From 89c1cdc75ffa3b2d53b362385ea9c1a49aefee8e Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 29 Sep 2026 20:41:08 +0000 Subject: [PATCH] =?UTF-8?q?build(deps):=20consolida=20as=20atualiza=C3=A7?= =?UTF-8?q?=C3=B5es=20pendentes=20do=20Dependabot?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Substitui os PRs abertos do Dependabot por um só: - requirements.txt: cryptography 50.0.0, PyJWT 2.15.0, requests 2.33.0 (correções de segurança), Flask-Compress 1.25, Flask-Cors 6.0.5, psycopg2 2.9.13, pymongo 4.18.2, pyparsing 3.3.3, pytz 2026.4, werkzeug 3.1.8. - requirements-ci.txt: lxml 6.1.3, pysaml2 7.5.5, python-ldap 3.4.8. - requirements-dev.txt: pylint 4.0.9, pytest>=9.1.1, setuptools>=84. - Actions: checkout v7, setup-python v7, codeql-action v4. - dependabot.yml: rodada mensal, tudo agrupado (atualizações, majors e segurança em no máximo um PR cada; Actions num PR só). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_017ytYXYq4ZUt1EUoaNC3n3m --- .github/dependabot.yml | 24 +++++++++++++++++------- .github/workflows/analysis.yml | 8 ++++---- .github/workflows/lint.yml | 4 ++-- .github/workflows/tests.yml | 4 ++-- requirements-ci.txt | 6 +++--- requirements-dev.txt | 6 +++--- requirements.txt | 20 ++++++++++---------- 7 files changed, 41 insertions(+), 31 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 82c4661bd..54cea050e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -2,20 +2,30 @@ version: 2 updates: - # Dependências Python. Menores e patches chegam agrupados num PR por semana - # para não virar ruído; majors continuam vindo um por dependência, para - # avaliar caso a caso. + # Dependências Python: uma rodada por mês, tudo agrupado. No máximo um PR + # de atualizações (menores e patches), um de majors e um de correções de + # segurança, em vez de um PR por dependência. - package-ecosystem: "pip" directory: "/" schedule: - interval: "weekly" - open-pull-requests-limit: 5 + interval: "monthly" + open-pull-requests-limit: 3 groups: - minor-e-patch: + atualizacoes: + applies-to: version-updates update-types: ["minor", "patch"] + majors: + applies-to: version-updates + update-types: ["major"] + seguranca: + applies-to: security-updates + patterns: ["*"] - # Actions usadas nos workflows (checkout, setup-python etc.). + # Actions usadas nos workflows: um PR por mês com todas. - package-ecosystem: "github-actions" directory: "/" schedule: interval: "monthly" + groups: + actions: + patterns: ["*"] diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml index 64a3dba0d..77679d005 100644 --- a/.github/workflows/analysis.yml +++ b/.github/workflows/analysis.yml @@ -39,11 +39,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@v4 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -54,7 +54,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v3 + uses: github/codeql-action/autobuild@v4 # ℹ️ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -68,4 +68,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@v4 diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 1270b20ee..631a696e5 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -11,11 +11,11 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 # 3.12: o autopep8 fixado no pre-commit (v2.0.4) usa lib2to3, que não # existe no 3.13. Os testes rodam em 3.13, a versão da imagem. - name: Set up Python 3.12 - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: '3.12' - name: Install dependencies diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 706aff6c7..635b5e094 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -28,9 +28,9 @@ jobs: --health-retries 5 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Set up Python 3.13 - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: '3.13' - name: Install dependencies diff --git a/requirements-ci.txt b/requirements-ci.txt index 8bfe782d7..998530dfb 100644 --- a/requirements-ci.txt +++ b/requirements-ci.txt @@ -1,3 +1,3 @@ -lxml==6.1.0 -pysaml2==7.5.0 -python-ldap==3.4.5 +lxml==6.1.3 +pysaml2==7.5.5 +python-ldap==3.4.8 diff --git a/requirements-dev.txt b/requirements-dev.txt index 9bf959975..3d616f455 100644 --- a/requirements-dev.txt +++ b/requirements-dev.txt @@ -1,8 +1,8 @@ mypy==1.11.2 pre-commit==3.7.0 -pylint==3.1.0 -pytest>=5.4.3 +pylint==4.0.9 +pytest>=9.1.1 pytest-cov python-dotenv requests_mock -setuptools>=70.0.0 +setuptools>=84.0.0 diff --git a/requirements.txt b/requirements.txt index 61930c164..8fa9f869f 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,20 +1,20 @@ bcrypt==5.0.0 blinker==1.9.0 -cryptography==48.0.1 +cryptography==50.0.0 defusedxml==0.7.1 Flask==3.1.3 -Flask-Compress==1.23 -Flask-Cors==6.0.2 +Flask-Compress==1.25 +Flask-Cors==6.0.5 mohawk==1.1.0 -psycopg2==2.9.11 -PyJWT==2.13.0 -pymongo==4.16.0 -pyparsing==3.3.2 +psycopg2==2.9.13 +PyJWT==2.15.0 +pymongo==4.18.2 +pyparsing==3.3.3 python-dateutil==2.9.0.post0 -pytz==2026.1.post1 +pytz==2026.4 PyYAML==6.0.3 -requests==2.32.5 +requests==2.33.0 requests-hawk==1.2.1 sentry-sdk[flask]==2.56.0 StrEnum==0.4.15 -werkzeug==3.1.7 +werkzeug==3.1.8