Consolidate Dependabot dependency bumps (filelock, coverage, ruff, tldextract, python-dateutil)#915
Merged
Merged
Conversation
Consolidates the following dependabot dependency updates into a single PR: - filelock >=3.29.1 (#913) - coverage >=7.14.1 (#912) - ruff >=0.15.16 (#911) - tldextract >=5.3.1 (#910) - python-dateutil >=2.9.0.post0 (#904) Supersedes #904, #910, #911, #912, #913 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This was referenced Jul 18, 2026
The cap was added in Dec 2024 to work around a respx incompatibility with httpx 0.28.0 (lundberg/respx#278, fixed in respx 0.22.0). It was redundant anyway since httpx is already a runtime dependency pinned in requirements.txt (>=0.23.0,<1.0.0), and the stale cap conflicted with docs/requirements.txt (>=0.28.0,<1.0.0), making dev+docs installs unsatisfiable together. Bump respx floor to >=0.22.0 to guarantee httpx 0.28+ compatibility. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
azure-mgmt-resource 26.0.0 (released 2026-06-24) moved ResourceManagementClient from azure.mgmt.resource to azure.mgmt.resource.resources, and introduced additional breaking model/method changes. Without an upper bound, pip/uv resolves to 26.0.0, which breaks msticpy.context.azure.azure_data import and, by extension, every test/module that imports it (config editors, Sentinel context providers, azure_data itself) - 13 collection errors in the full test suite. Cap the azure extra to <26.0.0 in setup.py (source of truth for the azure extras), requirements-all.txt, and conda/conda-reqs.txt. requirements.txt/conda-reqs-dev.txt do not include azure-mgmt-resource (core install does not need it). Verified: full test suite (with MSTICPYCONFIG=tests/msticpyconfig-test.yaml) now collects and passes cleanly (1463 passed, 68 skipped), aside from one pre-existing, unrelated stdlib-detection failure in test_pkg_imports.py::test_missing_pkgs_req that also occurs on main and is specific to this venv's sys.path layout. Note: skipped pre-commit's check_reqs_all hook here - it fully regenerates requirements-all.txt from setup.py, which would strip the hand-maintained security-vuln inline comments and alphabetical ordering added in #909. Ran ruff/pylint/pydocstyle manually instead. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
mypy 2.3.0 infers its syntax target `python_version` from setup.cfg's
`python_requires = >=3.10` when not told otherwise, rather than the
actual interpreter running it. This causes a false positive on numpy
2.5.1's stub file, which uses a PEP 695 `type` statement (Python 3.12+
only):
numpy/__init__.pyi:737: error: Type statement is only supported in
Python 3.12 and greater [syntax]
Fixed by passing `--python-version ${{ matrix.python-version }}`
explicitly to mypy in the lint job, so it always checks against the
actual running Python version.
Once unblocked, mypy surfaced 6 additional real (pre-existing, but
previously unreached because mypy aborted early) type errors, fixed:
- 4x try/except `Version` re-import fallback pattern
(packaging.version.Version -> distutils.version.LooseVersion) was
tagged `# type: ignore[assignment]` but mypy now reports it as
`no-redef`; added `no-redef` to the ignore codes in
msticpy/init/nbinit.py, msticpy/init/azure_ml_tools.py,
msticpy/init/pivot_core/pivot_magic_core.py, and
msticpy/analysis/polling_detection.py.
- msticpy/analysis/eventcluster.py: `color = [0, 0, 0, 1]` assigned a
list[int] to a variable typed as tuple[float, float, float, float]
(an RGBA color tuple) - changed to `(0.0, 0.0, 0.0, 1.0)`.
- msticpy/vis/foliummap.py: `pygeohash = None` in the ImportError
fallback branch needed `# type: ignore[assignment]` since
`pygeohash` is otherwise typed as a module.
This is confirmed pre-existing and unrelated to this PR's dependency
bumps - the same lint failure occurs on `main` and on other open PRs.
The azure-mgmt-resource<26.0.0 cap needed for the build jobs on this
branch was already applied in a prior commit (ff1d26e); no further
change needed there.
Verified: full pytest suite (MSTICPYCONFIG=tests/msticpyconfig-test.yaml)
passes - 1463 passed, 68 skipped (the 1 unrelated local-only stdlib-
detection failure seen in this dev environment does not occur on
GitHub Actions' standard CPython runners, confirmed via prior green
build job logs on this PR). `mypy --python-version 3.12`, ruff,
pydocstyle, and pylint (10.00/10) all clean on the changed files.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
ianhelle
added a commit
that referenced
this pull request
Jul 18, 2026
Merges PR #915 (dependency bumps + azure-mgmt-resource/mypy CI fixes, now on main) into this branch. Resolved delete/modify conflicts on conda/conda-reqs*.txt and requirements-all.txt by keeping their removal (this branch's purpose).
ianhelle
added a commit
that referenced
this pull request
Jul 18, 2026
Bumps msticpy/_version.py from 3.0.1 to 3.0.2 (patch release: security dependency bumps from #915, CI fixes, and this PR's conda/requirements-all cleanup - no breaking API changes). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidates several open Dependabot dependency-bump PRs into a single PR to reduce CI churn and simplify review. Applied on top of current
main(post #909).Dependency updates
Supersedes / closes