Repository navigation
Conversation
- aiohttp>=3.14.4 (py>=3.10)
- cryptography>=50.0.0 (py>=3.10) synced across ci/common.txt and static/pkg/
- msgpack>=1.2.3 (py>=3.10)
- opentelemetry-api/sdk/exporter-otlp-proto-http>=1.45.1 (py>=3.10)
- urllib3>=2.8.0 (py>=3.10)
- requests>=2.33.1 (py3.10 only): fixes an inverted range from the 2026-04-06
merge-forward that capped py3.10 at <2.32.0
Regenerated py3.{9-14} x {linux,freebsd,darwin,windows} locks via pre-commit
pip-compile hooks.
Deferred (constraints or codebase-audit blockers):
- virtualenv>=21.14.9 cascades to packaging>=26.3 which conflicts with the
packaging==24.0 pin held for salt-ssh target compatibility
- filelock>=4.2.1 requires Python>=3.11
- pylint 4.x needs E0601/E0602/E0606 audit (existing comment)
- pytest>=9.0.3 needs pytest-salt-factories compat review
- pip 26.x in constraints.txt breaks the py3.14 pre-commit venv
- ansible>=12.2.0 drops AL2 interpreter discovery (existing comment)
relenv-ssh ships a bundled interpreter to target hosts, so the
packaging==24.0 pin (held because packaging 24.1+ used
'from __future__ import annotations' and packaging 26.x used
positional-only '/' syntax, both SyntaxErrors on AL2's stock
Python 3.7 under the legacy salt-ssh thin tarball) is no longer
needed.
- packaging>=26.3 unified for all py versions (removes the
py>=3.11,<3.14 == 24.0 pin and the py>=3.14 <27 cap)
- virtualenv>=21.14.9 (py>=3.10), which hard-requires packaging>=26.3
- filelock>=4.2.1 (py>=3.11) and filelock>=3.29.1,<4.0.0 (py3.10):
filelock 4.2+ requires Python>=3.11 so py3.10 stays on the 3.29 line
Regenerated all static/{pkg,ci}/py3.{9-14}/*.lock files via the
pip-compile pre-commit hooks.
2 tasks
Contributor
Author
|
Superseded by #70629 which targets 3008.x. Closing this one — 3008.x will merge-forward to master. |
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bulk floor bump of pinned dependencies in
requirements/base.txt,requirements/static/ci/common.txt, andrequirements/static/pkg/{linux,freebsd}.txtto clear open Dependabot security alerts on master. Regenerates allrequirements/static/{pkg,ci}/py3.{9..14}/*.locklock files via thepip-compilepre-commit hooks.Bumped (py>=3.10 clauses only; 3.9 clauses intentionally frozen)
<2.32.0>=2.33.1The
requestspy3.10 cap was an inverted range introduced by the 2026-04-06 merge-forward — py3.10 was being held below the CVE floor while py3.9 and py3.11+ were above it.Deferred to follow-up PRs
packaging>=26.3, conflicts with the deliberatepackaging==24.0pin held for salt-ssh target compatlint.txtholds at 3.1 pending codebase audit for new default-on E0601/E0602/E0606 checks<9cap)tools/pkg/build.pyand is already 26.2). Comment calls out a vendored-pygments breakage in pip 26.0.1 on the py3.14 pre-commit hook venvAlert cleanup
Running against the 118 open alerts, this PR should clear roughly the aiohttp / cryptography / msgpack / opentelemetry / urllib3 / requests subset (approximately 60 alerts). The remaining ~55 alerts are from the deferred set above and are tracked as follow-up work.
Test plan