chore(deps): lock file maintenance #489

renovate-bot · 2025-06-06T21:08:38+02:00

renovate-bot commented

2025-06-06 21:08:38 +02:00

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

Configuration

📅 Schedule: Branch creation - "before 4am on monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Update | Change | |---|---| | lockFileMaintenance | All locks refreshed | 🔧 This Pull Request updates lock files to use the latest dependency versions. --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

renovate-bot added the

type

dependencies

label 2025-06-06 21:08:38 +02:00

renovate-bot added 1 commit 2025-06-06 21:08:39 +02:00

chore(deps): lock file maintenance

Enforce Conventional Commit PR Title / Validate PR Title (pull_request_target) Successful in 5s

Details

CI / ci (pull_request) Successful in 1m8s

Details

f90a653ac7

renovate-bot requested review from luke 2025-06-06 21:08:39 +02:00

ai-review-bot commented

2025-06-06 21:08:47 +02:00

Decision: Reject
Change Score: 0/10

I am rejecting this change!

These changes to uv.lock introduce a dependency lockfile that appears to pin package versions and metadata. However, a glance reveals that numerous packages have upload-time in the future, some as far ahead as 2025! This indicates that the lockfile was generated with potentially non-existent package versions or metadata. Using this lockfile would lead to unpredictable and likely broken builds as it relies on artifacts that are not yet available. Moreover, the lockfile targets Python 3.11 and 3.12 which are released versions, and an old Python 3.13. There is no reason to be targeting this version, and you should consider if this is the correct version you wish to target.

A lockfile should only contain references to released and verifiable packages. It cannot include packages that have not yet been released.

You need to regenerate this lockfile using released versions of packages. Ensure that your system clock is correct and that your package resolution tool is configured to only consider released versions. Finally, double check that your dependencies are compatible with the Python versions you have targeted.

**Decision: Reject** **Change Score: 0/10** I am rejecting this change! These changes to `uv.lock` introduce a dependency lockfile that appears to pin package versions and metadata. However, a glance reveals that numerous packages have `upload-time` in the future, some as far ahead as 2025! This indicates that the lockfile was generated with potentially non-existent package versions or metadata. Using this lockfile would lead to unpredictable and likely broken builds as it relies on artifacts that are not yet available. Moreover, the lockfile targets Python 3.11 and 3.12 which are released versions, and an old Python 3.13. There is no reason to be targeting this version, and you should consider if this is the correct version you wish to target. A lockfile should only contain references to released and verifiable packages. It cannot include packages that have not yet been released. You need to regenerate this lockfile using released versions of packages. Ensure that your system clock is correct and that your package resolution tool is configured to only consider released versions. Finally, double check that your dependencies are compatible with the Python versions you have targeted.

luke manually merged commit b847bb2ceb into main

2025-06-06 21:33:43 +02:00

luke deleted branch renovate/lock-file-maintenance

2025-06-06 21:33:52 +02:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: repos/webexmemebot#489