chore(deps-dev): bump configobj from 5.0.8 to 5.0.9 - #15084
chore(deps-dev): bump configobj from 5.0.8 to 5.0.9#15084dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [configobj](https://github.com/DiffSK/configobj) from 5.0.8 to 5.0.9. - [Release notes](https://github.com/DiffSK/configobj/releases) - [Changelog](https://github.com/DiffSK/configobj/blob/release/CHANGES.rst) - [Commits](DiffSK/configobj@v5.0.8...v5.0.9) --- updated-dependencies: - dependency-name: configobj dependency-version: 5.0.9 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
🔵 Review postedLast updated: 2026-07-24 16:51 UTC |
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #15084 bumps configobj 5.0.8 → 5.0.9.
- Semver: patch version number, but effectively breaking — 5.0.9 raises its own
requires-pythonto>=3.7, dropping Python 2 / <3.7 support (PR #246). - Dependency type: production. Declared in the
baseruntime group (pyproject.toml:75) and bundled into the WHL, despite thedeps-devPR title (that label comes from Dependabot config, not the actual group). - Security fix: 5.0.9 fixes CVE-2023-26112 (ReDoS) — worth revisiting once the 3.6 question is settled.
- API compatibility: the
ConfigObj/flatten_errors/get_extra_valuessurface Kolibri uses (kolibri/utils/options.py) is unchanged. Source-compatible on Python ≥3.7; the only breaking element is the Python floor. - Peer deps: none.
- CI: failing — Build WHL, WHL smoke tests, and Morango 3.6 all fail at dependency resolution because Kolibri still declares
requires-python = ">=3.6, <3.15"(pyproject.toml:14) and exercises Python 3.6, whichconfigobj==5.0.9(>=3.7) cannot satisfy.
Blocker: the Python 3.6 conflict is a hard, CI-confirmed failure. This cannot merge as-is. Resolution is a maintainer support-matrix decision, not something to fold silently into a Dependabot PR:
- If Python 3.6 must stay supported: this bump can't be taken — close the PR (or pin below 5.0.9), and track CVE-2023-26112 separately.
- If Python 3.6 is being dropped: raise
requires-pythonto>=3.7and remove the 3.6 CI legs first, then land this on top.
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #15084 — configobj 5.0.8 → 5.0.9 in the base (production runtime) group. Minor bump, but a blocking incompatibility persists on the same HEAD 3fcdb401 (no new commits since my prior CHANGES_REQUESTED).
1 of 1 prior finding still open.
Blocking — configobj 5.0.9 drops Python 3.6. The release raised its floor to Python>=3.7, but Kolibri still targets 3.6 (pyproject.toml:14 requires-python = ">=3.6, <3.15"; the Build WHL step resolves kolibri/dist with --python-version 3.6). CI is red on exactly this:
× No solution found when resolving dependencies:
╰─▶ Because the requested Python version (>=3.6) does not satisfy Python>=3.7
and configobj==5.0.9 depends on Python>=3.7, we can conclude that
configobj==5.0.9 cannot be used.
make: *** [Makefile:174: staticdeps] Error 1
This cascades to Build WHL, WHL smoke tests, and the Morango Integration Tests (3.6/3.7 without-uv legs). Despite the chore(deps-dev) title, configobj is a bundled production dependency, so this affects shipped installs.
The bump is desirable (5.0.9 addresses CVE-2023-26112, a ReDoS), but it cannot land as-is. Dependabot cannot make the required change — this is blocked on a human decision:
- Drop Python 3.6 support first (raise
requires-pythonand the dist--python-versionto 3.7), then take this bump; or - Hold until 3.6 is dropped on
develop; or - Keep 3.6 and pin configobj via an environment marker (
>=5.0.8,<5.0.9for 3.6,5.0.9for>=3.7) — more complexity than this bump warrants.
CI: failing.
Prior-finding status
UNADDRESSED — pyproject.toml:75 — configobj 5.0.9 requires Python >=3.7, incompatible with Kolibri's 3.6 support (same SHA, CI still red)
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
1 participant
Bumps configobj from 5.0.8 to 5.0.9.
Release notes
Sourced from configobj's releases.
Changelog
Sourced from configobj's changelog.
Commits
242dfd0release 5.0.98857b08Merge pull request #246 from DiffSK/python-versiond6f7597Update minimum python to 3.7 everywhere, and add 3.128ffcf0cMerge pull request #241 from yegorich/license5e2f143Merge pull request #245 from jelmer/extra-2014fdf3634Drop extra '2014' in LICENSE file. Fixes #2333480a6eMerge pull request #237 from jelmer/drop-python2008165cDrop python 3.5 from GitHub action, since it now fails to download861383cDrop support for Python < 3.57c618b0Merge pull request #236 from cdcadman/cve_2023_26112Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.