`uv.lock` is stuck on GitPython 3.1.58 and Pillow 12.3.0

Abierto
  • ¿Algo no está bien?
#287 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
48/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
github-actions, python
Área
devops, security

Línea de trabajo

Read pyproject.toml and the Dependabot configuration, then inspect the linked logs and PRs #275 and #277 to understand the metadata rewrite and Python version constraint. Check how the project’s supported Python versions affect both dependency updates and CI. Done means GitPython and Pillow can be updated to secure compatible versions, dependency checks pass, and lint passes without an unrelated Ruff upgrade.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

uv.lock on master (v1.59.1) still locks GitPython 3.1.58 and Pillow 12.3.0. Both have published advisories, fixed in GitPython 3.2.1 and Pillow 13.0.0, but neither Dependabot security update can land.

  • GitPython: #275 rewrites gitpython>=3.1.58 in pyproject.toml as gitpython*, so every check fails while building the package metadata (log):

    ValueError: Dependency #4 of field `project.dependencies` is invalid: Expected semicolon (after name with no version specifier) or end
    gitpython*
             ^

    This is the same name* rewrite as dependabot/dependabot-core#15639; versioning-strategy: increase did not prevent it here. #277 also moves GitPython to 3.2.1 and passes the tests, but it also upgrades ruff to 0.17.2, which fails lint.

  • Pillow: Pillow 13.0.0 requires Python 3.11 or later, and dvsim supports 3.10, so the security update job gives up (log):

    Filtered out pillow 13.0.0 because python requirement >= 3.11 is not satisfied by python 3.10.22
The latest possible version of pillow that can be installed is 12.3.0
security_update_not_possible

Found while relocking the same packages in chipsalliance/caliptra-rtl#1545.

Lenguaje dominante
Python
Estrellas
16
Forks
23
Merge medio
2 h 42 min
PR fusionados (30 d)
3

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de lowRISC/dvsim

Todos los issues de lowRISC/dvsim

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.