Repository navigation
Update dependencies and resolve open Dependabot advisories - #445
Merged
Merged
Conversation
- Raise minimum certifi, idna and soupsieve versions to resolve open Dependabot advisories (including the critical certifi emSign CA advisory); the refreshed lock also clears the anyio and pymdown-extensions advisories for development and CI. - Widen icalendar, chardet, timezonefinder, python-dateutil and pandas ranges to allow their latest majors while keeping existing floors. - Refresh development and documentation dependencies (ruff 0.17, griffe 1.15, invoke 3, towncrier 26, pytest, pylint, mkdocs plugins). - Apply ruff 0.17 Markdown code-block formatting and split the README example output into its own json block so it is not reformatted as Python.
jvanderaa
requested review from
glennmatthews,
pke11y and
scetron
as code owners
October 26, 2026 14:18
The library imports pytz in utils.py and parsers/cogent.py but only received it transitively through icalendar 5. icalendar 6 and later no longer depend on pytz, so widening the icalendar range left pytz uninstalled in a clean environment.
glennmatthews
previously approved these changes
Oct 27, 2026
Comment on lines
+45
to
+47
| certifi = ">=2026.10.19" | ||
| idna = ">=3.15,<4" | ||
| soupsieve = ">=2.9.0,<4" |
Contributor
There was a problem hiding this comment.
Generally for other packages with indirect dependencies that have security fixes, our pattern has been to just refresh the lockfile and note in the release-note that local installs should upgrade explicitly, rather than adding more explicit/direct dependencies for packages that we don't actually use directly. I'm not necessarily opposed to the approach you've taken here but it does increase the maintenance burden of this package, even if slightly.
Contributor
Author
There was a problem hiding this comment.
I've gotten confused from refreshing lock files and them not able to actually do anything to solve the dependabot recommendations to this. I will take this and remove them.
certifi, idna and soupsieve are never imported by the library and are only reached transitively, so declaring them added unused runtime constraints and ceilings that could block versions the parent packages support. The refreshed lock already pins patched versions, which is what resolves the Dependabot advisories, so the changelog entry moves from security to housekeeping.
glennmatthews
approved these changes
Oct 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves all open Dependabot advisories and supersedes the stale Renovate PRs #442, #430, #426, #421, #420, #408 and #365.
Security advisories
certifi,idna,soupsieve,anyio,pymdown-extensions). These packages are only reached transitively, andcertifi/idnaonly viarequests, which the library does not import, so no runtime constraints were added for them.Dependencies
pytzas a direct dependency; the library imports it but previously only received it throughicalendar5.icalendar(<8),chardet(<8),timezonefinder(<10),python-dateutil(<4) andpandas(<4) to allow their latest majors. Minimums are unchanged so downstream users are not forced to upgrade.mkdocs-material9.8 is held back because it requires Python 3.11+. The mkdocstrings 1.0 / griffe 2 upgrade is left for Replace the bespoke code-reference generation script with a maintained plugin #438.Formatting
ruff 0.17 formats Python code blocks in Markdown. The README example's printed JSON output now sits in its own
jsonblock so it is not reformatted as Python.