Repository navigation
Resolve the open dependency updates and stop the recurring failures - #55
Merged
Merged
Conversation
CodeQL requires every github/codeql-action step to run the same version. Dependabot opened init and analyze as separate PRs (#51, #52), so each one left the workflow mismatched and Analyze Python failed with 'Not all workflow steps that use github/codeql-action actions use the same version'. Bumping both together is the only form that passes.
Transitive dependency via pyjwt[crypto]. Dependabot (#49) updated uv.lock without regenerating requirements.lock, so the production dependency export check failed on every job. Both lockfiles are regenerated here with the same command CI verifies.
Groups actions/* and github/* into one pull request so related steps such as codeql-action init and analyze can never be bumped apart again. The HOL scanner action stays ungrouped because it is the only third-party action the Actions policy allows and each bump deserves its own review. spaCy is ignored at 3.8.14 and above: those releases still ship no CPython 3.14 wheels, so Dependabot was reopening a change every week that would break the macOS Python 3.14 jobs and contradict the pyproject constraint.
This was referenced Aug 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #49, #50, #51 and #52, all four of which were failing CI for
structural reasons rather than because the underlying updates were wrong.
Why every Dependabot PR was failing
#51 and #52 (codeql-action). CodeQL requires all
github/codeql-actionsteps to run the same version. Dependabot opened
initandanalyzeas twoseparate PRs, so each one left
codeql.ymlmismatched and the run failed:Neither PR could ever pass alone. Bumping both together to v4.37.6 does.
#49 (cryptography) and #50 (spaCy). CI verifies that
requirements.lockmatches
uv export. Dependabot updatespyproject.tomlanduv.lockbutcannot regenerate
requirements.lock, so the export check failed on everyjob in the matrix. This affects every Python update, not just these two.
What this does
5595ccafverified againstthe upstream
v4.37.6tag, matching what Dependabot proposed.uv.lockandrequirements.lockregenerated using the exact command CI checks.
actions/*andgithub/*are grouped into one PR, so paired steps likecodeql init and analyze can never be split again.
hashgraph-online/ai-plugin-scanner-actionis deliberately leftungrouped. It is the only third-party action the repository Actions
policy allows, so each bump should arrive as its own reviewable PR.
>=3.8.14.Why spaCy is ignored rather than merged
pyproject.tomlpinsspacy>=3.8.9,<3.8.14with this note:That is still true. Checking PyPI directly, both 3.8.14 and 3.8.15 publish 30
wheels each and zero are cp314, for macOS ARM or any other platform. #50
would have widened the range into exactly the versions that break the macOS
Python 3.14 jobs. Without an ignore entry, Dependabot reopens it every week.
Drop the ignore entry and widen the pyproject constraint together, once
upstream ships cp314 wheels.
Verification
uv lock --checkand thediff -u requirements.lockexport check pass locally.