Skip to content

Update dependencies including gitleaks, bandit, and black#58

Merged
bybatkhuu merged 19 commits into
mainfrom
dev
Jul 23, 2026
Merged

Update dependencies including gitleaks, bandit, and black#58
bybatkhuu merged 19 commits into
mainfrom
dev

Conversation

@bybatkhuu

Copy link
Copy Markdown
Owner

This pull request updates several dependencies and CI workflows to ensure compatibility, improve reliability, and add new automation. The main changes include upgrading GitHub Actions versions in workflow files, updating pre-commit hook versions, adding a new pre-commit workflow, and making minor dependency and configuration adjustments.

CI/CD Workflow Upgrades:

  • Updated actions/checkout and actions/setup-python to version 7 in all GitHub Actions workflow files for improved reliability and access to new features. (.github/workflows/1.bump-version.yml, .github/workflows/2.build-publish.yml, .github/workflows/3.update-changelog.yml, .github/workflows/publish-docs.yml) [1] [2] [3] [4] [5]

Pre-commit and Linting Improvements:

  • Added a new .github/workflows/pre-commit.yml workflow to automatically run pre-commit checks on pull requests targeting main or dev, ensuring code quality before merging.
  • Upgraded several pre-commit hooks to their latest versions for enhanced linting, formatting, and security checks:
    • gitleaks to v8.30.1
    • markdownlint-cli to v0.49.1
    • black to 26.5.1
    • bandit to 1.9.4
  • Removed commented-out local pytest hooks from .pre-commit-config.yaml for clarity.

Dependency and Configuration Updates:

  • Extended the allowed version range for setuptools in pyproject.toml and requirements/requirements.build.txt to <84.0.0 for improved compatibility with future releases. [1] [2]
  • Removed the deprecated python.languageServer setting from .vscode/settings.json to avoid warnings with recent VS Code versions.
  • Removed the gruntfuggly.todo-tree extension from .vscode/extensions.json, likely as a cleanup step.

dependabot Bot and others added 19 commits May 5, 2026 13:14
Bumps [https://github.com/gitleaks/gitleaks](https://github.com/gitleaks/gitleaks) from v8.30.0 to 8.30.1.
- [Release notes](https://github.com/gitleaks/gitleaks/releases)
- [Commits](gitleaks/gitleaks@v8.30.0...v8.30.1)

---
updated-dependencies:
- dependency-name: https://github.com/gitleaks/gitleaks
  dependency-version: 8.30.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [https://github.com/PyCQA/bandit](https://github.com/PyCQA/bandit) from 1.9.3 to 1.9.4.
- [Release notes](https://github.com/PyCQA/bandit/releases)
- [Commits](PyCQA/bandit@1.9.3...1.9.4)

---
updated-dependencies:
- dependency-name: https://github.com/PyCQA/bandit
  dependency-version: 1.9.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [https://github.com/psf/black](https://github.com/psf/black) from 26.1.0 to 26.3.1.
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](psf/black@26.1.0...26.3.1)

---
updated-dependencies:
- dependency-name: https://github.com/psf/black
  dependency-version: 26.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
…-/github.com/psf/black-26.3.1

⬆️ Bump https://github.com/psf/black from 26.1.0 to 26.3.1
…-/github.com/PyCQA/bandit-1.9.4

⬆️ Bump https://github.com/PyCQA/bandit from 1.9.3 to 1.9.4
…-/github.com/gitleaks/gitleaks-8.30.1

⬆️ Bump https://github.com/gitleaks/gitleaks from v8.30.0 to 8.30.1
Bumps [https://github.com/psf/black](https://github.com/psf/black) from 26.3.1 to 26.5.1.
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](psf/black@26.3.1...26.5.1)

---
updated-dependencies:
- dependency-name: https://github.com/psf/black
  dependency-version: 26.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
…-/github.com/psf/black-26.5.1

⬆️ Bump https://github.com/psf/black from 26.3.1 to 26.5.1
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [https://github.com/igorshubovych/markdownlint-cli](https://github.com/igorshubovych/markdownlint-cli) from v0.48.0 to 0.49.0.
- [Release notes](https://github.com/igorshubovych/markdownlint-cli/releases)
- [Commits](igorshubovych/markdownlint-cli@v0.48.0...v0.49.0)

---
updated-dependencies:
- dependency-name: https://github.com/igorshubovych/markdownlint-cli
  dependency-version: 0.49.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
…ctions/checkout-7

⬆️ Bump actions/checkout from 6 to 7
…-/github.com/igorshubovych/markdownlint-cli-0.49.0

⬆️ Bump https://github.com/igorshubovych/markdownlint-cli from v0.48.0 to 0.49.0
Updates the requirements on [setuptools](https://github.com/pypa/setuptools) to permit the latest version.
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v82.0.1...v83.0.0)

---
updated-dependencies:
- dependency-name: setuptools
  dependency-version: 83.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
…te-82.0.1-and-lt-84.0.0

⬆️ Update setuptools requirement from <83.0.0,>=82.0.1 to >=82.0.1,<84.0.0
Bumps [https://github.com/igorshubovych/markdownlint-cli](https://github.com/igorshubovych/markdownlint-cli) from v0.49.0 to 0.49.1.
- [Release notes](https://github.com/igorshubovych/markdownlint-cli/releases)
- [Commits](igorshubovych/markdownlint-cli@v0.49.0...v0.49.1)

---
updated-dependencies:
- dependency-name: https://github.com/igorshubovych/markdownlint-cli
  dependency-version: 0.49.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
…-/github.com/igorshubovych/markdownlint-cli-0.49.1

⬆️ Bump https://github.com/igorshubovych/markdownlint-cli from v0.49.0 to 0.49.1
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v6...v7)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…ctions/setup-python-7

⬆️ Bump actions/setup-python from 6 to 7
@bybatkhuu bybatkhuu self-assigned this Jul 23, 2026
Copilot AI review requested due to automatic review settings July 23, 2026 01:15
@bybatkhuu bybatkhuu added the cicd [👷 CI/CD] label Jul 23, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request updates dependency constraints and developer/CI tooling to keep the template current, improve reliability, and add automated pre-commit checks in CI.

Changes:

  • Broadened the upper bound for setuptools in build requirements (<84.0.0).
  • Updated several pre-commit hook versions (gitleaks, markdownlint, black, bandit) and removed commented-out local pytest hooks.
  • Upgraded GitHub Actions checkout/setup-python versions in workflows and added a new pre-commit workflow for PRs.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
requirements/requirements.build.txt Expands allowable setuptools build version range.
pyproject.toml Expands setuptools build-system constraint upper bound.
.vscode/settings.json Removes deprecated VS Code Python language server setting.
.vscode/extensions.json Removes an extension recommendation entry.
.pre-commit-config.yaml Bumps hook versions and cleans up commented-out test hooks.
.github/workflows/publish-docs.yml Upgrades GitHub Actions checkout/setup-python versions.
.github/workflows/pre-commit.yml Adds CI workflow to run pre-commit on pull requests.
.github/workflows/3.update-changelog.yml Upgrades GitHub Actions checkout version.
.github/workflows/2.build-publish.yml Upgrades GitHub Actions checkout/setup-python versions.
.github/workflows/1.bump-version.yml Upgrades GitHub Actions checkout version.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +27 to +31
- name: Cache pip
uses: actions/cache@v6
with:
path: ~/.cache/pip
key: pip-${{ runner.os }}-${{ hashFiles('requirements.txt') }}
Comment on lines +32 to +36
- name: Install pre-commit and dependencies
run: |
python -m pip install -U pip
python -m pip install -r ./requirements.txt
python -m pip install -U pre-commit pyright pytest
@bybatkhuu
bybatkhuu merged commit 5a9db39 into main Jul 23, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cicd [👷 CI/CD]

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants