Skip to content

Ci: combine dependabot dependency updates#1509

Open
DawidWesierski4 wants to merge 11 commits intomainfrom
combined/dependabot-updates
Open

Ci: combine dependabot dependency updates#1509
DawidWesierski4 wants to merge 11 commits intomainfrom
combined/dependabot-updates

Conversation

@DawidWesierski4
Copy link
Copy Markdown
Collaborator

@DawidWesierski4 DawidWesierski4 commented Apr 13, 2026

Combined dependabot dependency updates:

Skipped due to conflicts:

@DawidWesierski4 DawidWesierski4 changed the title Build: combine dependabot dependency updates Ci: combine dependabot dependency updates Apr 13, 2026
@DawidWesierski4 DawidWesierski4 added the TO_SQUASH Please don't rebase this PR, use the squash option during merging process label Apr 13, 2026
@DawidWesierski4 DawidWesierski4 enabled auto-merge (squash) April 13, 2026 09:17
Sakoram
Sakoram reviewed Apr 13, 2026
View reviewed changes
Comment thread manager/Dockerfile

# Build stage, ubuntu 22.04
FROM ubuntu@sha256:149d67e29f765f4db62aa52161009e99e389544e25a8f43c8c89d4a445a7ca37 AS builder
FROM ubuntu@sha256:84e77dee7d1bc93fb029a45e3c6cb9d8aa4831ccfcc7103d36e876938d28895b AS builder
Copy link
Copy Markdown
Collaborator

@Sakoram Sakoram Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this does not look like ubuntu 22.04. Why we update this?
the hash looks just like ubuntu latest: https://hub.docker.com/layers/library/ubuntu/latest/images/sha256-7409efd2c351d36aaca162069e56a19fa2633944215cc478832a72d7eadfaf10?context=explore

Copy link
Copy Markdown
Collaborator Author

@DawidWesierski4 DawidWesierski4 Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good question,
I think dependabot updates to "latest" but hash so it is validated automatically on newest shiniest

kinda valid i guess

do we an't to do it is another question

dependabot bot added 11 commits April 16, 2026 13:07
@dependabot @awilczyns
Ci: Update sdl2 requirement from 0.36.0 to 0.38.0 in /rust
efd7b2a 
Updates the requirements on [sdl2](https://github.com/Rust-SDL2/rust-sdl2) to permit the latest version.
- [Changelog](https://github.com/Rust-SDL2/rust-sdl2/blob/master/changelog.md)
- [Commits](https://github.com/Rust-SDL2/rust-sdl2/commits/0.38.0)

---
updated-dependencies:
- dependency-name: sdl2
  dependency-version: 0.38.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @awilczyns
Ci: Bump ubuntu from 149d67e to 84e77de in /manager
f80b62f 
Bumps ubuntu from `149d67e` to `84e77de`.

---
updated-dependencies:
- dependency-name: ubuntu
  dependency-version: 84e77dee7d1bc93fb029a45e3c6cb9d8aa4831ccfcc7103d36e876938d28895b
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @awilczyns
Ci: Bump paramiko from 3.4.0 to 4.0.0 in /tests
507113e 
Bumps [paramiko](https://github.com/paramiko/paramiko) from 3.4.0 to 4.0.0.
- [Commits](paramiko/paramiko@3.4.0...4.0.0)

---
updated-dependencies:
- dependency-name: paramiko
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @awilczyns
Ci: Bump click from 8.3.1 to 8.3.2 in /tests
8d27763 
Bumps [click](https://github.com/pallets/click) from 8.3.1 to 8.3.2.
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.rst)
- [Commits](pallets/click@8.3.1...8.3.2)

---
updated-dependencies:
- dependency-name: click
  dependency-version: 8.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @awilczyns
Ci: Bump idna from 3.10 to 3.11 in /tests
059739a 
Bumps [idna](https://github.com/kjd/idna) from 3.10 to 3.11.
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.rst)
- [Commits](kjd/idna@v3.10...v3.11)

---
updated-dependencies:
- dependency-name: idna
  dependency-version: '3.11'
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @awilczyns
Ci: Bump plumbum from 1.9.0 to 1.10.0 in /tests
c5f561e 
Bumps [plumbum](https://github.com/tomerfiliba/plumbum) from 1.9.0 to 1.10.0.
- [Release notes](https://github.com/tomerfiliba/plumbum/releases)
- [Changelog](https://github.com/tomerfiliba/plumbum/blob/master/CHANGELOG.rst)
- [Commits](tomerfiliba/plumbum@v1.9.0...v1.10.0)

---
updated-dependencies:
- dependency-name: plumbum
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @awilczyns
Ci: Bump ossf/scorecard-action from 2.4.2 to 2.4.3
9219975 
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.2 to 2.4.3.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@05b42c6...4eaacf0)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @awilczyns
Ci: Bump docker/login-action from 3.5.0 to 4.1.0
ed15d50 
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 4.1.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...4907a6d)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @awilczyns
Ci: Bump actions/upload-artifact from 4 to 7
a6d2d17 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @awilczyns
Ci: Bump actions/dependency-review-action from 4.7.3 to 4.9.0
857edd2 
Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 4.7.3 to 4.9.0.
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@595b5ae...2031cfc)

---
updated-dependencies:
- dependency-name: actions/dependency-review-action
  dependency-version: 4.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @awilczyns
Ci: Bump actions/checkout from 4 to 6
cb90f00 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v4...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@awilczyns awilczyns force-pushed the combined/dependabot-updates branch from c53f030 to cb90f00 Compare April 16, 2026 11:07
awilczyns added a commit to awilczyns/Media-Transport-Library that referenced this pull request Apr 17, 2026
@awilczyns
Ci: combine dependabot dependency updates v2
cdaec40 
Combined dependabot dependency updates into a single PR.

GitHub Actions updates (17 workflow files):
- step-security/harden-runner v2.13.0 -> v2.18.0 (OpenVisualCloud#1520)
- dorny/paths-filter v3.0.2 -> v4.0.1 (OpenVisualCloud#1519)
- docker/build-push-action v7.0.0 -> v7.1.0 (OpenVisualCloud#1522)
- actions/cache v4.2.3 -> v5.0.5 (OpenVisualCloud#1521)
- actions/checkout v4.2.2 -> v6.0.2 (from OpenVisualCloud#1509)
- actions/upload-artifact v4 -> v7 (from OpenVisualCloud#1509)
- docker/login-action v3.5.0 -> v4.1.0 (from OpenVisualCloud#1509)
- actions/dependency-review-action v4.7.3 -> v4.9.0 (from OpenVisualCloud#1509)
- actions/github-script v7 -> v9 (OpenVisualCloud#1518)
- ossf/scorecard-action v2.4.2 -> v2.4.3 (from OpenVisualCloud#1509)

Python requirements updates:
- click 8.3.1 -> 8.3.2 (from OpenVisualCloud#1509)
- idna 3.10 -> 3.11 (from OpenVisualCloud#1509)
- iniconfig 2.1.0 -> 2.3.0 (OpenVisualCloud#1525)
- plumbum 1.9.0 -> 1.10.0 (from OpenVisualCloud#1509)
- pysnmp 7.1.21 -> 7.1.23 (OpenVisualCloud#1526)

Other updates:
- Ubuntu digest in manager/Dockerfile (OpenVisualCloud#1523)
- sdl2 0.36.0 -> 0.38.0 in rust/Cargo.toml (from OpenVisualCloud#1509)

Skipped due to dependency conflicts with mfd-connect/pytest-mfd-config:
- paramiko 3.4.0 -> 4.0.0 (OpenVisualCloud#1527 - mfd-connect requires ==3.4.0)
- pexpect 4.8.0 -> 4.9.0 (OpenVisualCloud#1499 - mfd-connect requires ~=4.8.0)
- funcy 1.18 -> 2.0 (OpenVisualCloud#1524 - mfd-connect requires ~=1.14)
- scp 0.13.6 -> 0.15.0 (OpenVisualCloud#1527 - mfd-connect requires ~=0.13.4)
- pytest 8.4.1 -> 9.0.3 (OpenVisualCloud#1512 - pytest-mfd-config requires <9)

Supersedes OpenVisualCloud#1509.
Build tested: ./build.sh passed (24/24 steps).
Requirements tested: pip install passed in clean venv.
This was referenced Apr 17, 2026
Closed
Merged
awilczyns added a commit that referenced this pull request Apr 17, 2026
@awilczyns
Ci: combine dependabot dependency updates v2
c14d459 
Combined dependabot dependency updates into a single PR.

GitHub Actions updates (17 workflow files):
- step-security/harden-runner v2.13.0 -> v2.18.0 (#1520)
- dorny/paths-filter v3.0.2 -> v4.0.1 (#1519)
- docker/build-push-action v7.0.0 -> v7.1.0 (#1522)
- actions/cache v4.2.3 -> v5.0.5 (#1521)
- actions/checkout v4.2.2 -> v6.0.2 (from #1509)
- actions/upload-artifact v4 -> v7 (from #1509)
- docker/login-action v3.5.0 -> v4.1.0 (from #1509)
- actions/dependency-review-action v4.7.3 -> v4.9.0 (from #1509)
- actions/github-script v7 -> v9 (#1518)
- ossf/scorecard-action v2.4.2 -> v2.4.3 (from #1509)

Python requirements updates:
- click 8.3.1 -> 8.3.2 (from #1509)
- idna 3.10 -> 3.11 (from #1509)
- iniconfig 2.1.0 -> 2.3.0 (#1525)
- plumbum 1.9.0 -> 1.10.0 (from #1509)
- pysnmp 7.1.21 -> 7.1.23 (#1526)

Other updates:
- Ubuntu digest in manager/Dockerfile (#1523)
- sdl2 0.36.0 -> 0.38.0 in rust/Cargo.toml (from #1509)

Skipped due to dependency conflicts with mfd-connect/pytest-mfd-config:
- paramiko 3.4.0 -> 4.0.0 (#1527 - mfd-connect requires ==3.4.0)
- pexpect 4.8.0 -> 4.9.0 (#1499 - mfd-connect requires ~=4.8.0)
- funcy 1.18 -> 2.0 (#1524 - mfd-connect requires ~=1.14)
- scp 0.13.6 -> 0.15.0 (#1527 - mfd-connect requires ~=0.13.4)
- pytest 8.4.1 -> 9.0.3 (#1512 - pytest-mfd-config requires <9)

Supersedes #1509.
Build tested: ./build.sh passed (24/24 steps).
Requirements tested: pip install passed in clean venv.
awilczyns added a commit that referenced this pull request Apr 17, 2026
@awilczyns
Ci: combine dependabot dependency updates v2 (#1529)
8470b3a 
## Combined Dependabot Dependency Updates v2

This PR combines all open Dependabot PRs into a single update.
Supersedes #1509.

### GitHub Actions updates (17 workflow files)
| Dependency | Old | New | PR |
|---|---|---|---|
| step-security/harden-runner | v2.13.0 | v2.18.0 | #1520 |
| dorny/paths-filter | v3.0.2 | v4.0.1 | #1519 |
| docker/build-push-action | v7.0.0 | v7.1.0 | #1522 |
| actions/cache | v4.2.3 | v5.0.5 | #1521 |
| actions/checkout | v4.2.2 | v6.0.2 | #1509 |
| actions/upload-artifact | v4 | v7 | #1509 |
| docker/login-action | v3.5.0 | v4.1.0 | #1509 |
| actions/dependency-review-action | v4.7.3 | v4.9.0 | #1509 |
| actions/github-script | v7 | v9 | #1518 |
| ossf/scorecard-action | v2.4.2 | v2.4.3 | #1509 |

### Python requirements updates
| Package | Old | New | PR |
|---|---|---|---|
| click | 8.3.1 | 8.3.2 | #1509 |
| idna | 3.10 | 3.11 | #1509 |
| iniconfig | 2.1.0 | 2.3.0 | #1525 |
| plumbum | 1.9.0 | 1.10.0 | #1509 |
| pysnmp | 7.1.21 | 7.1.23 | #1526 |

### Other updates
| File | Change | PR |
|---|---|---|
| manager/Dockerfile | Ubuntu digest update | #1523 |
| rust/Cargo.toml | sdl2 0.36.0 → 0.38.0 | #1509 |

### Skipped (dependency conflicts)
These packages could not be updated due to version pinning by
`mfd-connect 7.15.0` or `pytest-mfd-config 3.25.0`:

| Package | Wanted | Blocker | PR |
|---|---|---|---|
| paramiko | 4.0.0 | mfd-connect requires ==3.4.0 | #1527 |
| scp | 0.15.0 | mfd-connect requires ~=0.13.4 | #1527 |
| pexpect | 4.9.0 | mfd-connect requires ~=4.8.0 | #1499 |
| funcy | 2.0 | mfd-connect requires ~=1.14 | #1524 |
| pytest | 9.0.3 | pytest-mfd-config requires &lt;9 | #1512 |

### Testing
- ✅ `./build.sh` passed (24/24 compilation steps)
- ✅ `pip install -r requirements.txt` passed in a clean venv

### PRs included
Covers: #1527, #1526, #1525, #1524, #1523, #1522, #1521, #1520, #1519,
#1518, #1512, #1509, #1499
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Sakoram Sakoram Sakoram left review comments

@staszczuk staszczuk Awaiting requested review from staszczuk staszczuk is a code owner

@awilczyns awilczyns Awaiting requested review from awilczyns awilczyns is a code owner

@moleksy moleksy Awaiting requested review from moleksy moleksy is a code owner

@soopel soopel Awaiting requested review from soopel soopel is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

TO_SQUASH Please don't rebase this PR, use the squash option during merging process

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@DawidWesierski4 @Sakoram