From 17c0a30bd980ecad2ed42b2e8c8c1227af0cd381 Mon Sep 17 00:00:00 2001 From: kingchenc Date: Sun, 26 Jul 2026 21:20:41 +0200 Subject: [PATCH] ci(dependabot): freeze hypothesis to keep the Python 3.9 dev lockfile installable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit hypothesis >=6.142 requires Python >=3.10, but .github/requirements/ci-dev-py39.txt targets the 3.9 matrix rows. A ci-pip group bump to hypothesis 6.157.0 made pip reject it on every 3.9 job ("Ignored the following versions that require a different python version"). Ignore hypothesis minor/major bumps in the CI requirements ecosystem, mirroring the existing numpy pin — the dev tooling only needs a working hypothesis, not the newest. --- .github/dependabot.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d25fd4dd..189cec1d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -87,6 +87,12 @@ updates: # CI tooling only needs a working numpy, not the newest. - dependency-name: "numpy" update-types: ["version-update:semver-minor", "version-update:semver-major"] + # hypothesis >=6.142 requires Python >=3.10, but ci-dev-py39.txt targets + # 3.9. A bump to 6.157 broke every 3.9 matrix row (pip "Ignored the + # following versions that require a different python version"). Freeze + # hypothesis so the 3.9 dev-tooling lockfile stays installable. + - dependency-name: "hypothesis" + update-types: ["version-update:semver-minor", "version-update:semver-major"] # GitHub Actions — keeps the SHA-pinned actions current (Dependabot reads # the version comment after each pinned SHA and bumps both together).