Repository navigation
chore(deps): roll up Dependabot updates (datasets, hypothesis, artifact actions) - #77
Merged
Merged
Conversation
…ct actions) Combines the three open Dependabot PRs into one commit so they land in a single CI run. Each uv.lock package block is taken verbatim from its source PR; the two uv.lock sets are disjoint, so no re-resolution was performed and the uv.lock revision is untouched (CI pins uv and runs `uv sync --locked`). - #74 datasets 5.0.1 -> 5.1.0. This pulls a dependency-graph change: huggingface-hub 1.18.0 -> 2.1.1, hf-xet 1.5.0 -> 1.7.0, and drops requests/httpx/rich/typer/urllib3/certifi/... in favour of httpx2/httpcore2/httpx2-jsfetch/truststore. - #75 hypothesis 6.168.3 -> 6.168.5 - #76 actions/upload-artifact v7.0.1 -> v7.0.2, actions/download-artifact v8.0.1 -> v8.0.2
This was referenced Oct 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rolls up the three open Dependabot PRs into one PR so they land in a single CI run.
Each
uv.lockpackage block is copied verbatim from its source PR. The twouv.lockchange sets are disjoint, so no re-resolution was performed and the lock revision is untouched — which matters here because CI pins uv and runsuv sync --locked.uv.lock
datasets5.0.1 -> 5.1.0. Not a leaf bump: it also restructures the graph —huggingface-hub1.18.0 -> 2.1.1,hf-xet1.5.0 -> 1.7.0, andrequests/httpx/rich/typer/urllib3/certifi/ … are dropped in favour ofhttpx2,httpcore2,httpx2-jsfetchandtruststore.hypothesis6.168.3 -> 6.168.5workflows
actions/upload-artifactv7.0.1 -> v7.0.2 andactions/download-artifactv8.0.1 -> v8.0.2Verification
Local check before pushing: the changed, added and removed package sets equal the union of the two source PRs, and every changed or added block is byte-identical to its source PR's block.
uv.lockstill parses as TOML with[options]preserved.uv sync --lockedin CI is the authoritative check that the lock agrees withpyproject.toml.Superseded Dependabot PRs will close once this lands.