ci(dependabot): ignore caio >= 0.10, document the pip resync step - #329
Merged
Conversation
caio is transitive (hypermnesia-mcp -> fastmcp -> fastmcp-slim -> py-key-value-aio -> aiofile -> caio). Every published aiofile pins caio below 0.10 — 3.9.0 `caio<0.10.0,>=0.9.0`, 3.10.0 through 3.11.1 (latest, 2026-05-16) `caio~=0.9.0` — while caio 0.10.2 shipped 2026-07-05, after it. PR #322 was therefore not a resync failure but an unresolvable one: every job failed, pip reporting ResolutionImpossible. Closed and ignored until aiofile widens its bound. No advisory affects caio (GitHub advisories API, 2026-08-01), so 0.9.25 is not a security hold. The comment above the pip entry records the other half of the story: the `deps` PRs that ARE resolvable still arrive red, because Dependabot never runs `uv lock` or generate_pip_constraints.py, and Lint guards exactly that chain. Writing the two-command fix next to the config saves the next maintainer the log archaeology this cycle cost. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Two distinct problems showed up in this week's Dependabot batch. This PR closes the one that is a config bug and documents the one that is a workflow gap.
1.
caiois unresolvable, not merely unresynced —ignoreitcaiois transitive, not declared:Every published
aiofilepinscaiobelow 0.10 (PyPI JSON API, verified 2026-08-01):caio<0.10.0,>=0.9.0caio~=0.9.0caio~=0.9.0caio~=0.9.0caio0.10.2 shipped 2026-07-05, after the latestaiofile. No version set satisfies both, which is why #322 failed every job rather than just Lint — pip reportedResolutionImpossible. #322 is closed; this rule stops it being reopened weekly. It should be removed as soon asaiofilewidens its bound.No advisory affects
caio(gh api "/advisories?ecosystem=pip&affects=caio"returned none on 2026-08-01), so holding at 0.9.25 is not a security trade-off.2. The resolvable
depsPRs still arrive red — document the fixDependabot rewrites a version specifier and never runs
uv lockorscripts/generate_pip_constraints.py. The Lint job guards exactly that chain (uv lock --check,generate_pip_constraints.py --check, added for #251), so every pip PR fails on arrival. The two-command resync now sits in a comment directly above the pip entry, along with the warning that pushing to adependabot/**branch disables auto-rebase.Scope
.github/dependabot.ymlonly — comments plus oneignoreentry. No workflow, no dependency, no code.Verification
ignore, with[{'dependency-name': 'caio', 'versions': ['>=0.10.0']}]