Skip to content

2026 10 08 tjr update ci - #429

Open
tomrittervg wants to merge 2 commits into
masterfrom
2026-10-08-tjr-update-ci
Open

tomrittervg wants to merge 2 commits into
masterfrom
2026-10-08-tjr-update-ci

Conversation

@tomrittervg

Copy link
Copy Markdown
Collaborator

No description provided.

Refresh the lock and raise the minimum of each direct dependency to the newly
locked version. This picks up fixes for known vulnerabilities in urllib3
(2.6.3 -> 2.8.0), cryptography (46.0.7 -> 50.0.2) and idna (3.11 -> 3.20);
pip-audit now reports none.
- actions/checkout v3 -> v7 and actions/setup-python v4 -> v7 (node24).
- Keep testing 3.10-3.14: 3.10 is still mach's minimum, production runs 3.11
  and the Windows task uses MozillaBuild's 3.12.
- Run `poetry install` in the lint and test jobs instead of relying on the
  build job's cache being restored.
- Fail if poetry's virtualenv isn't on the matrix Python. Poetry 2.1.1 (what
  production uses) builds the venv with its own interpreter regardless of
  PATH, which would make every matrix entry test the same Python; that's also
  why CI doesn't pin to it.
- Drop the unused poetry-version matrix entry.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant