fix: upgrade Python and vulnerable test dependencies - #962
Conversation
|
@codex Please review the additional dependency-vulnerability remediation in 95e5d72.\n\nResolved lock selections: filelock 3.12.2 -> 3.32.2 (VULN-99752), idna 3.10 -> 3.18 (VULN-99761), pytest remains 9.1.1 (VULN-99789), and requests 2.31.0 -> 2.34.2 (VULN-99802).\n\nValidation: poetry check --lock; poetry run pip check; poetry run pytest -v tests/unit (525 passed, Python 3.13). |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 95e5d72ce8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "Programming Language :: Python :: 3.7", | ||
| "Programming Language :: Python :: 3.13", |
There was a problem hiding this comment.
Remove the obsolete Python 3.7 support claim
The package now requires Python 3.13, but its published classifiers still claim Python 3.7 support, and the user-facing prerequisites in docs/index.md:15, docs/how_to_use.md:59, and docs/troubleshoot.md:24 continue directing users to Python 3.7. Anyone following those instructions will have installation rejected by the new Requires-Python constraint, so the stale classifier and documentation should be updated with this compatibility change.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Addressed in 8e0ef43: removed the Python 3.7 classifier and updated the support and installation troubleshooting docs to Python 3.13. The docs/how_to_use.md 3.7 reference is Docker Compose file-format version 3.7, not a Python support claim, so it remains unchanged. Validation: poetry check --lock and 525 unit tests passed.
What changed
>=3.13,<3.14).pytestto 9.1.1 through the>=9.0.3,<10constraint.urllib3to 2.7.0 through the>=2.5.0,<3constraint.filelockto 3.32.2 through the>=3.20.3,<4constraint.idnato 3.18 through the dependency graph.requeststo 2.34.2 through the>=2.33.0,<3constraint.PSA vulnerability tickets remediated
Related downstream RFCT tickets
This PSA PR provides the compatible PSA versions needed by RFCT, but it does not close those RFCT tickets: their FOSSA findings are against
taautomation/regression_field_comparison_tool's ownpoetry.lock, which requires a separate RFCT remediation PR.Validation
poetry check --lockpassed.poetry run pip checkpassed.Compatibility impact
This intentionally drops Python 3.7–3.12 support because the selected pytest version requires Python 3.10+, and this PR standardizes PSA on Python 3.13.