Skip to content

build(deps): bump the github-workflows group across 1 directory with 2 updates - #1199

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dot-github/workflows/github-workflows-2cda12ab30
Closed

build(deps): bump the github-workflows group across 1 directory with 2 updates#1199
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dot-github/workflows/github-workflows-2cda12ab30

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-workflows group with 2 updates in the /.github/workflows directory: envoy-code-check and yarl.

Updates envoy-code-check from 0.6.1 to 0.6.8

Commits

Updates yarl from 1.23.0 to 1.24.5

Release notes

Sourced from yarl's releases.

1.24.5

[!IMPORTANT] The v1.24.3 and v1.24.4 releases never published: their wheel builds failed on the emulated odd architectures, so no packages reached PyPI and no GitHub release was created for either version. No changes were lost; everything intended for v1.24.3 and v1.24.4 shipped in v1.24.5. Their changelog entries are reproduced below.

Contributor-facing changes

  • Restricted the exhaustive IDNA default-ignorable sweep test to a native Linux x86_64 runner. It iterates roughly 140,000 code points and its result does not depend on the architecture, so running it under emulated wheel builds only added minutes and intermittently crashed the test workers -- by :user:bdraco.

    Related issues and pull requests on GitHub: #1806.

v1.24.4

(2026-07-19)

Packaging updates and notes for downstreams

  • Stopped installing hypothesis in the wheel-build test environment. The property-based quoting tests that need it are skipped there already, and building it from source on architectures without a prebuilt wheel (such as armv7l musllinux, where the build pulls in a Rust toolchain) was failing the wheel jobs -- by :user:bdraco.

    Related issues and pull requests on GitHub: #1804.

v1.24.3

(2026-07-19)

Bug fixes

... (truncated)

Changelog

Sourced from yarl's changelog.

v1.24.5

(2026-07-19)

Contributor-facing changes

  • Restricted the exhaustive IDNA default-ignorable sweep test to a native Linux x86_64 runner. It iterates roughly 140,000 code points and its result does not depend on the architecture, so running it under emulated wheel builds only added minutes and intermittently crashed the test workers -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:1806.

v1.24.4

(2026-07-19)

Packaging updates and notes for downstreams

  • Stopped installing hypothesis in the wheel-build test environment. The property-based quoting tests that need it are skipped there already, and building it from source on architectures without a prebuilt wheel (such as armv7l musllinux, where the build pulls in a Rust toolchain) was failing the wheel jobs -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:1804.

v1.24.3

(2026-07-19)

... (truncated)

Commits
  • 0b30cb0 Release 1.24.5 (#1807)
  • 56150c8 Run the IDNA sweep test only on native Linux x86_64 (#1806)
  • 515adca Release 1.24.4 (#1805)
  • ab5dec2 Do not install hypothesis in the wheel-build test env (#1804)
  • f9d10fb Release 1.24.3 (#1803)
  • 058b7cb Test lone surrogate handling in encoded and parsed URL paths (#991)
  • a181cee Update hypothesis requirement from >=6.156.4 to >=6.157.0 in /requirements (#...
  • 28c1bcc Encode scheme-shaped path colon in relative-path builders (#1802)
  • 51e2802 Reject hosts with Unicode default-ignorable code points (#1801)
  • 3921a73 Drop lone surrogates that split a percent escape in the Cython quoter (#1752)
  • Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels May 15, 2026
@dependabot @github

dependabot Bot commented on behalf of github May 22, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

27 similar comments
@dependabot @github

dependabot Bot commented on behalf of github May 25, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github May 27, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github May 28, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github May 29, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 1, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 3, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 4, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 5, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 8, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 9, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 10, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 11, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 12, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 15, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 16, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 17, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 18, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 19, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 22, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 23, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 24, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 25, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 26, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 29, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jun 30, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jul 1, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jul 2, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jul 3, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

13 similar comments
@dependabot @github

dependabot Bot commented on behalf of github Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jul 7, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jul 9, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jul 10, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jul 13, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jul 14, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jul 16, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jul 17, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Jul 22, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't update vulnerable dependencies without a lockfile. Because of this, Dependabot cannot update this pull request.

@phlax phlax added the pick-me label Jul 26, 2026
@dependabot
build(deps): bump the github-workflows group across 1 directory with …
5d586f2 
…2 updates

Bumps the github-workflows group with 2 updates in the /.github/workflows directory: [envoy-code-check](https://github.com/envoyproxy/toolshed) and [yarl](https://github.com/aio-libs/yarl).


Updates `envoy-code-check` from 0.6.1 to 0.6.8
- [Release notes](https://github.com/envoyproxy/toolshed/releases)
- [Commits](https://github.com/envoyproxy/toolshed/commits)

Updates `yarl` from 1.23.0 to 1.24.5
- [Release notes](https://github.com/aio-libs/yarl/releases)
- [Changelog](https://github.com/aio-libs/yarl/blob/master/CHANGES.rst)
- [Commits](aio-libs/yarl@v1.23.0...v1.24.5)

---
updated-dependencies:
- dependency-name: envoy-code-check
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-workflows
- dependency-name: yarl
  dependency-version: 1.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-workflows
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/dot-github/workflows/github-workflows-2cda12ab30 branch from a9b31f0 to 5d586f2 Compare July 26, 2026 19:19
Copilot AI mentioned this pull request Jul 26, 2026
Closed
@phlax

phlax commented Jul 26, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Jul 26, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 26, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/dot-github/workflows/github-workflows-2cda12ab30 branch July 26, 2026 20:11
@phlax phlax removed the pick-me label Jul 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@phlax