chore: stop using -r include in requirements-dev.txt - #277
Merged
Conversation
Dependabot's security-update PR generation doesn't resolve `-r requirements.txt` includes — it can only patch a version pin that's literally written in the file it's scanning. With the include, every runtime CVE alert (Pillow, pypdf, etc.) got attributed to requirements-dev.txt but Dependabot had no way to fix it there, leaving 17 alerts permanently stuck with "cannot update to the required version" even after requirements.txt was already patched. Duplicating the pins directly (both files kept in sync by hand, per the comments added) lets Dependabot patch each file independently, the same way it already does for the dev-only tools. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
requirements-dev.txt, even thoughrequirements.txtalready has the patched versions — Dependabot's security-update PR generation doesn't resolve-r requirements.txtincludes, so it had no way to actually fix the pin in the file it flagged. This is a known, unfixed limitation upstream (dependabot-core#5339, #15141), not something specific to this repo.-r requirements.txtinclude with the actual pins, duplicated directly intorequirements-dev.txt(grouped/commented the same way as the source file). Both files now have a comment pointing at each other so future edits keep them in sync.pip install --dry-run -r requirements-dev.txtinside the running dev container — all packages already satisfied, no conflicts.Chose this over switching to
pip-tools/.infiles (the other option discussed) since the dependency count here is small enough that manual sync is low-risk, and it avoids adding a new compile step to the workflow.Test plan
./dev.py lintpassespip install --dry-run -r requirements-dev.txtinside the container — no conflicts, everything already satisfied