From 020a3dfad21046747d9152f42b25c117d98e7cdb Mon Sep 17 00:00:00 2001 From: TMHSDigital <154358121+TMHSDigital@users.noreply.github.com> Date: Sat, 10 Oct 2026 10:52:28 -0400 Subject: [PATCH] chore(deps): apply Dependabot bumps for actions and Python requirements - actions/setup-python v6 -> v7 (workflows, composite actions, scaffold templates, ACTION_PINS); the removed pip-install input was unused - actions/stale v10 -> v11 (workflow, scaffold template, ACTION_PINS) - Jinja2 >=3.1.6, PyYAML >=6.0.3, pytest >=9.1.1,<10.0 Supersedes #136, #137, #138, #139, #140, #141, #142, #143, which were opened before the docs-hygiene test fix and need the pin table updated in the same change. Co-Authored-By: Claude Opus 5.5 Signed-off-by: TMHSDigital <154358121+TMHSDigital@users.noreply.github.com> --- .github/actions/drift-check/action.yml | 2 +- .github/actions/release-doc-sync/action.yml | 2 +- .github/workflows/README.md | 2 +- .github/workflows/stale.yml | 4 ++-- .github/workflows/sync.yml | 2 +- .github/workflows/validate.yml | 6 +++--- CLAUDE.md | 2 +- requirements-test.txt | 6 +++--- requirements.txt | 2 +- scaffold/generator.py | 4 ++-- scaffold/templates/pages.yml.j2 | 2 +- scaffold/templates/stale.yml.j2 | 2 +- scaffold/templates/validate.yml.j2 | 2 +- site-template/requirements.txt | 2 +- 14 files changed, 20 insertions(+), 20 deletions(-) diff --git a/.github/actions/drift-check/action.yml b/.github/actions/drift-check/action.yml index 14c3ba2..527ec44 100644 --- a/.github/actions/drift-check/action.yml +++ b/.github/actions/drift-check/action.yml @@ -96,7 +96,7 @@ runs: path: .drift-checker - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@v7 with: python-version: ${{ inputs.python-version }} diff --git a/.github/actions/release-doc-sync/action.yml b/.github/actions/release-doc-sync/action.yml index aaafa48..8c47a2f 100644 --- a/.github/actions/release-doc-sync/action.yml +++ b/.github/actions/release-doc-sync/action.yml @@ -118,7 +118,7 @@ runs: path: .release-doc-sync - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@v7 with: python-version: ${{ inputs.python-version }} diff --git a/.github/workflows/README.md b/.github/workflows/README.md index 142ea66..d48ac08 100644 --- a/.github/workflows/README.md +++ b/.github/workflows/README.md @@ -28,7 +28,7 @@ First-party GitHub actions (`actions/`, `github/`) may use a major-version tag: ```yaml - uses: actions/checkout@v7 -- uses: actions/setup-python@v6 +- uses: actions/setup-python@v7 ``` Rationale: tags are mutable and can be retargeted to a malicious commit. SHAs are immutable. GitHub-owned actions are exempt because GitHub's own security model protects them. diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 9f52095..fa78465 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -15,7 +15,7 @@ jobs: name: Close stale issues runs-on: ubuntu-latest steps: - - uses: actions/stale@v10 + - uses: actions/stale@v11 with: days-before-stale: 60 days-before-close: 14 @@ -36,7 +36,7 @@ jobs: name: Close stale PRs runs-on: ubuntu-latest steps: - - uses: actions/stale@v10 + - uses: actions/stale@v11 with: days-before-stale: 30 days-before-close: 14 diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml index 7a2171a..8bb9684 100644 --- a/.github/workflows/sync.yml +++ b/.github/workflows/sync.yml @@ -23,7 +23,7 @@ jobs: steps: - uses: actions/checkout@v7 - - uses: actions/setup-python@v6 + - uses: actions/setup-python@v7 with: python-version: "3.12" diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index 37f6d07..d053eda 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -44,7 +44,7 @@ jobs: steps: - uses: actions/checkout@v7 - - uses: actions/setup-python@v6 + - uses: actions/setup-python@v7 with: python-version: "3.12" @@ -229,7 +229,7 @@ jobs: steps: - uses: actions/checkout@v7 - - uses: actions/setup-python@v6 + - uses: actions/setup-python@v7 with: python-version: "3.12" @@ -363,7 +363,7 @@ jobs: steps: - uses: actions/checkout@v7 - - uses: actions/setup-python@v6 + - uses: actions/setup-python@v7 with: python-version: "3.12" diff --git a/CLAUDE.md b/CLAUDE.md index 78abb3c..0e00b5e 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -179,6 +179,6 @@ Open `docs/index.html` in a browser. The script falls back to embedded registry | Dependency | Purpose | Where | |------------|---------|-------| -| Jinja2 >=3.1,<4.0 | Scaffold template rendering | `requirements.txt` | +| Jinja2 >=3.1.6,<4.0 | Scaffold template rendering | `requirements.txt` | The docs site has zero runtime dependencies. The sync script is pure stdlib. diff --git a/requirements-test.txt b/requirements-test.txt index a40b0ed..f57ffb5 100644 --- a/requirements-test.txt +++ b/requirements-test.txt @@ -1,8 +1,8 @@ -pytest>=8.0,<9.0 +pytest>=9.1.1,<10.0 # PyYAML is required by the YAML-validating tests (test_release_doc_sync.py, # test_composite_action_shape.py). Without it those tests pytest.importorskip # and silently skip in CI, hiding real coverage. -PyYAML>=6.0,<7.0 +PyYAML>=6.0.3,<7.0 # Jinja2 is required by the born-green scaffold integration test, which renders # a repo of each type and runs the drift checker against the output. -Jinja2>=3.1,<4.0 +Jinja2>=3.1.6,<4.0 diff --git a/requirements.txt b/requirements.txt index 9894c74..2b42ceb 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1 +1 @@ -Jinja2>=3.1,<4.0 +Jinja2>=3.1.6,<4.0 diff --git a/scaffold/generator.py b/scaffold/generator.py index 1edb18b..788ba16 100644 --- a/scaffold/generator.py +++ b/scaffold/generator.py @@ -54,11 +54,11 @@ ACTION_PINS = { "actions/checkout": "v7", "actions/setup-node": "v6", - "actions/setup-python": "v6", + "actions/setup-python": "v7", "actions/configure-pages": "v6", "actions/upload-pages-artifact": "v5", "actions/deploy-pages": "v5", - "actions/stale": "v10", + "actions/stale": "v11", } NODE_MATRIX = (22, 24) NODE_ENGINES = ">=22.0.0" diff --git a/scaffold/templates/pages.yml.j2 b/scaffold/templates/pages.yml.j2 index 06f2c54..f9d762c 100644 --- a/scaffold/templates/pages.yml.j2 +++ b/scaffold/templates/pages.yml.j2 @@ -38,7 +38,7 @@ jobs: sparse-checkout: site-template path: _template - - uses: actions/setup-python@v6 + - uses: actions/setup-python@v7 with: python-version: "3.12" diff --git a/scaffold/templates/stale.yml.j2 b/scaffold/templates/stale.yml.j2 index fc95102..c9b2c6a 100644 --- a/scaffold/templates/stale.yml.j2 +++ b/scaffold/templates/stale.yml.j2 @@ -13,7 +13,7 @@ jobs: stale: runs-on: ubuntu-latest steps: - - uses: actions/stale@v10 + - uses: actions/stale@v11 with: stale-issue-message: "This issue has been automatically marked as stale due to inactivity. It will be closed in 7 days if no further activity occurs." stale-pr-message: "This PR has been automatically marked as stale due to inactivity. It will be closed in 7 days if no further activity occurs." diff --git a/scaffold/templates/validate.yml.j2 b/scaffold/templates/validate.yml.j2 index 0cacdb9..4b0217c 100644 --- a/scaffold/templates/validate.yml.j2 +++ b/scaffold/templates/validate.yml.j2 @@ -150,7 +150,7 @@ jobs: steps: - uses: actions/checkout@v7 - - uses: actions/setup-python@v6 + - uses: actions/setup-python@v7 with: python-version: "3.12" diff --git a/site-template/requirements.txt b/site-template/requirements.txt index 9894c74..2b42ceb 100644 --- a/site-template/requirements.txt +++ b/site-template/requirements.txt @@ -1 +1 @@ -Jinja2>=3.1,<4.0 +Jinja2>=3.1.6,<4.0