fix(deps): bump pygments from 2.20.0 to 2.21.0 - #298
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [pygments](https://github.com/pygments/pygments) from 2.20.0 to 2.21.0. - [Release notes](https://github.com/pygments/pygments/releases) - [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES) - [Commits](pygments/pygments@2.20.0...2.21.0) --- updated-dependencies: - dependency-name: pygments dependency-version: 2.21.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
dependencies
dependabot
Bot
added
the
dependencies
|
Superseded by #344, which is green and carries this bump in |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
The `/` pip entry is documented as covering the runtime dependencies that ship inside the installed package — PyYAML and raes — but it reaches requirements/runtime.txt as well as pyproject.toml, and without an `allow` filter it raises a separate ungrouped PR for every transitive line in that lock. #298 (pygments), #299 (idna) and #300 (python-dotenv) were all opened that way and all three were closed unmerged. A single-lock PR like that cannot land. runtime.txt and pip-audit.txt are installed into one environment by ci.yml:audit, and runtime.txt and sbom.txt by release-please.yml:publish, so moving a shared package in one of them alone fails test_co_installed_locks_agree_on_shared_packages. Moving it in all of them duplicates half the /requirements batch and forces that PR to rebase. Splitting the transitive closure is exactly what the group above this entry exists to prevent; the `/` entry was quietly undoing it. `allow: dependency-type: direct` limits this entry to what pyproject declares, which is what its own comment already says it is for. The transitive closure stays the /requirements group's job. The z3-solver and pydantic-core ignores stay: the pip updater reads a locked line as a requested pin, so they are cheap insurance rather than redundancy.
1 participant
Bumps pygments from 2.20.0 to 2.21.0.
Release notes
Sourced from pygments's releases.
... (truncated)
Changelog
Sourced from pygments's changelog.
... (truncated)
Commits
a43b45dGet ready for the 2.21.0 release.d8f14cbFix version_added for Purescript.19c5817Remove superfluous parentheses from PostgresExplainLexer (#3232)9992e09Merge pull request #3191 from jvoisin/dupesbd22577Fix regexlint warnings after latest update.6a62df1Release preparation: Update the changelog.aabba32Merge pull request #3221 from jvoisin/alterd3441d0Merge pull request #3225 from jvoisin/caddyc593f3fAdd a lexer for Caddy0644b53Simplify single-character regex alternations to character classesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)