Repository navigation
Tags
Tags
fix(security): resolve Dependabot alerts in uv.lock [SECURITY] (#4732) ## Summary - Clear open Dependabot alerts on `uv.lock` for **filelock**, **Pillow**, and **dnspython** by pinning patched versions (`filelock>=4.2.1`, `pillow>=13.0.0`, `dnspython>=2.9.0`) via `tool.uv.constraint-dependencies` and refreshing the lockfile. - Raise **`requires-python` to `>=3.11`** because fixed releases of those packages no longer publish wheels for Python 3.10; the universal lock previously kept vulnerable 3.10 resolution forks (e.g. `filelock` 4.1.0, `pillow` 12.3.0, `dnspython` 2.8.0), which Dependabot continued to flag. - Align tooling with the new floor: drop the 3.10 Trove classifier, bump `mkdocs-ansible` to `>=26.4.0`, and update tox lower bound, CI lint default Python, mypy/ruff targets, and Sonar Python versions. ## Test plan - [ ] `uv lock --check` - [ ] `tox -e lint` - [ ] `tox -e py` (or CI matrix) - [ ] Confirm GitHub **Dependabot** alert count drops after merge (may lag briefly) ## Breaking change **Python 3.10 is no longer supported** for installing Molecule from this branch. Users on 3.10 must upgrade to 3.11+. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Compatibility** * The minimum supported Python version is now 3.11; Python 3.10 is no longer supported. Development and quality-checking tools now target Python 3.11 and newer. * **Dependency Updates** * Minimum versions for several dependencies have been raised, including `filelock`, `dnspython`, and `pillow`. Documentation tooling requirements have also been updated. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
chore(deps): bump uv from 0.12.15 to 0.12.18 (#4714) Bumps [uv](https://github.com/astral-sh/uv) from 0.12.15 to 0.12.18. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">uv's releases</a>.</em></p> <blockquote> <h2>0.12.18</h2> <h2>Release Notes</h2> <p>Released on 2026-09-22.</p> <p>This release addresses <a href="https://github.com/astral-sh/uv/security/advisories/GHSA-2cv4-cqwr-gwf7">GHSA-2cv4-cqwr-gwf7</a>, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.</p> <h3>Enhancements</h3> <ul> <li>Add <code>--output-format json</code> to <code>uv pip install</code> and <code>uv pip sync</code>, including for <code>--dry-run</code> and <code>--check</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21893">#21893</a>)</li> <li>Add <code>--check</code> to <code>uv pip install</code> and <code>uv pip sync</code> to report planned changes without modifying the environment (<a href="https://redirect.github.com/astral-sh/uv/pull/21844">#21844</a>)</li> <li>Identify failures from <code>get_requires_for_build_*</code> hooks correctly in build errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21881">#21881</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Validate build requirements for <code>uv build --no-build-isolation</code> with <code>--preview-features build-dependency-check</code>; use <code>--skip-dependency-check</code> to opt out (<a href="https://redirect.github.com/astral-sh/uv/pull/21880">#21880</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Speed up <code>uv_build</code> editable wheel creation by omitting compression from temporary wheels (<a href="https://redirect.github.com/astral-sh/uv/pull/21918">#21918</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags (<a href="https://redirect.github.com/astral-sh/uv/pull/21835">#21835</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/21836">#21836</a>)</li> <li>Restore project, script, and lock files when <code>uv add</code>, <code>uv remove</code>, or <code>uv version</code> fails or is interrupted (<a href="https://redirect.github.com/astral-sh/uv/pull/21860">#21860</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/21856">#21856</a>)</li> <li>Use configured <code>dependency-metadata</code> when checking whether installed requirements are satisfied (<a href="https://redirect.github.com/astral-sh/uv/pull/21843">#21843</a>)</li> <li>Reject archive entries that normalize to absolute Windows paths (<a href="https://redirect.github.com/astral-sh/uv/pull/21923">#21923</a>)</li> <li>Recognize distribution filenames and archive extensions when URL fragments contain <code>?</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21920">#21920</a>)</li> <li>Generate correctly lowercased platform tags for BSD and Haiku releases (<a href="https://redirect.github.com/astral-sh/uv/pull/21853">#21853</a>)</li> <li>Avoid rebuilding a Windows relative path into an absolute form (<a href="https://redirect.github.com/astral-sh/uv/pull/21923">#21923</a>)</li> </ul> <h2>Install uv 0.12.18</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-installer.ps1 | iex" </code></pre> <h2>Download uv 0.12.18</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-aarch64-apple-darwin.tar.gz">uv-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">uv's changelog</a>.</em></p> <blockquote> <h2>0.12.18</h2> <p>Released on 2026-09-22.</p> <p>This release addresses <a href="https://github.com/astral-sh/uv/security/advisories/GHSA-2cv4-cqwr-gwf7">GHSA-2cv4-cqwr-gwf7</a>, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.</p> <h3>Enhancements</h3> <ul> <li>Add <code>--output-format json</code> to <code>uv pip install</code> and <code>uv pip sync</code>, including for <code>--dry-run</code> and <code>--check</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21893">#21893</a>)</li> <li>Add <code>--check</code> to <code>uv pip install</code> and <code>uv pip sync</code> to report planned changes without modifying the environment (<a href="https://redirect.github.com/astral-sh/uv/pull/21844">#21844</a>)</li> <li>Identify failures from <code>get_requires_for_build_*</code> hooks correctly in build errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21881">#21881</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Validate build requirements for <code>uv build --no-build-isolation</code> with <code>--preview-features build-dependency-check</code>; use <code>--skip-dependency-check</code> to opt out (<a href="https://redirect.github.com/astral-sh/uv/pull/21880">#21880</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Speed up <code>uv_build</code> editable wheel creation by omitting compression from temporary wheels (<a href="https://redirect.github.com/astral-sh/uv/pull/21918">#21918</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags (<a href="https://redirect.github.com/astral-sh/uv/pull/21835">#21835</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/21836">#21836</a>)</li> <li>Restore project, script, and lock files when <code>uv add</code>, <code>uv remove</code>, or <code>uv version</code> fails or is interrupted (<a href="https://redirect.github.com/astral-sh/uv/pull/21860">#21860</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/21856">#21856</a>)</li> <li>Use configured <code>dependency-metadata</code> when checking whether installed requirements are satisfied (<a href="https://redirect.github.com/astral-sh/uv/pull/21843">#21843</a>)</li> <li>Reject archive entries that normalize to absolute Windows paths (<a href="https://redirect.github.com/astral-sh/uv/pull/21923">#21923</a>)</li> <li>Recognize distribution filenames and archive extensions when URL fragments contain <code>?</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21920">#21920</a>)</li> <li>Generate correctly lowercased platform tags for BSD and Haiku releases (<a href="https://redirect.github.com/astral-sh/uv/pull/21853">#21853</a>)</li> <li>Avoid rebuilding a Windows relative path into an absolute form (<a href="https://redirect.github.com/astral-sh/uv/pull/21923">#21923</a>)</li> </ul> <h2>0.12.17</h2> <p>Released on 2026-09-18.</p> <h3>Enhancements</h3> <ul> <li>Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports (<a href="https://redirect.github.com/astral-sh/uv/pull/21780">#21780</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Set minimum glibc and musl versions that universal resolutions must support with <code>minimum-libc-version</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21651">#21651</a>)</li> <li>Reject <code>pylock.toml</code> files whose wheel filenames do not match their declared package names or versions (<a href="https://redirect.github.com/astral-sh/uv/pull/20746">#20746</a>)</li> <li>Keep <code>uv workspace metadata</code> read-only unless <code>--sync</code> is provided (<a href="https://redirect.github.com/astral-sh/uv/pull/21821">#21821</a>)</li> <li>Apply <code>uv check</code> lock modes when retrieving workspace metadata (<a href="https://redirect.github.com/astral-sh/uv/pull/21821">#21821</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Speed up builds with many exclusion patterns by avoiding quadratic deduplication (<a href="https://redirect.github.com/astral-sh/uv/pull/21650">#21650</a>)</li> <li>Reduce resolver allocations when deduplicating package and distribution requests (<a href="https://redirect.github.com/astral-sh/uv/pull/21810">#21810</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/01cb90c1a4f88af09906cb60de9766d2add4a062"><code>01cb90c</code></a> Hush some PEP 440 version warnings when dry-running Docker pushes (<a href="https://redirect.github.com/astral-sh/uv/issues/21929">#21929</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/9937fa25e32ba962f91754ce4f0ee264355f4fba"><code>9937fa2</code></a> Check remote wheel metadata prefetch ranges (<a href="https://redirect.github.com/astral-sh/uv/issues/21919">#21919</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/0f039633039feaf65f67f89979e8cf4e81deedef"><code>0f03963</code></a> Skip loading Python download metadata when listing installed interpreters (<a href="https://redirect.github.com/astral-sh/uv/issues/2">#2</a>...</li> <li><a href="https://github.com/astral-sh/uv/commit/6d1b2661a943775ba2a36d2aa558298af9e277e5"><code>6d1b266</code></a> filter severity: labels in pr promotion automation (<a href="https://redirect.github.com/astral-sh/uv/issues/21926">#21926</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/d2698397da6215c7be71e51457bd90507ef7e6a5"><code>d269839</code></a> Bump version to 0.12.18 (<a href="https://redirect.github.com/astral-sh/uv/issues/21924">#21924</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/67169645278ce082638d619beefa6d062540843b"><code>6716964</code></a> Avoid rebuilding a path into an absolute form (<a href="https://redirect.github.com/astral-sh/uv/issues/21923">#21923</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/4dd39e85b13e97152d1c309f17dbdc1a9c07f11d"><code>4dd39e8</code></a> Use uncompressed editable wheels (<a href="https://redirect.github.com/astral-sh/uv/issues/21918">#21918</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/0c8da51a4b87c340c1cc85f6bde867d132df0f64"><code>0c8da51</code></a> Add JSON output for <code>uv pip install</code> and <code>uv pip sync</code> (<a href="https://redirect.github.com/astral-sh/uv/issues/21893">#21893</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/07143223ba8778f40d2d003e3381e65f0180669f"><code>0714322</code></a> Fix fragment boundaries in <code>UrlString::base_str</code> (<a href="https://redirect.github.com/astral-sh/uv/issues/21920">#21920</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/8460ef50ac8d00b1d98fd78cb0e686d3f5a90f8f"><code>8460ef5</code></a> Share URL userinfo redaction (<a href="https://redirect.github.com/astral-sh/uv/issues/21912">#21912</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.12.15...0.12.18">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ansible/molecule/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Shashank Venkat <shvenkat@redhat.com>
test: model one ephemeral directory per scenario in the unit fixture (#… …4701) ## Summary The unit-test suite mocks `Scenario.ephemeral_directory` so tests do not touch a real per-project cache. The mock returns one shared directory for every scenario, so two `Scenario` objects in the same test see an identical ephemeral directory. The real property does not behave that way outside shared state: it derives a distinct path per scenario. This changes the mock to model what the code actually does, one directory per scenario, and cleans up a `__repr__` assertion that was only passing by accident under the old mock. This is test-only. Nothing under `src/molecule` changes, and no runtime behavior changes. ## Problem `tests/conftest.py` monkeypatches `Scenario.ephemeral_directory` onto the class with a function that ignores the scenario it is called on: ```python def mock_ephemeral_directory(_self: Scenario) -> str: return str(test_dir) ``` `tests/unit/conftest.py` wires `config_instance` to depend on that fixture, so most of the unit suite runs against this mock. Because it returns the same `test_dir` for every scenario, the suite cannot express or observe per-scenario ephemeral paths: two distinct `Scenario` instances return byte-identical directories. The real `Scenario.ephemeral_directory` composes a per-scenario path (`molecule.<checksum>.<scenario name>`, with the name sanitized) and only collapses all scenarios onto one directory when `shared_state` is enabled. The old mock modeled that shared-state collapse unconditionally, for every test, which is the case the suite least needs as its default. ## Root cause of the fallout `test_ephemeral_directory_property` asserted the ephemeral directory appears in the scenario's `repr()`: ```python # assert that scenario path is included in in repr (useful for debugging) assert _instance.ephemeral_directory in repr(_instance) ``` But `Scenario.__repr__` never mentions the ephemeral directory: ```python def __repr__(self) -> str: return f"<Scenario {self.name} from {self.config.project_directory}>" ``` The assertion passed only because `config_instance` chdirs into the same directory the shared mock returned, so `ephemeral_directory` and `project_directory` were the identical string at that moment. Once the mock returns a per-scenario subdirectory, the ephemeral directory becomes a strict subpath of `project_directory` rather than equal to it, the coincidence breaks, and the assertion fails, exposing that it was never checking the ephemeral directory at all. It was, at most, an incidental check of `__repr__`. ## Changes - `tests/conftest.py`: `mock_ephemeral_directory` now derives the directory from the scenario asking, `test_dir / _self.name`, creating it on demand exactly as the real property does with `mkdir(parents=True, exist_ok=True)`. Teardown is unchanged: the fixture's existing `shutil.rmtree(test_dir)` removes the per-scenario subdirectories with the rest of the tree. - `tests/unit/test_scenario.py`: `test_ephemeral_directory_property` now checks only what its name promises, that the ephemeral directory is writable. The `repr()` check moves to a dedicated `test_scenario_repr` that asserts the exact representation string, so it tests `__repr__`'s actual contract instead of relying on a chdir coincidence: ```python def test_scenario_repr(_instance: Scenario) -> None: expected = f"<Scenario {_instance.name} from {_instance.config.project_directory}>" assert repr(_instance) == expected ``` - `.config/pydoclint-baseline.txt`: the mock gains an `Args:` entry for `_self` (and its `Returns:` type is corrected from `Path` to `str` to match the annotation), so its two DOC101/DOC103 baseline exceptions are no longer needed. The pydoclint pre-commit hook regenerated the file; the two removed lines are the only change. ## What this does and does not claim This is an obstacle removed, not a bug caught. It does not fix any user-facing behavior, and no pipeline will feel a change. The narrow claim is exactly this: the fixture should model one directory per scenario because that is what the code does, and a test whose comment claimed to check the ephemeral path never did. Stating it at that strength is the point. ## Test / lint evidence Base `upstream/main` at `66b70b0a`. All runs in a clean clone, molecule dev environment. `tox -e lint` (full prek/pre-commit suite, `--all-files`): ``` EXIT=0 ``` All hooks pass, including mypy, pydoclint, pylint, codespell and cspell; the pydoclint baseline shows no drift once the regeneration is committed. `tox -e py`, with a container engine available so the container-backed integration tests run: ``` 909 passed, 7 skipped, 11 warnings in 538.74s ``` The full suite is green, including `test_podman`, `test_native_inventory` and `test_with_backend_as_ansible_navigator`, which build and drive real containers. `test_scenario_repr` and `test_ephemeral_directory_property` both pass, and total coverage holds at 90%. ## Notes for reviewers - Test-only by intent. The mock change is the piece that lets the unit suite express per-scenario ephemeral paths; the assertion move is the one bit of fallout it produced. - The `repr()` check was relocated rather than dropped so `Scenario.__repr__` stays covered, and rewritten as an exact-string assertion so it tests the representation contract directly rather than by coincidence. - An alternative was to put the ephemeral directory into `__repr__`, which is what the old comment always intended and would be useful when debugging. That is a runtime change and out of scope for a test-only PR, so `__repr__` is untouched. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Tests** - Improved test isolation by assigning each scenario its own ephemeral directory, including support for scenario names containing path separators. - Added coverage for creating required directories and formatting scenario-specific paths consistently. - Strengthened scenario representation tests to verify the complete expected display format. - Updated documentation checks to accurately reflect fixture arguments and return values. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Jeff Pullen <9343691+jeffcpullen@users.noreply.github.com> Co-authored-by: Jeff Pullen <9343691+jeffcpullen@users.noreply.github.com> Co-authored-by: Shashank Venkat <shvenkat@redhat.com>
chore(deps): bump gitpython from 3.1.57 to 3.1.58 (#4684) Bumps [gitpython](https://github.com/gitpython-developers/GitPython) from 3.1.57 to 3.1.58. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/gitpython-developers/GitPython/releases">gitpython's releases</a>.</em></p> <blockquote> <h2>3.1.58 - Security and Fixes</h2> <h2>What's Changed</h2> <ul> <li>test: allow Python startup before timeout by <a href="https://github.com/Byron"><code>@Byron</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2195">gitpython-developers/GitPython#2195</a></li> <li>Resolve Windows hook Bash through PATH by <a href="https://github.com/Byron"><code>@Byron</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2199">gitpython-developers/GitPython#2199</a></li> <li>Revert "Resolve Windows hook Bash through PATH" by <a href="https://github.com/Byron"><code>@Byron</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2200">gitpython-developers/GitPython#2200</a></li> <li>test: focus pytest summary on unexpected failures by <a href="https://github.com/raisulchowdhury"><code>@raisulchowdhury</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2203">gitpython-developers/GitPython#2203</a></li> <li>Validate submodule names before filesystem operations by <a href="https://github.com/Byron"><code>@Byron</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2202">gitpython-developers/GitPython#2202</a></li> <li>Handle invalid submodule names during recursive updates by <a href="https://github.com/Byron"><code>@Byron</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2205">gitpython-developers/GitPython#2205</a></li> <li>Fix Windows path handling on Python 3.13+ by <a href="https://github.com/Byron"><code>@Byron</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2196">gitpython-developers/GitPython#2196</a></li> <li>fixup 2202 by <a href="https://github.com/Byron"><code>@Byron</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2206">gitpython-developers/GitPython#2206</a></li> <li>Correct Windows hook Bash precedence by <a href="https://github.com/Byron"><code>@Byron</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2201">gitpython-developers/GitPython#2201</a></li> <li>Harden config and Git option validation by <a href="https://github.com/Byron"><code>@Byron</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2204">gitpython-developers/GitPython#2204</a></li> <li>Skip tests that need symlink privileges instead of erroring by <a href="https://github.com/Cyrus580529"><code>@Cyrus580529</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2197">gitpython-developers/GitPython#2197</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/raisulchowdhury"><code>@raisulchowdhury</code></a> made their first contribution in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2203">gitpython-developers/GitPython#2203</a></li> <li><a href="https://github.com/Cyrus580529"><code>@Cyrus580529</code></a> made their first contribution in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2197">gitpython-developers/GitPython#2197</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/gitpython-developers/GitPython/compare/3.1.57...3.1.58">https://github.com/gitpython-developers/GitPython/compare/3.1.57...3.1.58</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/gitpython-developers/GitPython/commit/30be45d786e95023e23c616fec5cbabca861b44c"><code>30be45d</code></a> prepare changelog for upcoming release</li> <li><a href="https://github.com/gitpython-developers/GitPython/commit/fc2f02cc15af0457896f40a8a72b9f1866d75788"><code>fc2f02c</code></a> Merge pull request <a href="https://redirect.github.com/gitpython-developers/GitPython/issues/2197">#2197</a> from Cyrus580529/shared-symlink-guard</li> <li><a href="https://github.com/gitpython-developers/GitPython/commit/b10e2501438e31cbc1220c4879fc3747c34dccdb"><code>b10e250</code></a> test: use the shared guard instead of local copies</li> <li><a href="https://github.com/gitpython-developers/GitPython/commit/e3e5da8476d9e184ebc729d2d85ea035e582d467"><code>e3e5da8</code></a> test: skip tests that need symlink privileges</li> <li><a href="https://github.com/gitpython-developers/GitPython/commit/30d05e30c0b7f28bed7e10cb17b10b68e0708af9"><code>30d05e3</code></a> test: add a shared symlink capability guard</li> <li><a href="https://github.com/gitpython-developers/GitPython/commit/9a8f6fef579912bc8b10ab513c33ca6ea1f687ef"><code>9a8f6fe</code></a> Merge pull request <a href="https://redirect.github.com/gitpython-developers/GitPython/issues/2204">#2204</a> from gitpython-developers/security-fixes</li> <li><a href="https://github.com/gitpython-developers/GitPython/commit/f2550b65bf60ca087190981e2c7b6865e201f40c"><code>f2550b6</code></a> Guard pathspec file inputs in high-level commands</li> <li><a href="https://github.com/gitpython-developers/GitPython/commit/d9ddb55bdc66ffe8c9932fe460e6b8c8211e47c7"><code>d9ddb55</code></a> Guard unsafe git init options</li> <li><a href="https://github.com/gitpython-developers/GitPython/commit/9b5dcaf85da5946dbf69dcd53f9edba08f760b32"><code>9b5dcaf</code></a> Guard read-tree index output paths</li> <li><a href="https://github.com/gitpython-developers/GitPython/commit/96a888f4d782cb2f80452148e48e60ce4af6d541"><code>96a888f</code></a> Check joined short-option values before Git execution</li> <li>Additional commits viewable in <a href="https://github.com/gitpython-developers/GitPython/compare/3.1.57...3.1.58">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ansible/molecule/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
fix: upgrade cryptography and cairosvg to patch known vulnerabilities (… …#4652) - Bump cryptography 48.0.0 -> 49.0.0 (GHSA-537c-gmf6-5ccf, CVE-2026-39892) - Bump cairosvg 2.7.1 -> 2.9.0 for all Python versions (CVE-2026-31899) - Add cairosvg>=2.9.0 constraint to prevent vulnerable resolution on Python 3.10
chore(deps): update pep621 (#4627) This PR contains the following updates: | Update | Change | |---|---| | lockFileMaintenance | All locks refreshed | 🔧 This Pull Request updates lock files to use the latest dependency versions. --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on monday" in timezone UTC, Automerge - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) in timezone UTC. 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/ansible/molecule). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDIuMTEiLCJ1cGRhdGVkSW5WZXIiOiI0My4xMDIuMTEiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImNob3JlIiwiZGVwZW5kZW5jaWVzIiwicGVwNjIxIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix: validate subcommand name before dynamic import (#4620) Validation for subcommand names in `execute_subcommand` ensures that only alphanumeric characters and underscores are processed. While checking the command execution flow, I noticed that `import_module` was receiving values directly from the scenario configuration without sanitization. This change prevents potential unintended module loading attempts through special characters or path traversal sequences in the subcommand string. Existing tests for command execution remain unchanged, and I added a new test case to verify that invalid subcommand names are correctly rejected with a `MoleculeError`. Verified the changes locally with `ruff` to ensure compliance with the project's linting standards.
chore: Add check for platform versions (#4584) This pull request introduces several updates to platform compatibility management and dependency constraints, as well as minor configuration changes. The most significant changes are the addition of explicit package version rules for Renovate, updates to dependency versions, and the inclusion of a new pre-commit hook for platform constraint checking. **Platform compatibility and dependency management:** * Added explicit `packageRules` in `renovate.json` to restrict versions of key dependencies (e.g., `ansible-core`, `cffi`, `django`, `importlib-metadata`, `jsonschema`, `packaging`, `pyyaml`, `python-gnupg`, `setuptools`) for platform compatibility. * Updated the `packaging` dependency version in `pyproject.toml` to require at least `23.2` instead of `25.0`, aligning with the new Renovate constraint. **Pre-commit and configuration updates:** * Added a new pre-commit hook `check-platform-constraints` from `ansible/team-devtools` to enforce platform compatibility during development. **Minor dictionary and housekeeping updates:** * Removed the word `levelname` from `.config/dictionary.txt` to clean up the custom dictionary. --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
chore(deps): update all dependencies (#4576) This PR contains the following updates: | Package | Change | Age | Confidence | Type | Update | Pending | |---|---|---|---|---|---|---| | [ansible-compat](https://redirect.github.com/ansible/ansible-compat) ([changelog](https://redirect.github.com/ansible/ansible-compat/releases)) | `25.8.2` -> `25.11.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | project.dependencies | minor | | | [ansible-lint](https://redirect.github.com/ansible/ansible-lint) ([changelog](https://redirect.github.com/ansible/ansible-lint/releases)) | `25.9.2` -> `25.11.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | dependency-groups | minor | | | [ansible-navigator](https://redirect.github.com/ansible/ansible-navigator) ([changelog](https://redirect.github.com/ansible/ansible-navigator/releases)) | `25.9.0` -> `25.11.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | dependency-groups | minor | | | [ansible/ansible-lint](https://redirect.github.com/ansible/ansible-lint) | `v25.9.2` -> `v25.11.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | repository | minor | | | [astral-sh/ruff-pre-commit](https://redirect.github.com/astral-sh/ruff-pre-commit) | `v0.14.4` -> `v0.14.5` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | repository | patch | | | [astral-sh/uv-pre-commit](https://redirect.github.com/astral-sh/uv-pre-commit) | `0.9.8` -> `0.9.10` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | repository | patch | | | [biomejs/pre-commit](https://redirect.github.com/biomejs/pre-commit) | `v2.3.4` -> `v2.3.6` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | repository | patch | | | [click](https://redirect.github.com/pallets/click) ([changelog](https://click.palletsprojects.com/page/changes/)) | `8.3.0` -> `8.3.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | project.dependencies | patch | | | [pycqa/pylint](https://redirect.github.com/pycqa/pylint) | `v4.0.2` -> `v4.0.3` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | repository | patch | | | [pylint](https://redirect.github.com/pylint-dev/pylint) ([changelog](https://pylint.readthedocs.io/en/latest/whatsnew/3/)) | `4.0.2` -> `4.0.3` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | dependency-groups | patch | | | [pytest](https://redirect.github.com/pytest-dev/pytest) ([changelog](https://docs.pytest.org/en/stable/changelog.html)) | `9.0.0` -> `9.0.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | dependency-groups | patch | | | [streetsidesoftware/cspell-cli](https://redirect.github.com/streetsidesoftware/cspell-cli) | `v9.2.1` -> `v9.3.3` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | repository | minor | | | [tombi-toml/tombi-pre-commit](https://redirect.github.com/tombi-toml/tombi-pre-commit) | `v0.6.41` -> `v0.6.50` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | repository | patch | `v0.6.52` (+1) | | | All locks refreshed | | | | lockFileMaintenance | | | [ruff](https://docs.astral.sh/ruff) ([source](https://redirect.github.com/astral-sh/ruff), [changelog](https://redirect.github.com/astral-sh/ruff/blob/main/CHANGELOG.md)) | `0.14.4` -> `0.14.5` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | dependency-groups | patch | | | [tox-ansible](https://redirect.github.com/ansible/tox-ansible) ([changelog](https://redirect.github.com/ansible/tox-ansible/releases)) | `25.8.0` -> `25.11.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | dependency-groups | minor | | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>ansible/ansible-compat (ansible-compat)</summary> ### [`v25.11.0`](https://redirect.github.com/ansible/ansible-compat/releases/tag/v25.11.0) [Compare Source](https://redirect.github.com/ansible/ansible-compat/compare/v25.8.2...v25.11.0) #### Maintenance - chore(deps): update all dependencies ([#​543](https://redirect.github.com/ansible/ansible-compat/issues/543)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​542](https://redirect.github.com/ansible/ansible-compat/issues/542)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​540](https://redirect.github.com/ansible/ansible-compat/issues/540)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​539](https://redirect.github.com/ansible/ansible-compat/issues/539)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - Add finalize workflow for secure sonarcloud checks ([#​538](https://redirect.github.com/ansible/ansible-compat/issues/538)) [@​alisonlhart](https://redirect.github.com/alisonlhart) - Update sonar-project.properties configuration ([#​536](https://redirect.github.com/ansible/ansible-compat/issues/536)) [@​alisonlhart](https://redirect.github.com/alisonlhart) - chore(deps): update all dependencies ([#​537](https://redirect.github.com/ansible/ansible-compat/issues/537)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore: tell uv to use unreleased ansible-core when running with py314 ([#​535](https://redirect.github.com/ansible/ansible-compat/issues/535)) [@​ssbarnea](https://redirect.github.com/ssbarnea) - \[pre-commit.ci] pre-commit autoupdate ([#​534](https://redirect.github.com/ansible/ansible-compat/issues/534)) @​[pre-commit-ci\[bot\]](https://redirect.github.com/apps/pre-commit-ci) </details> <details> <summary>ansible/ansible-lint (ansible-lint)</summary> ### [`v25.11.0`](https://redirect.github.com/ansible/ansible-lint/releases/tag/v25.11.0) [Compare Source](https://redirect.github.com/ansible/ansible-lint/compare/v25.9.2...v25.11.0) ##### Fixes - fix: require ansible-core>=2.17.10 ([#​4835](https://redirect.github.com/ansible/ansible-lint/issues/4835)) [@​ssbarnea](https://redirect.github.com/ssbarnea) - fix: ignore internal types false positives with jinja\[invalid] ([#​4823](https://redirect.github.com/ansible/ansible-lint/issues/4823)) [@​anusshukla](https://redirect.github.com/anusshukla) - fix: make repository key optional in galaxy.yml ([#​4798](https://redirect.github.com/ansible/ansible-lint/issues/4798)) [@​rivv0](https://redirect.github.com/rivv0) - fix: github action ref doesn't checkout that ref ([#​4774](https://redirect.github.com/ansible/ansible-lint/issues/4774)) [@​rohun-apex](https://redirect.github.com/rohun-apex) - fix: add set-environment and unset-environment in executable\_options for systemctl ([#​4785](https://redirect.github.com/ansible/ansible-lint/issues/4785)) [@​ziegenberg](https://redirect.github.com/ziegenberg) - Fix typos ([#​4814](https://redirect.github.com/ansible/ansible-lint/issues/4814)) [@​jsf9k](https://redirect.github.com/jsf9k) ##### Maintenance - chore: pre-commit autoupdate ([#​4834](https://redirect.github.com/ansible/ansible-lint/issues/4834)) @​[pre-commit-ci\[bot\]](https://redirect.github.com/apps/pre-commit-ci) - chore: Test cspell configuration ([#​4828](https://redirect.github.com/ansible/ansible-lint/issues/4828)) [@​alisonlhart](https://redirect.github.com/alisonlhart) - chore(deps): update all dependencies ([#​4817](https://redirect.github.com/ansible/ansible-lint/issues/4817)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - Add finalize workflow for secure sonarcloud checks ([#​4820](https://redirect.github.com/ansible/ansible-lint/issues/4820)) [@​alisonlhart](https://redirect.github.com/alisonlhart) - Update sonar-project.properties ([#​4815](https://redirect.github.com/ansible/ansible-lint/issues/4815)) [@​alisonlhart](https://redirect.github.com/alisonlhart) </details> <details> <summary>ansible/ansible-navigator (ansible-navigator)</summary> ### [`v25.11.0`](https://redirect.github.com/ansible/ansible-navigator/releases/tag/v25.11.0) [Compare Source](https://redirect.github.com/ansible/ansible-navigator/compare/v25.9.0...v25.11.0) #### Fixes - fix: avoid using hub.docker.com ([#​2051](https://redirect.github.com/ansible/ansible-navigator/issues/2051)) [@​ssbarnea](https://redirect.github.com/ssbarnea) #### Maintenance - chore: rename sonar config file ([#​2056](https://redirect.github.com/ansible/ansible-navigator/issues/2056)) [@​ssbarnea](https://redirect.github.com/ssbarnea) - chore(deps): update all dependencies ([#​2060](https://redirect.github.com/ansible/ansible-navigator/issues/2060)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore: use ansible/actions/matrix ([#​2061](https://redirect.github.com/ansible/ansible-navigator/issues/2061)) [@​ssbarnea](https://redirect.github.com/ssbarnea) - \[pre-commit.ci] pre-commit autoupdate ([#​2054](https://redirect.github.com/ansible/ansible-navigator/issues/2054)) @​[pre-commit-ci\[bot\]](https://redirect.github.com/apps/pre-commit-ci) - chore(deps): update all dependencies ([#​2053](https://redirect.github.com/ansible/ansible-navigator/issues/2053)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​2052](https://redirect.github.com/ansible/ansible-navigator/issues/2052)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​2050](https://redirect.github.com/ansible/ansible-navigator/issues/2050)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​2049](https://redirect.github.com/ansible/ansible-navigator/issues/2049)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​2048](https://redirect.github.com/ansible/ansible-navigator/issues/2048)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​2047](https://redirect.github.com/ansible/ansible-navigator/issues/2047)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​2046](https://redirect.github.com/ansible/ansible-navigator/issues/2046)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​2045](https://redirect.github.com/ansible/ansible-navigator/issues/2045)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​2044](https://redirect.github.com/ansible/ansible-navigator/issues/2044)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​2043](https://redirect.github.com/ansible/ansible-navigator/issues/2043)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​2042](https://redirect.github.com/ansible/ansible-navigator/issues/2042)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) </details> <details> <summary>astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)</summary> ### [`v0.14.5`](https://redirect.github.com/astral-sh/ruff-pre-commit/releases/tag/v0.14.5) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.14.4...v0.14.5) See: <https://github.com/astral-sh/ruff/releases/tag/0.14.5> </details> <details> <summary>astral-sh/uv-pre-commit (astral-sh/uv-pre-commit)</summary> ### [`v0.9.10`](https://redirect.github.com/astral-sh/uv-pre-commit/releases/tag/0.9.10) [Compare Source](https://redirect.github.com/astral-sh/uv-pre-commit/compare/0.9.9...0.9.10) See: <https://github.com/astral-sh/uv/releases/tag/0.9.10> ### [`v0.9.9`](https://redirect.github.com/astral-sh/uv-pre-commit/releases/tag/0.9.9) [Compare Source](https://redirect.github.com/astral-sh/uv-pre-commit/compare/0.9.8...0.9.9) See: <https://github.com/astral-sh/uv/releases/tag/0.9.9> </details> <details> <summary>biomejs/pre-commit (biomejs/pre-commit)</summary> ### [`v2.3.6`](https://redirect.github.com/biomejs/pre-commit/compare/v2.3.5...v2.3.6) [Compare Source](https://redirect.github.com/biomejs/pre-commit/compare/v2.3.5...v2.3.6) ### [`v2.3.5`](https://redirect.github.com/biomejs/pre-commit/compare/v2.3.4...v2.3.5) [Compare Source](https://redirect.github.com/biomejs/pre-commit/compare/v2.3.4...v2.3.5) </details> <details> <summary>pallets/click (click)</summary> ### [`v8.3.1`](https://redirect.github.com/pallets/click/blob/HEAD/CHANGES.rst#Version-831) [Compare Source](https://redirect.github.com/pallets/click/compare/8.3.0...8.3.1) Released 2025-11-15 - Don't discard pager arguments by correctly using `subprocess.Popen`. :issue:`3039` :pr:`3055` - Replace `Sentinel.UNSET` default values by `None` as they're passed through the `Context.invoke()` method. :issue:`3066` :issue:`3065` :pr:`3068` - Fix conversion of `Sentinel.UNSET` happening too early, which caused incorrect behavior for multiple parameters using the same name. :issue:`3071` :pr:`3079` - Hide `Sentinel.UNSET` values as `None` when looking up for other parameters through the context inside parameter callbacks. :issue:`3136` :pr:`3137` - Fix rendering when `prompt` and `confirm` parameter `prompt_suffix` is empty. :issue:`3019` :pr:`3021` - When `Sentinel.UNSET` is found during parsing, it will skip calls to `type_cast_value`. :issue:`3069` :pr:`3090` </details> <details> <summary>pycqa/pylint (pycqa/pylint)</summary> ### [`v4.0.3`](https://redirect.github.com/pylint-dev/pylint/releases/tag/v4.0.3) [Compare Source](https://redirect.github.com/pycqa/pylint/compare/v4.0.2...v4.0.3) ## What's new in Pylint 4.0.3? Release date: 2025-11-13 ## False Positives Fixed - Add Enum dunder methods `_generate_next_value_`, `_missing_`, `_numeric_repr_`, `_add_alias_`, and `_add_value_alias_` to the list passed to `--good-dunder-names`. Closes [#​10435](https://redirect.github.com/pycqa/pylint/issues/10435) - Fixed false positive for `invalid-name` with `typing.Annotated`. Closes [#​10696](https://redirect.github.com/pycqa/pylint/issues/10696) - Fix false positive for `f-string-without-interpolation` with template strings when using format spec. Closes [#​10702](https://redirect.github.com/pycqa/pylint/issues/10702) - Fix a false positive when an UPPER\_CASED class attribute was raising an `invalid-name` when typed with `Final`. Closes [#​10711](https://redirect.github.com/pycqa/pylint/issues/10711) - Fix a false positive for `unbalanced-tuple-unpacking` when a tuple is assigned to a function call and the structure of the function's return value is ambiguous. Closes [#​10721](https://redirect.github.com/pycqa/pylint/issues/10721) ## Other Bug Fixes - Make 'ignore' option work as expected again. Closes [#​10669](https://redirect.github.com/pycqa/pylint/issues/10669) - Fix crash for `consider-using-assignment-expr` when a variable annotation without assignment is used as the `if` test expression. Closes [#​10707](https://redirect.github.com/pycqa/pylint/issues/10707) - Fix crash for `prefer-typing-namedtuple` and `consider-math-not-float` when a `slice` object is called. Closes [#​10708](https://redirect.github.com/pycqa/pylint/issues/10708) </details> <details> <summary>pylint-dev/pylint (pylint)</summary> ### [`v4.0.3`](https://redirect.github.com/pylint-dev/pylint/releases/tag/v4.0.3) [Compare Source](https://redirect.github.com/pylint-dev/pylint/compare/v4.0.2...v4.0.3) ## What's new in Pylint 4.0.3? Release date: 2025-11-13 ## False Positives Fixed - Add Enum dunder methods `_generate_next_value_`, `_missing_`, `_numeric_repr_`, `_add_alias_`, and `_add_value_alias_` to the list passed to `--good-dunder-names`. Closes [#​10435](https://redirect.github.com/pylint-dev/pylint/issues/10435) - Fixed false positive for `invalid-name` with `typing.Annotated`. Closes [#​10696](https://redirect.github.com/pylint-dev/pylint/issues/10696) - Fix false positive for `f-string-without-interpolation` with template strings when using format spec. Closes [#​10702](https://redirect.github.com/pylint-dev/pylint/issues/10702) - Fix a false positive when an UPPER\_CASED class attribute was raising an `invalid-name` when typed with `Final`. Closes [#​10711](https://redirect.github.com/pylint-dev/pylint/issues/10711) - Fix a false positive for `unbalanced-tuple-unpacking` when a tuple is assigned to a function call and the structure of the function's return value is ambiguous. Closes [#​10721](https://redirect.github.com/pylint-dev/pylint/issues/10721) ## Other Bug Fixes - Make 'ignore' option work as expected again. Closes [#​10669](https://redirect.github.com/pylint-dev/pylint/issues/10669) - Fix crash for `consider-using-assignment-expr` when a variable annotation without assignment is used as the `if` test expression. Closes [#​10707](https://redirect.github.com/pylint-dev/pylint/issues/10707) - Fix crash for `prefer-typing-namedtuple` and `consider-math-not-float` when a `slice` object is called. Closes [#​10708](https://redirect.github.com/pylint-dev/pylint/issues/10708) </details> <details> <summary>pytest-dev/pytest (pytest)</summary> ### [`v9.0.1`](https://redirect.github.com/pytest-dev/pytest/releases/tag/9.0.1) [Compare Source](https://redirect.github.com/pytest-dev/pytest/compare/9.0.0...9.0.1) ### pytest 9.0.1 (2025-11-12) #### Bug fixes - [#​13895](https://redirect.github.com/pytest-dev/pytest/issues/13895): Restore support for skipping tests via `raise unittest.SkipTest`. - [#​13896](https://redirect.github.com/pytest-dev/pytest/issues/13896): The terminal progress plugin added in pytest 9.0 is now automatically disabled when iTerm2 is detected, it generated desktop notifications instead of the desired functionality. - [#​13904](https://redirect.github.com/pytest-dev/pytest/issues/13904): Fixed the TOML type of the verbosity settings in the API reference from number to string. - [#​13910](https://redirect.github.com/pytest-dev/pytest/issues/13910): Fixed <span class="title-ref">UserWarning: Do not expect file\_or\_dir</span> on some earlier Python 3.12 and 3.13 point versions. #### Packaging updates and notes for downstreams - [#​13933](https://redirect.github.com/pytest-dev/pytest/issues/13933): The tox configuration has been adjusted to make sure the desired version string can be passed into its `package_env` through the `SETUPTOOLS_SCM_PRETEND_VERSION_FOR_PYTEST` environment variable as a part of the release process -- by `webknjaz`. #### Contributor-facing changes - [#​13891](https://redirect.github.com/pytest-dev/pytest/issues/13891), [#​13942](https://redirect.github.com/pytest-dev/pytest/issues/13942): The CI/CD part of the release automation is now capable of creating GitHub Releases without having a Git checkout on disk -- by `bluetech` and `webknjaz`. - [#​13933](https://redirect.github.com/pytest-dev/pytest/issues/13933): The tox configuration has been adjusted to make sure the desired version string can be passed into its `package_env` through the `SETUPTOOLS_SCM_PRETEND_VERSION_FOR_PYTEST` environment variable as a part of the release process -- by `webknjaz`. </details> <details> <summary>streetsidesoftware/cspell-cli (streetsidesoftware/cspell-cli)</summary> ### [`v9.3.3`](https://redirect.github.com/streetsidesoftware/cspell-cli/releases/tag/v9.3.3) [Compare Source](https://redirect.github.com/streetsidesoftware/cspell-cli/compare/v9.3.2...v9.3.3) ##### Trivial updates and changes. - Work on NPM Publishing ([#​730](https://redirect.github.com/streetsidesoftware/cspell-cli/issues/730)) ([25b6eae](https://redirect.github.com/streetsidesoftware/cspell-cli/commit/25b6eae8b8afc7260a889437cb4b54f8e3df5008)) ### [`v9.3.2`](https://redirect.github.com/streetsidesoftware/cspell-cli/releases/tag/v9.3.2) [Compare Source](https://redirect.github.com/streetsidesoftware/cspell-cli/compare/v9.3.1...v9.3.2) ##### Trivial updates and changes. - Update CSpell version (9.3.2) ([#​726](https://redirect.github.com/streetsidesoftware/cspell-cli/issues/726)) ([344ffb7](https://redirect.github.com/streetsidesoftware/cspell-cli/commit/344ffb7d06af4803f5e37e3b909f1f3137d5fcf9)) ### [`v9.3.1`](https://redirect.github.com/streetsidesoftware/cspell-cli/releases/tag/v9.3.1) [Compare Source](https://redirect.github.com/streetsidesoftware/cspell-cli/compare/v9.3.0...v9.3.1) ##### Trivial updates and changes. - Update CSpell version (9.3.1) ([#​722](https://redirect.github.com/streetsidesoftware/cspell-cli/issues/722)) ([be44634](https://redirect.github.com/streetsidesoftware/cspell-cli/commit/be446342a3508fd0f69c08366971e5e8c656ef47)) ### [`v9.3.0`](https://redirect.github.com/streetsidesoftware/cspell-cli/releases/tag/v9.3.0) [Compare Source](https://redirect.github.com/streetsidesoftware/cspell-cli/compare/v9.2.1...v9.3.0) ##### Features - Update CSpell version (9.3.0) ([#​719](https://redirect.github.com/streetsidesoftware/cspell-cli/issues/719)) ([7b263a4](https://redirect.github.com/streetsidesoftware/cspell-cli/commit/7b263a40a1c7d1c71ee1dc86dd04792b3843f640)) </details> <details> <summary>tombi-toml/tombi-pre-commit (tombi-toml/tombi-pre-commit)</summary> ### [`v0.6.50`](https://redirect.github.com/tombi-toml/tombi-pre-commit/releases/tag/v0.6.50) [Compare Source](https://redirect.github.com/tombi-toml/tombi-pre-commit/compare/v0.6.49...v0.6.50) See: <https://github.com/tombi-toml/tombi/releases/tag/v0.6.50> ### [`v0.6.49`](https://redirect.github.com/tombi-toml/tombi-pre-commit/releases/tag/v0.6.49) [Compare Source](https://redirect.github.com/tombi-toml/tombi-pre-commit/compare/v0.6.48...v0.6.49) See: <https://github.com/tombi-toml/tombi/releases/tag/v0.6.49> ### [`v0.6.48`](https://redirect.github.com/tombi-toml/tombi-pre-commit/releases/tag/v0.6.48) [Compare Source](https://redirect.github.com/tombi-toml/tombi-pre-commit/compare/v0.6.47...v0.6.48) See: <https://github.com/tombi-toml/tombi/releases/tag/v0.6.48> ### [`v0.6.47`](https://redirect.github.com/tombi-toml/tombi-pre-commit/releases/tag/v0.6.47) [Compare Source](https://redirect.github.com/tombi-toml/tombi-pre-commit/compare/v0.6.46...v0.6.47) See: <https://github.com/tombi-toml/tombi/releases/tag/v0.6.47> ### [`v0.6.46`](https://redirect.github.com/tombi-toml/tombi-pre-commit/releases/tag/v0.6.46) [Compare Source](https://redirect.github.com/tombi-toml/tombi-pre-commit/compare/v0.6.45...v0.6.46) See: <https://github.com/tombi-toml/tombi/releases/tag/v0.6.46> ### [`v0.6.45`](https://redirect.github.com/tombi-toml/tombi-pre-commit/releases/tag/v0.6.45) [Compare Source](https://redirect.github.com/tombi-toml/tombi-pre-commit/compare/v0.6.44...v0.6.45) See: <https://github.com/tombi-toml/tombi/releases/tag/v0.6.45> ### [`v0.6.44`](https://redirect.github.com/tombi-toml/tombi-pre-commit/releases/tag/v0.6.44) [Compare Source](https://redirect.github.com/tombi-toml/tombi-pre-commit/compare/v0.6.42...v0.6.44) See: <https://github.com/tombi-toml/tombi/releases/tag/v0.6.44> ### [`v0.6.42`](https://redirect.github.com/tombi-toml/tombi-pre-commit/releases/tag/v0.6.42) [Compare Source](https://redirect.github.com/tombi-toml/tombi-pre-commit/compare/v0.6.41...v0.6.42) See: <https://github.com/tombi-toml/tombi/releases/tag/v0.6.42> </details> <details> <summary>astral-sh/ruff (ruff)</summary> ### [`v0.14.5`](https://redirect.github.com/astral-sh/ruff/blob/HEAD/CHANGELOG.md#0145) [Compare Source](https://redirect.github.com/astral-sh/ruff/compare/0.14.4...0.14.5) Released on 2025-11-13. ##### Preview features - \[`flake8-simplify`] Apply `SIM113` when index variable is of type `int` ([#​21395](https://redirect.github.com/astral-sh/ruff/pull/21395)) - \[`pydoclint`] Fix false positive when Sphinx directives follow a "Raises" section (`DOC502`) ([#​20535](https://redirect.github.com/astral-sh/ruff/pull/20535)) - \[`pydoclint`] Support NumPy-style comma-separated parameters (`DOC102`) ([#​20972](https://redirect.github.com/astral-sh/ruff/pull/20972)) - \[`refurb`] Auto-fix annotated assignments (`FURB101`) ([#​21278](https://redirect.github.com/astral-sh/ruff/pull/21278)) - \[`ruff`] Ignore `str()` when not used for simple conversion (`RUF065`) ([#​21330](https://redirect.github.com/astral-sh/ruff/pull/21330)) ##### Bug fixes - Fix syntax error false positive on alternative `match` patterns ([#​21362](https://redirect.github.com/astral-sh/ruff/pull/21362)) - \[`flake8-simplify`] Fix false positive for iterable initializers with generator arguments (`SIM222`) ([#​21187](https://redirect.github.com/astral-sh/ruff/pull/21187)) - \[`pyupgrade`] Fix false positive on relative imports from local `.builtins` module (`UP029`) ([#​21309](https://redirect.github.com/astral-sh/ruff/pull/21309)) - \[`pyupgrade`] Consistently set the deprecated tag (`UP035`) ([#​21396](https://redirect.github.com/astral-sh/ruff/pull/21396)) ##### Rule changes - \[`refurb`] Detect empty f-strings (`FURB105`) ([#​21348](https://redirect.github.com/astral-sh/ruff/pull/21348)) ##### CLI - Add option to provide a reason to `--add-noqa` ([#​21294](https://redirect.github.com/astral-sh/ruff/pull/21294)) - Add upstream linter URL to `ruff linter --output-format=json` ([#​21316](https://redirect.github.com/astral-sh/ruff/pull/21316)) - Add color to `--help` ([#​21337](https://redirect.github.com/astral-sh/ruff/pull/21337)) ##### Documentation - Add a new "Opening a PR" section to the contribution guide ([#​21298](https://redirect.github.com/astral-sh/ruff/pull/21298)) - Added the PyScripter IDE to the list of "Who is using Ruff?" ([#​21402](https://redirect.github.com/astral-sh/ruff/pull/21402)) - Update PyCharm setup instructions ([#​21409](https://redirect.github.com/astral-sh/ruff/pull/21409)) - \[`flake8-annotations`] Add link to `allow-star-arg-any` option (`ANN401`) ([#​21326](https://redirect.github.com/astral-sh/ruff/pull/21326)) ##### Other changes - \[`configuration`] Improve error message when `line-length` exceeds `u16::MAX` ([#​21329](https://redirect.github.com/astral-sh/ruff/pull/21329)) ##### Contributors - [@​njhearp](https://redirect.github.com/njhearp) - [@​11happy](https://redirect.github.com/11happy) - [@​hugovk](https://redirect.github.com/hugovk) - [@​Gankra](https://redirect.github.com/Gankra) - [@​ntBre](https://redirect.github.com/ntBre) - [@​pyscripter](https://redirect.github.com/pyscripter) - [@​danparizher](https://redirect.github.com/danparizher) - [@​MichaReiser](https://redirect.github.com/MichaReiser) - [@​henryiii](https://redirect.github.com/henryiii) - [@​charliecloudberry](https://redirect.github.com/charliecloudberry) </details> <details> <summary>ansible/tox-ansible (tox-ansible)</summary> ### [`v25.11.1`](https://redirect.github.com/ansible/tox-ansible/releases/tag/v25.11.1) [Compare Source](https://redirect.github.com/ansible/tox-ansible/compare/v25.11.0...v25.11.1) ##### Fixes - tests - Expects ansible-compat as dependency ([#​509](https://redirect.github.com/ansible/tox-ansible/issues/509)) [@​KB-perByte](https://redirect.github.com/KB-perByte) ### [`v25.11.0`](https://redirect.github.com/ansible/tox-ansible/releases/tag/v25.11.0) [Compare Source](https://redirect.github.com/ansible/tox-ansible/compare/v25.8.0...v25.11.0) ##### Fixes - Add ansible-core==2.20 ([#​508](https://redirect.github.com/ansible/tox-ansible/issues/508)) [@​KB-perByte](https://redirect.github.com/KB-perByte) - fix: adopt tox.uv and modern packaging ([#​494](https://redirect.github.com/ansible/tox-ansible/issues/494)) [@​ssbarnea](https://redirect.github.com/ssbarnea) ##### Maintenance - chore(deps): update all dependencies ([#​507](https://redirect.github.com/ansible/tox-ansible/issues/507)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​506](https://redirect.github.com/ansible/tox-ansible/issues/506)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​505](https://redirect.github.com/ansible/tox-ansible/issues/505)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​504](https://redirect.github.com/ansible/tox-an 5CEE sible/issues/504)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - Add finalize workflow for secure sonarcloud checks ([#​503](https://redirect.github.com/ansible/tox-ansible/issues/503)) [@​alisonlhart](https://redirect.github.com/alisonlhart) - Update sonar-project.properties configuration ([#​501](https://redirect.github.com/ansible/tox-ansible/issues/501)) [@​alisonlhart](https://redirect.github.com/alisonlhart) - chore(deps): update all dependencies ([#​502](https://redirect.github.com/ansible/tox-ansible/issues/502)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore: pre-commit autoupdate ([#​499](https://redirect.github.com/ansible/tox-ansible/issues/499)) @​[pre-commit-ci\[bot\]](https://redirect.github.com/apps/pre-commit-ci) - chore: rename sonar config file ([#​500](https://redirect.github.com/ansible/tox-ansible/issues/500)) [@​ssbarnea](https://redirect.github.com/ssbarnea) - chore(deps): update all dependencies ([#​498](https://redirect.github.com/ansible/tox-ansible/issues/498)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​497](https://redirect.github.com/ansible/tox-ansible/issues/497)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​496](https://redirect.github.com/ansible/tox-ansible/issues/496)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​495](https://redirect.github.com/ansible/tox-ansible/issues/495)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​493](https://redirect.github.com/ansible/tox-ansible/issues/493)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​492](https://redirect.github.com/ansible/tox-ansible/issues/492)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update all dependencies ([#​491](https://redirect.github.com/ansible/tox-ansible/issues/491)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update pre-commit hook astral-sh/ruff-pre-commit to v0.12.12 ([#​489](https://redirect.github.com/ansible/tox-ansible/issues/489)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update actions/setup-python action to v6 ([#​488](https://redirect.github.com/ansible/tox-ansible/issues/488)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): update pre-commit hook jsh9/pydoclint to v0.7.3 ([#​487](https://redirect.github.com/ansible/tox-ansible/issues/487)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore(deps): pin dependencies ([#​485](https://redirect.github.com/ansible/tox-ansible/issues/485)) @​[renovate\[bot\]](https://redirect.github.com/apps/renovate) - chore: configure renovate ([#​483](https://redirect.github.com/ansible/tox-ansible/issues/483)) [@​ssbarnea](https://redirect.github.com/ssbarnea) - chore: update tests to work with newer tox ([#​484](https://redirect.github.com/ansible/tox-ansible/issues/484)) [@​ssbarnea](https://redirect.github.com/ssbarnea) - Bump the dependencies group across 1 directory with 18 updates ([#​474](https://redirect.github.com/ansible/tox-ansible/issues/474)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on monday" in timezone UTC, Automerge - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) in timezone UTC. 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/ansible/molecule). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQyLjE2LjEiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImNob3JlIiwiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
PreviousNext