[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Changelog entry: N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• ci — workflows or build tooling

---

Description of your pull request and other information

Fixes main's red Dependabot check. The pip version-update job failed on every root Pipfile dev-package, starting with Invalid requirement: 'vermin=='.

Root cause.

• Dependabot replaces setup.py with a stub that passes no long description.
• pyproject.toml declared readme dynamic, so building the Pipfile's editable pypcapkit failed.
• Dependabot's fallback then ran pipenv upgrade 'vermin==' with a nil version.

Fix.

• readme is now static in pyproject.toml, and setup.py no longer reads README.md.
• Before and after, the built sdist and wheel have the same files and a byte-identical description.
• The metadata loses only its two Dynamic: description* lines.
• With the stub setup.py, the job's pipenv upgrade exits 1 on main and 0 here.

Also.

• The / job read conda/requirements.txt, though the config says it is left out. That file is where the cryptography bump came from.
• exclude-paths now skips it. In dependabot-core (FileFiltering.exclude_path?), the pattern matches the path from the repository root.

Tests. New tests in tests/project/test_actions_pinned_1968.py and tests/project/test_setup.py fail on main (4 failed) and pass here.

Part of #1968.

[JarryShaw]

GOOD TO GO at 752cbdd60. A Sonnet review of e9af37db5 reproduced the failure: with Dependabot's stub setup.py, pipenv upgrade vermin --dev exits 1 on main (setuptools cannot obtain the dynamic readme) and 0 here. It built the sdist and wheel on 3.12 and 3.7: the only metadata difference is the two Dynamic: description* lines, and the readme table is supported by the setuptools>=62.3.0 the build requires. It confirmed exclude-paths matches from the repository root, nothing else calls the removed get_long_description, and the new tests fail on main (4 failed). The real Dependabot job was not re-run, so the green check is inferred from the reproduction.

752cbdd60 only corrects a test docstring: the sanitizer's stub takes name= from setup.py, else default_package_name, not sanitized-package (checked against SetupFileSanitizer#package_name).

[github-actions]

Coverage: 91.52% (unit tier, Python 3.15, 752cbdd60, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19597	881	2618	867	92.11%
pcapkit/corekit	2540	71	808	37	96.54%
pcapkit/dumpkit	276	3	100	3	98.40%
pcapkit/foundation	2918	23	1016	25	98.78%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17450	226	4598	191	98.09%
pcapkit/toolkit	872	36	298	10	95.21%
pcapkit/utilities	522	2	158	4	99.12%
pcapkit/vendor	4431	1995	1018	167	51.73%

Per-file detail: the coverage-html artifact of this run.