Repository navigation
Land the ten failing Dependabot pull requests #418
Description
What this is: the work item for merging ten open Dependabot pull requests without breaking Jerry. Parent: #417.
The problem: each pull request below fails the same nine of its fifteen CI checks: the eight "Test uv" matrix jobs and the "CI Success" gate. The other six pass (Changelog Entry, CLI Integration Tests, Plugin Validation, Security Scan, Static Analysis, Validation Checks). The root cause is under investigation.
| PR | Update | Files changed | Flagged in #385 |
|---|---|---|---|
| #391 | pip 26.1.2 → 26.2 | uv.lock |
yes |
| #393 | httpcore2 2.4.0 → 2.10.0 | uv.lock |
yes |
| #394 | httpx2 2.4.0 → 2.12.0 | uv.lock |
yes |
| #401 | anyio 4.13.0 → 4.14.2 | uv.lock |
yes |
| #404 | 8 updates: tiktoken, pygments, mypy, ruff 0.16.1 → 0.16.8, charset-normalizer, bump-my-version, pre-commit, pyright | uv.lock |
no |
| #408 | urllib3 2.7.0 → 2.8.0 | uv.lock |
yes |
| #410 | 4 GitHub Actions: upload-artifact, codecov-action, download-artifact, attest-build-provenance | ci.yml, release.yml |
no |
| #411 | commitizen pre-commit hook 4.17.0 → 4.19.2 | .pre-commit-config.yaml |
no |
| #412 | ruff pre-commit hook 0.16.1 → 0.17.1 | .pre-commit-config.yaml |
no |
| #414 | virtualenv 20.36.1 → 21.14.13 (major) | uv.lock |
yes |
Observed facts (as of 2026-10-25 UTC):
mainlast ran CI on 2026-08-13 (commit4aff2428, still the head ofmain), and it passed.- The oldest failing run is from 2026-09-01 (deps: Bump pip from 26.1.2 to 26.2 [skip-bump] [skip-changelog] #391); the newest is from 2026-10-24 (deps: Bump virtualenv from 20.36.1 to 21.14.13 #414).
- chore: Bump https://github.com/commitizen-tools/commitizen from v4.17.0 to 4.19.2 [skip-bump] [skip-changelog] #411 and chore: Bump https://github.com/astral-sh/ruff-pre-commit from v0.16.1 to 0.17.1 #412 change only the pre-commit configuration, yet fail the same nine checks.
- All ten pull requests are mergeable today; none has a conflict.
- For the six flagged packages, the pull requests' target versions meet or exceed every fix version listed in Security Alert: CVEs found in dependency tree #385.
Done when:
- Each pull request is merged to
main, or closed with a recorded reason (superseded by a newer Dependabot pull request, or deferred by the owner). - Every merged pull request passed all CI checks first, including the eight "Test uv" jobs and "CI Success".
- A root-cause write-up links to a failing CI run and to the change that fixed it.
- CI on
mainpasses after the last of the ten updates lands. - No existing test is skipped, deleted, or marked expected-to-fail to make a pull request pass, unless the owner approves that change.
Risks to watch:
- Seven pull requests change
uv.lock, so each merge makes the others stale. - deps: Bump the uv-minor-patch group across 1 directory with 8 updates #404 locks ruff 0.16.8 while chore: Bump https://github.com/astral-sh/ruff-pre-commit from v0.16.1 to 0.17.1 #412 moves the ruff hook to 0.17.1. A ruff formatter change blocked a Dependabot pull request before (chore: reformat repository for ruff 0.16.1 (Dependabot PR #334 formatting check red) #339).
- ci: Bump the actions-minor-patch group across 1 directory with 4 updates #410 updates actions used by the release workflow, which pull-request CI does not run.
- deps: Bump virtualenv from 20.36.1 to 21.14.13 #414 is a major version bump.
How it is being worked: the root-cause investigation runs through the multi-session working-model trial (#416).
Tracking: worktracker enabler EN-001, in projects/PROJ-025-tactical-work-q4y2026/work/EPIC-001-dependency-update-flow/FEAT-001-unblock-dependabot-backlog/EN-001-land-failing-dependabot-prs/. This issue stays open until the work lands on main.
Activity
[-]PROJ-025/EN-001: Land the Ten Failing Dependabot PRs[/-][+]Land the ten failing Dependabot pull requests[/+]