From dbb3b2d0711e8fd35909bb8ec41def27a4da6849 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 2 Aug 2026 21:03:09 +0000 Subject: [PATCH 1/6] [actions] (deps): Bump the dev-dependencies group across 1 directory with 3 updates Bumps the dev-dependencies group with 3 updates in the / directory: [actions/setup-python](https://github.com/actions/setup-python), [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) and [sigstore/gh-action-sigstore-python](https://github.com/sigstore/gh-action-sigstore-python). Updates `actions/setup-python` from 6 to 7 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v6...v7) Updates `pypa/gh-action-pypi-publish` from 1.14.0 to 1.14.2 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](https://github.com/pypa/gh-action-pypi-publish/compare/cef221092ed1bacb1cc03d23a2d87d1d172e277b...dc37677b2e1c63e2034f94d8a5b11f265b73ba33) Updates `sigstore/gh-action-sigstore-python` from 3.4.0 to 3.5.0 - [Release notes](https://github.com/sigstore/gh-action-sigstore-python/releases) - [Changelog](https://github.com/sigstore/gh-action-sigstore-python/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/gh-action-sigstore-python/compare/5b79a39c381910c090341a2c9b0bf022c8b387e1...790bc6befb9d733738f18d8f895854b453640ec9) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: dev-dependencies - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: sigstore/gh-action-sigstore-python dependency-version: 3.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] --- .github/workflows/publish-to-pypi.yaml | 8 ++++---- .github/workflows/pyright.yaml | 2 +- .github/workflows/pytest.yaml | 2 +- .github/workflows/ruff.yaml | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/publish-to-pypi.yaml b/.github/workflows/publish-to-pypi.yaml index ea667db..ae16ea3 100644 --- a/.github/workflows/publish-to-pypi.yaml +++ b/.github/workflows/publish-to-pypi.yaml @@ -13,7 +13,7 @@ jobs: steps: - uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@v7 with: python-version: "3.x" - name: Install hatch @@ -50,7 +50,7 @@ jobs: name: python-package-distributions path: dist/ - name: Publish distribution 📦 to PyPI - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 github-release: name: >- @@ -71,7 +71,7 @@ jobs: name: python-package-distributions path: dist/ - name: Sign the dists with Sigstore - uses: sigstore/gh-action-sigstore-python@5b79a39c381910c090341a2c9b0bf022c8b387e1 #v3.4.0 + uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9 #v3.5.0 with: inputs: >- ./dist/*.tar.gz @@ -115,6 +115,6 @@ jobs: name: python-package-distributions path: dist/ - name: Publish distribution 📦 to TestPyPI - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 with: repository-url: https://test.pypi.org/legacy/ diff --git a/.github/workflows/pyright.yaml b/.github/workflows/pyright.yaml index b0da9d6..e2cc5b9 100644 --- a/.github/workflows/pyright.yaml +++ b/.github/workflows/pyright.yaml @@ -14,7 +14,7 @@ jobs: steps: - uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@v7 with: python-version: '3.x' - name: Install dependencies diff --git a/.github/workflows/pytest.yaml b/.github/workflows/pytest.yaml index e50b2d7..54c3d7a 100644 --- a/.github/workflows/pytest.yaml +++ b/.github/workflows/pytest.yaml @@ -20,7 +20,7 @@ jobs: steps: - uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@v7 with: python-version: '3.x' - name: Install dependencies diff --git a/.github/workflows/ruff.yaml b/.github/workflows/ruff.yaml index ff87d99..f8a277e 100644 --- a/.github/workflows/ruff.yaml +++ b/.github/workflows/ruff.yaml @@ -14,7 +14,7 @@ jobs: steps: - uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@v7 with: python-version: '3.x' - name: Install dependencies From fab877a90704a10b64328919b4fa6a6c29b4ce5e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 9 Aug 2026 21:04:28 +0000 Subject: [PATCH 2/6] [pip] (deps): Bump the dev-dependencies group across 1 directory with 8 updates Bumps the dev-dependencies group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [certifi](https://github.com/certifi/python-certifi) | `2026.6.17` | `2026.7.22` | | [coverage](https://github.com/coveragepy/coveragepy) | `7.15.1` | `7.15.4` | | [filelock](https://github.com/tox-dev/py-filelock) | `3.29.7` | `3.32.2` | | [packaging](https://github.com/pypa/packaging) | `26.2` | `26.3` | | [platformdirs](https://github.com/tox-dev/platformdirs) | `4.10.0` | `4.11.0` | | [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.0` | `4.6.1` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.21` | `0.16.1` | | [virtualenv](https://github.com/pypa/virtualenv) | `21.6.1` | `21.7.1` | Updates `certifi` from 2026.6.17 to 2026.7.22 - [Commits](https://github.com/certifi/python-certifi/compare/2026.06.17...2026.07.22) Updates `coverage` from 7.15.1 to 7.15.4 - [Release notes](https://github.com/coveragepy/coveragepy/releases) - [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst) - [Commits](https://github.com/coveragepy/coveragepy/compare/7.15.1...7.15.4) Updates `filelock` from 3.29.7 to 3.32.2 - [Release notes](https://github.com/tox-dev/py-filelock/releases) - [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst) - [Commits](https://github.com/tox-dev/py-filelock/compare/3.29.7...3.32.2) Updates `packaging` from 26.2 to 26.3 - [Release notes](https://github.com/pypa/packaging/releases) - [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pypa/packaging/compare/26.2...26.3) Updates `platformdirs` from 4.10.0 to 4.11.0 - [Release notes](https://github.com/tox-dev/platformdirs/releases) - [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst) - [Commits](https://github.com/tox-dev/platformdirs/compare/4.10.0...4.11.0) Updates `pre-commit` from 4.6.0 to 4.6.1 - [Release notes](https://github.com/pre-commit/pre-commit/releases) - [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md) - [Commits](https://github.com/pre-commit/pre-commit/compare/v4.6.0...v4.6.1) Updates `ruff` from 0.15.21 to 0.16.1 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](https://github.com/astral-sh/ruff/compare/0.15.21...0.16.1) Updates `virtualenv` from 21.6.1 to 21.7.1 - [Release notes](https://github.com/pypa/virtualenv/releases) - [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst) - [Commits](https://github.com/pypa/virtualenv/compare/21.6.1...21.7.1) --- updated-dependencies: - dependency-name: certifi dependency-version: 2026.7.22 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: coverage dependency-version: 7.15.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: filelock dependency-version: 3.32.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: packaging dependency-version: '26.3' dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: platformdirs dependency-version: 4.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: pre-commit dependency-version: 4.6.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: ruff dependency-version: 0.16.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: virtualenv dependency-version: 21.7.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] --- requirements.txt | 2 +- requirements/requirements-dev.txt | 16 ++++++++-------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/requirements.txt b/requirements.txt index bec5f6b..94b4aea 100644 --- a/requirements.txt +++ b/requirements.txt @@ -7,7 +7,7 @@ # - requests # -certifi==2026.6.17 +certifi==2026.7.22 # via requests charset-normalizer==3.4.9 # via requests diff --git a/requirements/requirements-dev.txt b/requirements/requirements-dev.txt index 2d21e24..19245d9 100644 --- a/requirements/requirements-dev.txt +++ b/requirements/requirements-dev.txt @@ -19,19 +19,19 @@ # - requests # -certifi==2026.6.17 +certifi==2026.7.22 # via requests cfgv==3.5.0 # via pre-commit charset-normalizer==3.4.9 # via requests -coverage==7.15.1 +coverage==7.15.4 # via # hatch.envs.dev # pytest-cov distlib==0.4.3 # via virtualenv -filelock==3.29.7 +filelock==3.32.2 # via virtualenv freezegun==1.5.5 # via pytest-freezer @@ -47,15 +47,15 @@ nodeenv==1.10.0 # via # pre-commit # pyright -packaging==26.2 +packaging==26.3 # via pytest -platformdirs==4.10.0 +platformdirs==4.11.0 # via virtualenv pluggy==1.6.0 # via # pytest # pytest-cov -pre-commit==4.6.0 +pre-commit==4.6.1 # via hatch.envs.dev pychoir==0.0.30 # via hatch.envs.dev @@ -93,7 +93,7 @@ requests==2.34.2 # requests-mock requests-mock==1.12.1 # via hatch.envs.dev -ruff==0.15.21 +ruff==0.16.1 # via hatch.envs.dev six==1.17.0 # via python-dateutil @@ -103,5 +103,5 @@ typing-extensions==4.16.0 # pyright urllib3==2.7.0 # via requests -virtualenv==21.6.1 +virtualenv==21.7.1 # via pre-commit From d03217c70aebc0dce8d9098ec270e204816ba8ec Mon Sep 17 00:00:00 2001 From: Sophia Gavrila Date: Fri, 14 Aug 2026 13:05:21 -0400 Subject: [PATCH 3/6] chore: repair ruff 0.16 lint break ruff 0.16 stabilized CPY001 (missing-copyright-notice) and PLR0917 (too-many-positional-arguments) out of preview, pulling both into this repo's "ALL" selector. Added them to lint.ignore: the project does not use per-file copyright headers, and the public AnnotatedLogger constructor keeps its positional signature for backwards compatibility. ruff 0.16 also began formatting Python code blocks embedded in Markdown. README.md's ```python blocks deliberately show sample JSON log output beneath the source, which the formatter rewrites into multi-line dict literals and destroys. Markdown is excluded from the formatter instead. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 88ca26ce-88a6-4da4-a026-1e55f37076bc --- pyproject.toml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/pyproject.toml b/pyproject.toml index 8c37081..da8d525 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -101,8 +101,21 @@ lint.ignore = [ "W191", "E111", "E114", "E117", "D206", "D300", "Q000", "Q001", "Q002", "Q003", "COM812", "COM819", "ISC001", "ISC002", # Conflicts with other rule, choosing one "D203", "D213", + # Stabilised out of preview in ruff 0.16 and pulled in by "ALL". + # This project does not use per-file copyright headers, and the public + # AnnotatedLogger constructor keeps its positional signature for + # backwards compatibility. + "CPY001", "PLR0917", ] +[tool.ruff.format] +# ruff 0.16 began formatting Python code blocks embedded in Markdown. The +# README's ```python blocks deliberately show sample JSON log output beneath +# the source; the formatter parses those lines as Python and rewrites them +# into multi-line dict literals, destroying the documentation. Keep Markdown +# out of the formatter. +exclude = ["*.md"] + [tool.ruff.lint.per-file-ignores] "test/*" = ["E501", "D10", "ANN", "S101", "PLR2004"] From 91eac8cd5c8472b24659582099478755e0ee8b7e Mon Sep 17 00:00:00 2001 From: Sophia Gavrila Date: Fri, 14 Aug 2026 13:52:51 -0400 Subject: [PATCH 4/6] ci: bind pytest matrix to setup-python version The pytest job declares a 3.10-3.14 matrix, but the setup step pinned python-version to '3.x', so all 15 matrix jobs installed the same interpreter while their names implied version-specific coverage. Bind the input to matrix.python-version so the stated compatibility gate is real. Verified locally: the suite passes at 100% coverage on both ends of the matrix (3.10 and 3.14). Raised by Copilot review on #155. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 88ca26ce-88a6-4da4-a026-1e55f37076bc --- .github/workflows/pytest.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pytest.yaml b/.github/workflows/pytest.yaml index 54c3d7a..017beb4 100644 --- a/.github/workflows/pytest.yaml +++ b/.github/workflows/pytest.yaml @@ -22,7 +22,7 @@ jobs: - name: Set up Python uses: actions/setup-python@v7 with: - python-version: '3.x' + python-version: ${{ matrix.python-version }} - name: Install dependencies run: | python -m pip install hatch From 8818bb0b7f07585aa322ee5f25bcbeba4b6a6ad7 Mon Sep 17 00:00:00 2001 From: Sophia Gavrila Date: Fri, 14 Aug 2026 13:59:40 -0400 Subject: [PATCH 5/6] Revert pytest matrix binding, track separately 91eac8c bound setup-python to matrix.python-version so the declared 3.10-3.14 matrix would stop running a single interpreter. The binding is correct, but it exposes a pre-existing environment defect unrelated to this dependency PR: on macos-latest with Python 3.11, `hatch env create dev` fails with "Environment `dev` has unknown type: pip-compile", reproducibly across two runner allocations, while the same command and the full suite succeed locally on macOS arm64 / CPython 3.11.14 (76 passed, 100% coverage). Because the matrix has no fail-fast: false, that single job cancels the other 14 and turns the PR red. Restoring '3.x' keeps this PR scoped to dependency patching; the matrix fix and the underlying hatch plugin resolution failure are tracked in a follow-up issue. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 88ca26ce-88a6-4da4-a026-1e55f37076bc --- .github/workflows/pytest.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pytest.yaml b/.github/workflows/pytest.yaml index 017beb4..54c3d7a 100644 --- a/.github/workflows/pytest.yaml +++ b/.github/workflows/pytest.yaml @@ -22,7 +22,7 @@ jobs: - name: Set up Python uses: actions/setup-python@v7 with: - python-version: ${{ matrix.python-version }} + python-version: '3.x' - name: Install dependencies run: | python -m pip install hatch From 6324a9ac7f2938dc1ea2290b6613d4760af90571 Mon Sep 17 00:00:00 2001 From: Sophia Gavrila Date: Fri, 14 Aug 2026 14:35:52 -0400 Subject: [PATCH 6/6] ci: skip already-published files on TestPyPI upload publish-to-testpypi has no tag guard and the workflow triggers on push, so it runs on every branch push and PR. The project version only changes at release time, so almost every run rebuilds the current version and re-uploads a file TestPyPI already has: Uploading annotated_logger-1.3.4-py3-none-any.whl 400 File already exists ('annotated_logger-1.3.4-py3-none-any.whl', ...) ERROR HTTPError: 400 Bad Request from https://test.pypi.org/legacy/ That has made this job a permanent red check on every PR, including on main, which trains reviewers to ignore a failing publish job. Set skip-existing: true so already-present files are skipped rather than failing the upload. This is the canonical input on pypa/gh-action-pypi-publish at the pinned SHA dc37677 (skip_existing is the deprecated alias). Deliberately NOT set on the publish-to-pypi job: a duplicate upload to the real index means someone re-released an existing version, and that should keep failing loudly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 88ca26ce-88a6-4da4-a026-1e55f37076bc --- .github/workflows/publish-to-pypi.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/publish-to-pypi.yaml b/.github/workflows/publish-to-pypi.yaml index ae16ea3..085248f 100644 --- a/.github/workflows/publish-to-pypi.yaml +++ b/.github/workflows/publish-to-pypi.yaml @@ -118,3 +118,9 @@ jobs: uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 with: repository-url: https://test.pypi.org/legacy/ + # This job runs on every push, but the project version only changes at + # release time, so most runs re-upload an already-published file and + # TestPyPI rejects it with "400 File already exists". Skip files that + # are already there instead of failing the build. Deliberately not set + # on the real PyPI job, where a duplicate upload should fail loudly. + skip-existing: true