Skip to content

Update uv.lock to fix open Dependabot alerts - #296

Merged
kurok merged 1 commit into
mainfrom
fix/dependabot-uv-lock
Oct 25, 2026
Merged

kurok merged 1 commit into
mainfrom
fix/dependabot-uv-lock

Conversation

@kurok

@kurok kurok commented Oct 25, 2026

Copy link
Copy Markdown
Owner

Closes the 14 open Dependabot alerts (#35–#48), all in uv.lock.

Package Was Now Alerts
aiohttp 3.14.3 3.14.5 #36–38, #42–46 (needs ≥ 3.14.4)
urllib3 2.7.0 2.8.0 #35, #39, #40
certifi 2026.4.22 2026.10.23 #47 (critical)
multidict 6.7.1 7.1.0 (py3.10) / 7.2.1 #41
opentelemetry-api 1.41.1 1.45.1 #48

The other OpenTelemetry packages, yarl and a few transitive dependencies move with them; importlib-metadata and zipp drop out. pyproject.toml is unchanged.

Checked locally with uv sync --all-extras: pytest 1940 passed, ruff and mypy clean.

Bump aiohttp, urllib3, certifi, multidict and opentelemetry-api to their
patched releases (alerts #35-#48). Only these packages and their
transitive dependencies were re-resolved; pyproject.toml is unchanged.
Tests (1940), ruff and mypy pass.

Signed-off-by: kurok <22548029+kurok@users.noreply.github.com>
@codecov

codecov Bot commented Oct 25, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

@kurok
kurok merged commit 25ce91a into main Oct 25, 2026
17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant