build(deps-dev): Bump ruff from 0.15.21 to 0.16.0 in /services/account_unification - #31
Conversation
Bumps [ruff](https://github.com/astral-sh/ruff) from 0.15.21 to 0.16.0. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.21...0.16.0) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.16.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
|
Warning Review limit reached
Next review available in: 59 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Comment |
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
e82ccf80ecc4171daec56965caa248d9ec71be73. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- SAST Semgrep/Semgrep (multi-language SAST): FAILURE (https://github.com/ContextualWisdomLab/keyverse/actions/runs/30442418737/job/90544607665)
- Semgrep (multi-language SAST) check run: failure (https://github.com/ContextualWisdomLab/keyverse/actions/runs/30442418737/job/90544607665)
- account-unification-tests check run: failure (https://github.com/ContextualWisdomLab/keyverse/actions/runs/30442418794/job/90544607629)
- ci/account-unification-tests: FAILURE (https://github.com/ContextualWisdomLab/keyverse/actions/runs/30442418794/job/90544607629)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (2 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (2 files)"]
R1 --> V1["required checks"]
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (2 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (2 files)"]
R1 --> V1["required checks"]
|
|
Superseded by #33, which applies the Ruff upgrade together with an explicit stable lint rule set and a regenerated |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
* build(deps): consolidate account-unification dependency updates and pin ruff rule set Dependabot opened five PRs (#27-#31) bumping account_unification dependencies, but each only edited pyproject.toml (or targeted a transitive package) without regenerating uv.lock, so every one fails `uv sync --locked` on the account-unification-tests gate ("The lockfile at uv.lock needs to be updated"). Apply all five bumps in one lock-consistent change: - fastapi 0.139.0 -> 0.140.13 (pulls starlette 1.3.1) - uvicorn 0.51.0 -> 0.52.0 - ruff 0.15.21 -> 0.16.0 (dev) - annotated-doc 0.0.4 -> 0.0.5 (transitive) - annotated-types 0.7.0 -> 0.8.0 (transitive) ruff 0.16.0 widened its implicit default rule set (adding flake8-bugbear, pyupgrade, flake8-pyi, flake8-blind-except, RUF100, isort), which surfaced 21 lints on code that previously passed. Pin the classic default select (["E4","E7","E9","F"]) so the established lint policy stays explicit and stable across ruff upgrades instead of silently changing on a version bump. Verified in services/account_unification: `uv sync --locked --extra dev`, `ruff check app tests tools` (All checks passed), `interrogate .` (100%), `pytest -q` (52 passed). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AqtiEQFfuYFsS75Aku9tPT * fix(security): restrict healthcheck URL scheme and resolve Semgrep urllib finding The org-central "Semgrep (multi-language SAST)" gate reports a real Medium (WARNING) finding on every keyverse PR, blocking OpenCode approval: python.lang.security.audit.dynamic-urllib-use-detected services/account_unification/app/healthcheck.py:18 — dynamic value passed to urllib.request.urlopen (urllib honours file://, so a caller-controlled URL could read arbitrary files). Mitigate the actual risk by rejecting any non-http(s) scheme before opening the URL (closes the file:// vector), then annotate the audited call with a narrow, documented `# nosemgrep` for that single rule. Add a regression test for the rejected-scheme path. Fixed at base so all open keyverse PRs inherit a clean SAST gate. Verified in services/account_unification: `ruff check app tests tools`, `interrogate .` (100%), `pytest -q`. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AqtiEQFfuYFsS75Aku9tPT * chore: drop superseded healthcheck changes from dependency PR * test: drop superseded healthcheck coverage from dependency PR * build(deps-dev): bump anyio to 4.14.2 Integrate the validated AnyIO lockfile refresh into the consolidated account-unification dependency branch. * build(deps-dev): bump certifi to 2026.7.22 Integrate the validated certificate bundle lockfile refresh into the consolidated account-unification dependency branch. --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: opencode-agent[bot] <219766164+opencode-agent[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps ruff from 0.15.21 to 0.16.0.
Release notes
Sourced from ruff's releases.
... (truncated)
Changelog
Sourced from ruff's changelog.
... (truncated)
Commits
a2635fdBump 0.16.0 (#27136)3433449[ty] Reuse full call diagnostics for implicit setter calls (#27115)2240070Reflectruff: ignoreand--add-ignorestabilization in documentation (#27...17ef711Stabilize--add-ignore(#27125)ef912bbAdd newly stabilized rules to defaults (#27055)b30f040Stabilize new default rules (#27035)bcd70c5Exclude Markdown files fromformat-devruns (#27052)87e51e2Fixformat --checkspans for syntax errors (#27045)afe2723[flake8-gettext] Stabilize qualified-name and built-in binding resolution (...a9702d8[flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)