before it, rather than against the size of the merged set. As a result it
could stop before every extra was resolved, silently dropping dependencies
only reachable through two or more
pkg[extra]hops, and for the common caseof a package with no self-referencing extras it never converged at all,
running all 10000 rounds while evaluating each wheel's generated
BUILDfile(#4039).
--hash=<algo>:<digest>pins and Simple API#<algo>=<digest>URL fragments are now parsed for all hash algorithmsinstead of silently dropping everything except
sha256. Non-sha256 pins arematched against the digests advertised by the index and downloads are verified
using the corresponding Subresource Integrity value, and the pins are kept in
the requirement line when falling back to
pip(#3972).
As part of this,
whl_libraryrepos created bypip.parsenow always passthe digest via the
integrityattribute (SRI format) instead ofsha256,and the lock file facts store digests as
<algo>:<digest>values (the factsversion was bumped, so cached index information is refreshed once).
pip.parse(uv_lock = ...)no longer exposes uv workspace/root membersthat resolve to no wheel or sdist (e.g.
source = { virtual = "." }or editableinstalls). Previously these source-less packages were added to the hub's
all_requirements/all_whl_requirementswith an alias to a subpackage thatdoes not exist, breaking analysis for anything enumerating the full set such as
modules_mapping(wheels = all_whl_requirements)(#3934).
index_urlfor each wheel so that the source registry is forwarded tothe {obj}
whl_library. This is so that thepurlforpackage_metadatacan be correctlyconstructed.
enabling wheel sources files to point to an absolute path. Currently it supports
the
file://<absolute_path>for linux and windows like paths. We also supportenvsubst for the said paths from now on.
{#v2-3-0-added}
Added
build_python_zip,incompatible_default_to_explicit_init_py,python_path, andexperimental_python_import_all_repositories.{obj}explicit_init_pytag class to the `{obj}`configmodule extension for configuring implicit__init__.pyfilegeneration module-wide.
(#3997,
#2945)
py_extensionmacro for creating C/C++ Pythonextension modules
(#3283).
(cc) Added
libc,platform_machine,platform_tag,soabi, andsys_platformattributes and info fields to {obj}py_cc_toolchain/{obj}
PyCcToolchainInfo.pyproject_tomlattribute to {obj}pip.default, {obj}pip.parseand {obj}python.defaultsto read the default Python version from therequires-pythonfield ofpyproject.toml.py_testtargets that silentlypass without running any tests. Set
{obj}
--@rules_python//python/config_settings:validate_test_main=enabledtofail the build when a test's main module only contains inert top-level
statements (definitions, imports, assignments) and never invokes a test
runner (#3824).
{#v2-2-0}
astral-sh/ty (ty)
v0.0.72Compare Source
Released on 2026-08-14.
Preview features
Library support
Diagnostics
TypedDicttypes (#27717)Core type checking
__getattr__calls (#27507)TypedDictaliases (#27760)Never(#27580)TypeVarTuplein call binding (#26886)Performance
Contributors
v0.0.71Compare Source
Released on 2026-08-12.
Library support
Diagnostics
__getattribute__calls (#27506)Core type checking
type[...]parameters (#27689)TypeVartypes when slicing (#27645)Selfand bounded type variables (#27644)_missing_methods (#27700)type[](#27663)Performance
Contributors
v0.0.70Compare Source
Released on 2026-08-10.
LSP server
TYPE_CHECKINGblocks (#27549)CLI
Diagnostics
unsound-return-statementlint (#27561)unsound-yieldlint (#27593)__getattr__calls (#27502)__get__calls (#27400)Core type checking
Generatoraliases when evaluating return, send, and yield types (#27577)TypedDictkey-membership truthiness (#27579)type[T](#27534)NewTypetypes and their underlying values (#27522)ClassVardeclarations for protocol members (#27530)Annotatedinsidetype[...](#27629)Contributors
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.