From bca97d3daf802af209c4247c9415a9e87e2c0ac1 Mon Sep 17 00:00:00 2001 From: Daniel Holbach Date: Tue, 28 Jul 2026 12:44:33 +0200 Subject: [PATCH] chore: stop using -r include in requirements-dev.txt for Dependabot MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dependabot's security-update PR generation doesn't resolve `-r requirements.txt` includes — it can only patch a version pin that's literally written in the file it's scanning. With the include, every runtime CVE alert (Pillow, pypdf, etc.) got attributed to requirements-dev.txt but Dependabot had no way to fix it there, leaving 17 alerts permanently stuck with "cannot update to the required version" even after requirements.txt was already patched. Duplicating the pins directly (both files kept in sync by hand, per the comments added) lets Dependabot patch each file independently, the same way it already does for the dev-only tools. Co-Authored-By: Claude Sonnet 5 --- app/requirements-dev.txt | 30 +++++++++++++++++++++++++++++- app/requirements.txt | 2 ++ 2 files changed, 31 insertions(+), 1 deletion(-) diff --git a/app/requirements-dev.txt b/app/requirements-dev.txt index 91b428b..13ff00c 100644 --- a/app/requirements-dev.txt +++ b/app/requirements-dev.txt @@ -1,5 +1,33 @@ --r requirements.txt +# Kept in sync with requirements.txt by hand (no `-r` include) so Dependabot +# can patch this file's pins directly — it doesn't resolve `-r` includes when +# generating security-update PRs, which left every runtime CVE alert stuck +# against this file with no way for Dependabot to fix it. +Django==6.0.7 +psycopg[binary]==3.3.4 +cryptography==49.0.0 +markdown==3.10.2 +nh3==0.3.6 +gunicorn==26.0.0 +python-dotenv==1.2.2 +weasyprint==69.0 +pydyf==0.12.1 +pillow==12.3.0 +whitenoise==6.12.0 +python-dateutil==2.9.0.post0 +pdfplumber==0.11.10 +pypdf==6.14.2 +urllib3==2.7.0 +# Google Calendar API +google-auth==2.56.2 +google-auth-oauthlib==1.4.0 +google-auth-httplib2==0.4.0 +google-api-python-client==2.198.0 + +# Async support (Django 5.1+) +uvicorn==0.51.0 + +# Dev-only tools ruff==0.16.0 vulture==2.16 radon==6.0.1 diff --git a/app/requirements.txt b/app/requirements.txt index d208163..6b9e150 100644 --- a/app/requirements.txt +++ b/app/requirements.txt @@ -1,3 +1,5 @@ +# requirements-dev.txt duplicates these pins instead of using `-r` (see the +# comment there for why) — update both files together. Django==6.0.7 psycopg[binary]==3.3.4 cryptography==49.0.0