Repository navigation
DLPX-100204 dependency-bump: batch update 9 dependencies (consolidates 21 PRs) - #747
Open
delphix-devops-bot wants to merge 1 commit into
Open
delphix-devops-bot wants to merge 1 commit into
delphix-devops-bot wants to merge 1 commit into
Conversation
delphix-devops-bot
marked this pull request as ready for review
November 3, 2026 19:50
…s 21 PRs) PR URL: https://www.github.com/delphix/virtualization-sdk/pull/747 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
delphix-devops-bot
force-pushed
the
dlpx/pr/delphix-devops-bot/e431bf6e-86a4-4d01-a270-2ad514d43523
branch
from
November 3, 2026 19:50
b244cb1 to
7abbbd5
Compare
This was referenced Nov 3, 2026
delphix-devops-bot
added
the
dependency-bump/risk-low
Contributor
Author
|
dependency-bump reconcile — 2026-11-04 — all green, no changes needed
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR
Consolidates 21 open Dependabot PRs for 9 dependencies into one batch, all resolved to latest-stable. No major-version crossings, no applicable CVEs, no breaking-change commits identified. Build passes (both passes, all 5 modules) on the first attempt — no fix-and-retry needed. Both
[sync]automations (flake8, end-to-enddvp build --devsmoke test) also passed.Batch risk tier: LOW
✅ dependency-bump verified: every dependency in this batch is LOW risk (build passes, no exploitable CVEs).
Dependencies in this batch (9)
pytest9.1.1→9.2.0pluggy1.6.0→1.7.0zipp4.1.0→4.1.2flake87.4.1→7.5.0configparser>=7.2,<7.3→7.3.0more-itertools11.1.0→11.2.1entrypoints0.4→0.4.2coverage7.16.2→7.17.1pyflakes4.0.3→4.1.0pytest:9.1.1→9.2.0— risk: LOWManifests affected:
common/pyproject.tomllibs/pyproject.tomlplatform/pyproject.tomltools/pyproject.tomldvp/pyproject.tomlCVE findings (0 in this version range):
One historical advisory exists for this dependency — GHSA-6w46-j5rx-g56g / CVE-2025-71176 (medium, "pytest has vulnerable tmpdir handling"), vulnerable range
< 9.0.3, fixed in9.0.3. This repo's pre-bump pin (9.1.1) already postdates the fix, so it does not apply to this transition.Commit breakdown (250 commits, GitHub compare API cap — the real range is likely larger):
No CVE-tagged or breaking-change commits identified in range.
pluggy:1.6.0→1.7.0— risk: LOWManifests affected:
common/pyproject.tomllibs/pyproject.tomlplatform/pyproject.tomltools/pyproject.tomldvp/pyproject.tomlCVE findings (0 in this version range): No CVE-tagged commits between
1.6.0and1.7.0.Commit breakdown (250 commits, GitHub compare API cap — the real range is likely larger):
No CVE-tagged or breaking-change commits identified in range.
zipp:4.1.0→4.1.2— risk: LOWManifests affected:
common/pyproject.tomllibs/pyproject.tomlplatform/pyproject.tomltools/pyproject.toml(dev pin; the package's separate runtime range>= 3.23, < 4.2already covers4.1.2and was not touched)dvp/pyproject.tomlCVE findings (0 in this version range):
One historical advisory exists for this dependency — GHSA-jfmj-5v4g-7637 / CVE-2024-5569 (medium, "zipp Denial of Service vulnerability"), vulnerable range
< 3.19.1, fixed in3.19.1. This repo's pre-bump pin (4.1.0) already postdates the fix, so it does not apply to this transition.Commit breakdown (33 commits):
One commit removes Python ≤3.9 compatibility shims — this repo requires Python 3.11 only, so it's not applicable.
zippis also a real runtime dependency ofdvp-tools(shipped topip install dvpusers via itstools/pyproject.tomlrange constraint), not just a test-only tool — noted since its impact extends beyond CI.flake8:7.4.1→7.5.0— risk: LOWManifests affected:
tools/pyproject.toml— two lines changed: the dev exact pin (7.4.1→7.5.0) and the runtime range constraint (>= 7.3, < 7.5→>= 7.3, < 7.6, consolidated from the same source PR, Bump flake8 from 7.4.1 to 7.5.0 in /tools #742)Note:
flake8is also a real runtime dependency ofdvp-tools(line 35 oftools/pyproject.toml), shipped to everypip install dvpuser, not just a dev/lint tool for this repo's own CI.CVE findings (0 in this version range): No CVE-tagged commits between
7.4.1and7.5.0.Commit breakdown (16 commits):
No CVE-tagged or breaking-change commits identified in range.
configparser:>= 7.2, < 7.3→7.3.0— risk: LOWNote: this dependency's manifest declares a version range, not an exact pin — the source PR (#738) proposed widening it to
>= 7.2, < 7.4.7.2(the range's old lower bound) is used only as a proxy for policy comparisons; it is not necessarily the exact version actually installed (the pre-bump install already satisfied the new range and was not force-upgraded — see the freeze diff below).Manifests affected:
tools/pyproject.toml(runtime dependency, shipped topip install dvpusers)CVE findings (0 in this version range): No advisories found for
configparser.Commit history: unavailable — none of the standard tag-naming conventions (
<version>,v<version>,release-<version>,<dep>-<version>,<dep>@<version>) resolved a7.2tag injaraco/configparser(the real tag isv7.2.0, notv7.2— our lower-bound proxy doesn't match it exactly). No advisories were found either, so this has no effect on the risk tier, but is noted here for transparency.more-itertools:11.1.0→11.2.1— risk: LOWManifests affected:
tools/pyproject.toml(dev-only, not shipped todvpend users)CVE findings (0 in this version range): No CVE-tagged commits between
11.1.0and11.2.1.Commit breakdown (180 commits):
Includes a fix to
seekable.peek/bool(no longer drops items whenmaxlenis 0) — a bug fix, not a breaking API change. No CVE-tagged or breaking-change commits identified.entrypoints:0.4→0.4.2— risk: LOWManifests affected:
tools/pyproject.toml(dev-only, not shipped todvpend users)CVE findings (0 in this version range): No CVE-tagged commits between
0.4and0.4.2.Commit breakdown (9 commits):
coverage:7.16.2→7.17.1— risk: LOWManifests affected:
tools/pyproject.toml(dev-only, not shipped todvpend users)CVE findings (0 in this version range): No CVE-tagged commits between
7.16.2and7.17.1.Commit breakdown (84 commits):
Version note: source PR #730 proposed
coverage 7.17.0. dependency-bump resolved to7.17.1(policy:latest-stable) — a newer patch release appeared on PyPI after the source PR was opened, bringing the repo fully current rather than partially upgraded.pyflakes:4.0.3→4.1.0— risk: LOWManifests affected:
tools/pyproject.toml(dev-only, not shipped todvpend users)CVE findings (0 in this version range): No CVE-tagged commits between
4.0.3and4.1.0.Commit breakdown (5 commits):
Source PRs consolidated (21)
dependency-bump does not close these. Once this PR merges and dep versions match the manifests, the bot that opened each one is responsible for auto-closing it on its own next scan.
Build verification
Commands run (per
.claude/dependency-bump.md), against all 5 modules (all affected by this batch):sh bin/build_project.sh -bsh bin/build_project.sh -ctfAdditional automations
Run against the pushed batch branch, after this PR was opened — see the PR's edit history if you're reading this before they've landed.
sh bin/build_project.sh -f— clean on all 5 modulesdvp init --root-dir . && dvp build --dev— ran from an isolated temp directory with~/.dvp/configpointed at this checkout;dvp initscaffolded a plugin,dvp build --devbuilt the wrappers from source and producedartifact.json(~1.0 MB)trigger_blackbox.sh ... virtualization_sdk APPDATA_SDK_UBUNTU20_STAGED_CENTOS73— triggered successfully, not factored into risk tier→ Tracking URL: https://selfservice-jenkins.eng-tools-prd.aws.delphixcloud.com/job/blackbox-self-service/237924/ — check here for the actual result
trigger_blackbox.sh ... appdata_basic APPDATA_PYTHON_STAGED_RHEL93— triggered successfully, not factored into risk tier→ Tracking URL: https://selfservice-jenkins.eng-tools-prd.aws.delphixcloud.com/job/blackbox-self-service/237925/ — check here for the actual result
Installed package changes (
pip freezediff)The diff below shows the full effect of this batch — including transitive deps that updated as a side effect.
configparserandzipp's runtime range constraint are not shown below: their pre-bump installed versions already satisfied the newly widened ranges, so pip did not upgrade them in place.8 explicit package version changes, no unexpected transitive bumps.
Generated by dependency-bump · policy:
latest-stable