[sophiagavrila]

Note

Combined on-call dependency patching PR for Week 2 of the vuln-mgmt-eng on-call rotation, tracked by github/vuln-mgmt-eng#12120.

What this PR does

Consolidates the three open Dependabot PRs into one change, closes all 23 open Dependabot alerts on requirements/requirements-dev.txt, and fixes the single ruff 0.17 lint finding that kept #181 red.

Area	Updates
Python (pip, hatch-pip-compile)	12 dev pins bumped, 1 new transitive pin (tzdata), certifi bumped in both lockfiles
GitHub Actions	2 action SHAs bumped (coverage.yaml, pytest.yaml, publish-to-pypi.yaml)
Docker	none open
Go modules	n/a
Vendored packages	n/a, this repo vendors nothing (no requirements-vendored.txt, no vendor/, no committed archives)
Lint	one stale noqa code removed in example/logging_config.py; ruff-pre-commit hook v0.14.0 -> v0.17.3 to match
Docs	CONTRIBUTING.md: one sentence stating the dev env needs Python >= 3.11

How the requirements were produced

Both lockfiles are generated by hatch-pip-compile (type = "pip-compile", pip-compile-resolver = "uv"). They were regenerated with the tool, on Python 3.12 to match the existing file headers, rather than edited in place:

PIP_COMPILE_UPGRADE_PACKAGE="certifi==2026.10.23" hatch env run --env default -- python --version
PIP_COMPILE_UPGRADE_PACKAGE="certifi==2026.10.23,distlib==0.4.4,filelock==4.2.1,nodeenv==1.11.1,platformdirs==4.12.4,pluggy==1.7.0,pytest==9.2.0,pytest-mock==3.17.0,python-dateutil==3.0.0,python-discovery==1.6.7,ruff==0.17.3,virtualenv==21.15.1" \
  hatch env run --env dev -- python --version

The targets are the highest version proposed for each package across #181 and #180. The regenerated files match the Dependabot diffs exactly, with one addition: python-dateutil 3.0.0 declares an unconditional tzdata dependency, which #181's in-place edit left out. The resolver adds tzdata==2026.6.

Python packages

Package	Previous	New	File	Source
certifi	2026.10.19	2026.10.23	both	#181
distlib	0.4.3	0.4.4	dev	#181
filelock	4.0.12	4.2.1	dev	#180 (#181 proposed 4.1.0, still vulnerable)
nodeenv	1.11.0	1.11.1	dev	#181
platformdirs	4.12.3	4.12.4	dev	#181
pluggy	1.6.0	1.7.0	dev	#181
pytest	9.1.1	9.2.0	dev	#181
pytest-mock	3.16.0	3.17.0	dev	#181
python-dateutil	2.9.0.post0	3.0.0	dev	#181 (via freezegun)
python-discovery	1.6.1	1.6.7	dev	#181
ruff	0.16.10	0.17.3	dev	#181
tzdata	(none)	2026.6	dev	new, required by python-dateutil 3.0.0
virtualenv	21.14.5	21.15.1	dev	#181 (#180 proposed 21.14.13)

GitHub Actions pins

Action	Previous	New	Files
py-cov-action/python-coverage-comment-action	54b4ecb (v4.4)	e5fb221 (v4.5)	coverage.yaml, pytest.yaml
pypa/gh-action-pypi-publish	dc37677 (v1.14.2)	7245906 (v1.14.3)	publish-to-pypi.yaml (TestPyPI and PyPI jobs)

Both SHAs were checked against the upstream tags (v4.5 -> e5fb221, annotated tag v1.14.3 -> 7245906).

Superseded Dependabot PRs

PR	Title	Disposition
#181	[pip] (deps): Bump the dev-dependencies group across 1 directory with 12 updates	Included. Was red on ruff (RUF100), fixed here. Lockfile also corrected for tzdata.
#180	Bump the pip group across 1 directory with 2 updates	Included (filelock 4.2.1; virtualenv taken at #181's higher 21.15.1).
#178	[actions] (deps): Bump the dev-dependencies group across 1 directory with 2 updates	Included unchanged (cherry-picked).

These are not closed manually; they should auto-close once this merges.

Security findings accounted for

From github/vuln-mgmt#273354 (Security Finding Summary):

Finding	Tracking issue	Dependabot alerts	Resolution
virtualenv -> 21.14.9	github/vuln-mgmt#272883	#32, #33, #34, #35, #38, #39, #40, #41, #42, #43	virtualenv==21.15.1
virtualenv -> 21.14.7	github/vuln-mgmt#272906	#31	virtualenv==21.15.1
filelock -> 4.2.1	github/vuln-mgmt#274472	#36, #44, #45, #46, #47, #48, #49, #50, #51, #53, #54, #55	filelock==4.2.1

23 of 23 open alerts are addressed. All are on requirements/requirements-dev.txt; none affect the published package. No GitHub advisories currently list filelock 4.2.1, virtualenv 21.15.1, or any other new pin in this PR as affected.

Important

Every patched filelock release (>= 4.2.1) requires Python >= 3.11; the newest release installable on 3.10 is 4.1.0, which is still vulnerable. The dev lockfile is generated for Python 3.12 (see its header) and CI installs the latest 3.x, so CI is unaffected. A contributor building the dev environment on Python 3.10 would fail to install filelock==4.2.1. The published package still declares requires-python = ">=3.10" and does not depend on filelock. This becomes visible in CI if the pytest matrix is bound to real interpreter versions (#156). Reproduced locally: hatch env create dev on CPython 3.10.19 fails resolving filelock==4.2.1. A Python-version-specific lock would put a vulnerable filelock==4.1.0 pin back in the file and leave the alerts open, so CONTRIBUTING.md now states the dev env needs 3.11+.

Lint repair (not a dependency change)

ruff 0.17.0 stabilised pragma-aware line length: E501 now ignores trailing pragma comments when measuring a line (changelog, astral-sh/ruff#27313). example/logging_config.py:114 is 76 characters without its # noqa, so E501 no longer fires and the E501 code in that noqa became unused:

example/logging_config.py:114:79: RUF100 Unused `noqa` directive (unused: `E501`)

The fix drops E501 from that noqa, keeping ERA001. Verified across versions: ruff 0.14.0 and 0.16.10 pass on the original line, and only 0.17.3 reports RUF100. With the edit, 0.17.3 passes. The pinned project linter is 0.17.3.

.pre-commit-config.yaml pinned ruff-pre-commit at v0.14.0, which still flags E501 on that line once the code is removed (pre-commit run ruff --all-files failed locally). The hook is bumped to v0.17.3 to match the pinned ruff. The ruff hook id remains available as a legacy alias in v0.17.3, so the hook list is unchanged.

Release

Per CONTRIBUTING.md ("Release a Version"), a release is cut by pushing a signed tag, and the published version comes from annotated_logger/__init__.py (VERSION = "1.3.5").

No package release is needed for this PR. The published wheel's dependencies come from [project] dependencies in pyproject.toml, which is not touched. requirements.txt and requirements/requirements-dev.txt are hatch lockfiles for local and CI environments and are not shipped. The pypa/gh-action-pypi-publish bump only takes effect at the next tag push. VERSION is unchanged.

Validation

Validation

Run locally on CPython 3.12.4 in the dev hatch environment (hatch 1.18.2, the version CI installs), built from the regenerated lockfile. Installed versions were confirmed: filelock 4.2.1, virtualenv 21.15.1, python-dateutil 3.0.0, tzdata 2026.6, ruff 0.17.3, pytest 9.2.0.

Command	Result
hatch run dev:ruff check .	All checks passed
hatch run dev:ruff format --check .	19 files already formatted
hatch run dev:pyright	0 errors, 0 warnings, 0 informations
hatch run dev:pytest (random order)	76 passed, 100.00% coverage (required 100%)
hatch run dev:pytest -p no:randomly	76 passed, 100.00% coverage
Re-activating default and dev envs	lockfiles stable, no regeneration
pre-commit run ruff --all-files / ruff-format / check-yaml (hook v0.17.3)	Passed
hatch env create dev on CPython 3.10.19	fails on filelock==4.2.1 (expected, see Security findings note)

Remote CI (pytest matrix, pyright, ruff, CodeQL, TestPyPI build) is the final gate.

Deployment monitoring

Deployment monitoring

Not applicable. annotated-logger is a library published to PyPI. It has no config/moda/ directory and no Kubernetes namespace, so there is no staging or production rollout to baseline. Consumers only pick up changes when a new version is released and they re-resolve their own lockfiles, and this PR does not cut a release.

No Splunk baseline was captured, and none is claimed.

Isolation / not touched

Isolation / not touched

This PR changes only requirements.txt, requirements/requirements-dev.txt, three workflow files (action SHA pins only), one noqa comment in example/logging_config.py, the ruff-pre-commit rev in .pre-commit-config.yaml, and one sentence in CONTRIBUTING.md.

It does not modify:

• any runtime source under annotated_logger/ (no behavior change)
• pyproject.toml, including [project] dependencies, requires-python, hatch env config, and ruff config
• the package VERSION, release configuration, or tags
• any test under test/, or coverage thresholds (still 100%)
• README.md or other documentation
• workflow triggers, permissions, job structure, or the pytest.yaml matrix (tracked separately in Pytest matrix runs a single interpreter; binding it exposes a macOS/3.11 hatch env failure #156)
• other .pre-commit-config.yaml hooks (pyright, pre-commit-hooks, check-jsonschema)
• Dockerfile

Not folded in (human or bot authored, out of scope): #171, #170, #169 (Shubham-Padkonde), #163 (github-security-bot, SHA pinning), #144 (draft). #163 edits the same workflow files and may need a rebase after this merges.

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
annotated_logger
__init__.py
plugins.py
Project Total

This report was generated by python-coverage-comment-action

[Copilot]

🟡 Changes recommended

Two moderate active issues remain: the checked-in pre-commit hook fails on the changed lint configuration, and the development lockfile cannot be installed on the supported Python 3.10 target.

2 open issues

• Keep E501 suppressed until the pre-commit Ruff hook is upgraded · New
• Dev lockfile requires Python 3.11 despite Python 3.10 support · New

What changed in this PR

This pull request consolidates Dependabot dependency updates, refreshes Python lockfiles and pinned GitHub Actions, and removes an obsolete Ruff E501 suppression.

Changes:

• Updates development dependencies, including filelock, virtualenv, python-dateutil, and the transitive tzdata pin.
• Refreshes certifi in the lockfiles.
• Updates coverage-comment and PyPI publishing action SHAs.
• Removes the unused E501 code from an example noqa directive.

This pull request requires changes.

File	Summary
requirements/​requirements-dev.txt	Refreshes development dependency pins and adds tzdata. Moderate issue (2 votes): filelock==4.2.1 requires Python 3.11+, so the lockfile cannot be installed on the repository’s supported Python 3.10 target.
requirements.txt	Updates the default environment’s certifi lockfile pin.
example/​logging_config.py	Removes the obsolete Ruff E501 suppression. Moderate issue (3 votes): the checked-in ruff-pre-commit v0.14.0 hook still reports E501; retain the suppression or update the hook.
.github/​workflows/​pytest.yaml	Updates the coverage-comment action SHA.
.github/​workflows/​publish-to-pypi.yaml	Updates the PyPI publishing action SHA for the PyPI and TestPyPI jobs.
.github/​workflows/​coverage.yaml	Updates the coverage-comment action SHA.

_{Review effort: Lite (auto)}

[brandonganem]

Matrix review

No issues found.

_{Reviewed d8ba5e9 with claude-opus-5.5, gpt-6.1-sol, gemini-4-argon and gpt-6.1-terra. Linked issues were read at review time.}