fix(deps): remove orphaned uv.lock, resolving 3 Dependabot alerts - #30
fix(deps): remove orphaned uv.lock, resolving 3 Dependabot alerts#30jbdevprimary wants to merge 3 commits into
Conversation
uv.lock (idna 3.11, urllib3 2.6.3, both below their patched versions — GHSA-65pc-fj4g-8rjx, GHSA-qccp-gfcp-xxvc, GHSA-mf9v-mfxr-j63j) was added in a single commit in April with no accompanying pyproject.toml — one has never existed in this repo's history. Nothing sources, syncs, or otherwise references this lockfile: docs tooling runs through tox.ini (a completely separate dependency list — myst-parser, shibuya, sphinx, sphinxcontrib-mermaid — invoked via `uvx tox`, which doesn't touch a project lockfile at all). Rather than bump the two vulnerable transitive pins in a lockfile nothing reads, removed the orphaned file outright — root-causing dead tooling debris resolves the alerts and removes a stale, unmaintained artifact in one move. `make test` stays green (9/9).
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
Warning Review limit reached
Next review available in: 23 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR correctly removes an orphaned uv.lock file that generates false-positive security alerts. The change is safe and well-justified:
✅ Verified no pyproject.toml exists in the repository
✅ Confirmed documentation tooling runs via uvx tox -e docs using dependencies from tox.ini
✅ No references to uv.lock or uv sync found in any scripts or workflows
The approach of removing dead configuration is correct - this eliminates the root cause rather than maintaining pins for a lockfile nothing reads. No blocking issues identified.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
Same pre-existing whitespace CI catches on the full diff against main, unrelated to the uv.lock removal — see the identical fix on chore/consolidate-actions-bumps.
|
Carries forward PR #30, which could not merge directly after #16 rewrote the workflow files. `uv.lock` pinned 514 lines of Python dependencies for a project that does not exist in this repository: there is no `pyproject.toml` anywhere in the tree, and nothing — no workflow, script, or document — references the file. It was pure residue, and Dependabot was scanning it and raising alerts against dependencies nothing installs. Verified before deleting rather than assumed: `find` for pyproject.toml returns nothing, and a repo-wide grep for `uv.lock` across yml/yaml/toml/ sh/bash/md finds no reference outside the file itself.
|
Superseded by #35 — same conflict cause. The orphaned uv.lock removal was reapplied on current main, after re-verifying no pyproject.toml exists and nothing references the file. |
1 participant
Summary
Removes `uv.lock` — a lockfile with no accompanying `pyproject.toml` (one has never existed in this repo's history) and nothing referencing it anywhere in scripts or CI. Its pinned `idna` (3.11) and `urllib3` (2.6.3) are both below their patched versions, generating 3 open Dependabot alerts:
Docs tooling runs entirely through `tox.ini` (a separate, unrelated dependency list — myst-parser/shibuya/sphinx/sphinxcontrib-mermaid), invoked via `uvx tox` — that doesn't read a project lockfile at all. Root-causing dead debris rather than bumping pins nothing reads.
Test plan