Skip to content

deps(pip-ci)(deps): bump splunk-appinspect from 4.2.0 to 4.2.1 in /requirements#16

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/requirements/splunk-appinspect-4.2.1
Closed

deps(pip-ci)(deps): bump splunk-appinspect from 4.2.0 to 4.2.1 in /requirements#16
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/requirements/splunk-appinspect-4.2.1

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github May 22, 2026

Bumps splunk-appinspect from 4.2.0 to 4.2.1.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [splunk-appinspect](https://splunk.com) from 4.2.0 to 4.2.1.

---
updated-dependencies:
- dependency-name: splunk-appinspect
  dependency-version: 4.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github May 22, 2026

Labels

The following labels could not be found: ci, dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

RelativisticJet added a commit that referenced this pull request May 23, 2026
The "Run module-level tests" step in ci.yml referenced
tests/test_wl_hmac_key.py — a file that never existed. The result
was every Unit Tests run on main red since the workflow landed
(verified via gh run list --workflow=ci.yml -- 5+ consecutive
failures on commits a48f6c2 / 4330149 / ab53066 / 91d9d22 /
b14b3c9 all citing "ERROR: file or directory not found:
tests/test_wl_hmac_key.py", exit code 4).

HMAC coverage is already provided by tests/unit/test_hmac_key.py
+ tests/unit/test_hmac_sig_fuzz.py, both of which run via the
prior `pytest tests/unit/` step. So removing the broken line
loses zero coverage — it just unblocks the workflow.

Same shape of fix as the round-7-B4 cleanup that removed a
stale tests/test_wl_filelock.py reference. Updated the
preamble comment to document BOTH missing-file gotchas so
they don't get re-added by a future contributor reading the
old comment as a TODO.

Side benefit: this also unblocks the Unit Tests check on every
open Dependabot PR (#7-#16), which were all red on the same
missing-file error.
@RelativisticJet
Copy link
Copy Markdown
Owner

Closing per locked decision in docs/DECISION_LOG.md (2026-05-22 row, GHSA-vfmq-68hx-4jfw) — same rationale as PR #9 (which was the duplicate for the root requirements-dev.txt scope).

The hosted Splunk AppInspect API is still on 4.2.0 (verified 2026-05-22). Per docs/RUNBOOKS.md §"AppInspect API — Credential Setup", local pin MUST match hosted version. 4.2.1 also still pins lxml<6.0.0,>=5.3.0 so this bump does nothing for the lxml CVE either (handled via pip-audit carve-out in commit b14b3c9).

Re-evaluation trigger: when the hosted API reports ≥4.2.1.

@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github May 23, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant