chore(deps): upgrade all direct dependencies - #659
Merged
Merged
Conversation
Consolidates the open dependabot PRs (sqlparse 0.6.0, pillow 12.3.0, soupsieve 2.9.2) into a single refresh of the whole lock file, and raises the dev dependency floors that had fallen behind their locked versions. Notable upgrades: mypy 1.20 -> 2.3.1, ruff 0.15.17 -> 0.16.7, Django 6.0.3 -> 6.1.1 / 5.2.14 -> 5.2.17, pytest-django 4.12 -> 4.14, pytest-benchmark 5.2.3 -> 5.3.0, myst-parser 5.0 -> 5.1. Two fallouts required code changes: - mypy 2.x no longer infers the type of an empty dict literal at module scope, so `registry._REGISTRY` now carries an explicit annotation. - ruff 0.16 formats Python code blocks inside Markdown, which reformats fourteen files under `docs/`. Doctest blocks are untouched. Runtime dependency floors (pydot, PyYAML, jsonschema) are unchanged: they are the minimum versions supported for library consumers, not the versions under test. Sphinx, myst-parser and the remaining docs tooling stay unconstrained because their latest releases require Python 3.12+, while the project supports 3.10+; the resolver picks the right version per interpreter. Signed-off-by: Fernando Macedo <[email protected]>
actions/checkout v5 -> v7, actions/setup-python v6 -> v7, astral-sh/setup-uv v8.1.0 -> v10.1.0, codecov/codecov-action v6 -> v7, actions/upload-artifact v4 -> v7, actions/download-artifact v4 -> v8, actions/upload-pages-artifact v3 -> v5, actions/deploy-pages v4 -> v5. The breaking changes in these majors do not reach this repository: - checkout v7 blocks fork checkouts only for `pull_request_target` and `workflow_run`; the test workflow triggers on `pull_request`. - setup-python v7 drops the `pip-install` input, which is unused. - setup-uv v10 disables the cache for sensitive events under `enable-cache: auto`; both workflows set it to `true` explicitly. - upload-artifact v7 and download-artifact v8 are the matching pair for direct (unzipped) uploads; the release job uploads a directory, so it still ships a zip that v8 extracts as before. - upload-pages-artifact v4 stopped including dotfiles; the assembled `_site` has none. Signed-off-by: Fernando Macedo <[email protected]>
This was referenced Sep 13, 2026
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #659 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 52 52
Lines 5581 5582 +1
Branches 883 883
=========================================
+ Hits 5581 5582 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates the three open dependabot PRs into a single dependency refresh,
raises the dev dependency floors that had fallen behind, and brings the
GitHub Actions up to their latest majors.
Closes #648, closes #640, closes #637.
Python dependencies
uv lock --upgrademoved 48 packages. The direct ones:The dependabot PRs covered transitive packages, all included here:
sqlparse 0.5.5 -> 0.6.0, soupsieve 2.8.3 -> 2.9.2, pillow 12.2.0 -> 12.3.0.
Dev dependency floors
Every
>=floor in thedevgroup that had drifted below its locked versionwas raised to match. The previously unconstrained entries stay unconstrained:
Sphinx, myst-parser and the rest of the docs toolchain publish releases that
require Python 3.12+, so a floor there makes the project unresolvable on 3.10
and 3.11.
Runtime floors (
pydot >= 4.0.1,PyYAML >= 6.0,jsonschema >= 4.18) areuntouched. They declare the minimum a library consumer needs, not the version
this repo tests against, and tightening them would exclude working setups.
Fallout from the upgrades
mypy 2.x stopped inferring the type of an empty dict literal at module
scope, so
statemachine/registry.pynow annotates_REGISTRYexplicitly(
dict[str, type[StateMachine]], underTYPE_CHECKINGto avoid the cycle).ruff 0.16 formats Python code blocks inside Markdown files. Fourteen files
under
docs/are reformatted as a result: quote style, blank lines and commentalignment inside
python blocks. Doctest blocks (py with>>>) are nottouched, and the diff is cosmetic.
GitHub Actions
checkout v5->v7, setup-python v6->v7, setup-uv v8.1.0->v10.1.0,
codecov-action v6->v7, upload-artifact v4->v7, download-artifact v4->v8,
upload-pages-artifact v3->v5, deploy-pages v4->v5.
The breaking changes in these majors do not apply here: checkout v7 only blocks
fork checkouts on
pull_request_target/workflow_run; setup-python v7 dropsthe unused
pip-installinput; setup-uv v10 disables caching for sensitiveevents under
enable-cache: autowhile both workflows set it totrue;upload-artifact v7 and download-artifact v8 are the matching pair and the
release job uploads a directory, so it still ships a zip; upload-pages-artifact
v4 stopped including dotfiles and the assembled
_sitehas none.Note that this PR's CI exercises
python-package.ymlonly.release.ymlandpages.ymlare first exercised on the next tag and the next push todevelop.Verification
uv run pytest -n 4 --cov --cov-fail-under=100: 2161 passed, 1 skipped,44 xfailed, 100% branch coverage, no warnings.
uv run ruff check .andruff format --check .: clean.uv run mypy --namespace-packages --explicit-package-bases statemachine/ tests/:no issues in 258 files.
uv run pyright statemachine/: 0 errors.uv run sphinx-build docs docs/_build/html: succeeds with 48 warnings,the same 48 the build already emits on
develop.uv run pre-commit run --all-files: all hooks pass.