chore(deps): bump for 3.13 wheel coverage - #59439
Merged
Merged
Conversation
Member
Author
This was referenced May 21, 2026
Contributor
|
🎭 Playwright didn't run on this PR — your changes touch code that could affect E2E behavior, but Playwright is opt-in via label now to keep CI cost down. Add the Most PRs don't need this. Real regressions still get caught on master and fix-forward. |
Contributor
|
Size Change: +7.93 kB (+0.01%) Total Size: 116 MB 📦 View Changed
ℹ️ View Unchanged
|
Contributor
✅ Hobby deploy smoke test: PASSEDHobby deployment smoke test passed successfully. |
rnegron
force-pushed
the
pr-2-python313-deps
branch
from
May 21, 2026 17:22
5e663de to
c2bf0a1
Compare
rnegron
force-pushed
the
pr-1-python313-prep
branch
from
May 21, 2026 17:22
bcc9832 to
a217170
Compare
rnegron
force-pushed
the
pr-2-python313-deps
branch
from
May 26, 2026 14:49
c2bf0a1 to
725224d
Compare
rnegron
force-pushed
the
pr-2-python313-deps
branch
from
May 26, 2026 17:45
725224d to
cdec827
Compare
rnegron
marked this pull request as ready for review
May 26, 2026 19:09
Contributor
|
Reviews (1): Last reviewed commit: "Merge branch 'master' into pr-2-python31..." | Re-trigger Greptile |
![mendral-app[bot]](https://avatars.githubusercontent.com/in/1975249?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Supply Chain Security Review
✅ Approve — 1 finding in 1 file
Routine dependency upgrades (clickhouse-driver, nh3, openpyxl, paramiko). GHSA-r374-rxx8-8654 (low, SHA-1 in paramiko rsakey.py) affects all versions through 4.0.0 with no fix available — pre-existing, not newly introduced.
Tag @mendral-app with feedback or questions. View session
rnegron
force-pushed
the
pr-2-python313-deps
branch
from
May 26, 2026 19:44
c32a68d to
9efcd27
Compare
rnegron
force-pushed
the
pr-2-python313-deps
branch
2 times, most recently
from
May 26, 2026 20:25
11ec1b7 to
b4bd2ba
Compare
Contributor
webjunkie
approved these changes
May 27, 2026
rnegron
force-pushed
the
pr-2-python313-deps
branch
from
May 27, 2026 16:49
b4bd2ba to
1a2c401
Compare
Contributor
There was a problem hiding this comment.
Supply Chain Security Review
✅ Approve — 1 finding in 1 file
Routine dependency upgrades (clickhouse-driver, nh3, openpyxl, paramiko). All new versions published well over 7 days ago. GHSA-r374-rxx8-8654 (LOW) in paramiko affects all versions ≤4.0.0 equally — both old and new pins are affected; no regression introduced.
Tag @mendral-app with feedback or questions. View session
| "orjson==3.11.6", | ||
| "pandas~=2.2.2", | ||
| "paramiko==3.4.1", | ||
| "paramiko~=3.5.0", |
Contributor
There was a problem hiding this comment.
maintainability (P3): paramiko changed from exact pin (==3.4.1) to compatible-release specifier (~=3.5.0), allowing automatic patch bumps within 3.5.x. This is inconsistent with most other deps in this file that use == pins. Intentional loosening is fine if desired, but worth confirming.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At pyproject.toml, line 98:
<issue>
paramiko changed from exact pin (`==3.4.1`) to compatible-release specifier (`~=3.5.0`), allowing automatic patch bumps within 3.5.x. This is inconsistent with most other deps in this file that use `==` pins. Intentional loosening is fine if desired, but worth confirming.
</issue>
Contributor
There was a problem hiding this comment.
Supply Chain Security Review
✅ Approve — 1 finding in 1 file
⚠️ paramiko@3.5.1 — CVE-2026-44405 (low severity, no fix available)
GHSA-r374-rxx8-8654 / CVE-2026-44405: Paramiko rsakey.py allows the SHA-1 algorithm. Affects all versions through 4.0.0 — no fixed release exists yet. CVSS 3.1 score is low (AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N). The fix commit exists upstream (a448945) but hasn't been released. This is informational only; the vulnerability requires adjacent network access with high attack complexity and provides minimal integrity impact.
Tag @mendral-app with feedback or questions. View session
| "orjson==3.11.6", | ||
| "pandas~=2.2.2", | ||
| "paramiko==3.4.1", | ||
| "paramiko~=3.5.0", |
Contributor
There was a problem hiding this comment.
maintainability (P3): paramiko changed from exact pin (==3.4.1) to compatible-release specifier (~=3.5.0). The lockfile still pins to 3.5.1, but this allows minor version drift on re-lock. Other dependencies in this file use exact pins — consider keeping consistency.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At pyproject.toml, line 98:
<issue>
paramiko changed from exact pin (`==3.4.1`) to compatible-release specifier (`~=3.5.0`). The lockfile still pins to 3.5.1, but this allows minor version drift on re-lock. Other dependencies in this file use exact pins — consider keeping consistency.
</issue>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Four direct dependencies either lack Python 3.13 wheels or sit below their first 3.13-classified release. Bumping them on the existing 3.12 pin so the version bump itself is decoupled from dep churn.
Changes
==0.2.9==0.2.10Python :: 3.13classifier.==0.2.14==0.3.5==3.1.2==3.1.5==3.4.1~=3.5.0How did you test this code?
Agent-authored. Import smoke for all four packages on 3.12 venv; nh3 sanitization smoke on a survey-style payload;
pytest products/surveys/backend/api/test/test_survey.py -k "nh3 or sanitiz or xss or html"(7 passed). Fullruff check .clean.Publish to changelog?
no
🤖 Agent context
Authored by Claude Code as PR 2 of a 3-PR stack moving the monorepo from Python 3.12.12 to 3.13.13. This PR lands on 3.12 — bumping deps first means each can be reverted independently from the version cutover (#59440).