chore(deps): bump ast-serialize from 0.8.0 to 0.11.1

requirements-lint.txt

@@ -128,64 +128,64 @@ diff-cover==10.5.1 \
 #
 #     pip install --dry-run --report - --only-binary=:all: --python-version 3.14 \
 #         --platform manylinux2014_x86_64 --target /tmp/x -r requirements-lint.txt
-ast_serialize==0.8.0 \
-    --hash=sha256:0485a25ef519c62e749ee3c1ad8070e591b380d67226349eb5a70b228dc1ac4a \
-    --hash=sha256:057769b5921336eb2d9124f2a731b42ed05ffdac559b840dbdf6f3937cf153dc \
-    --hash=sha256:1f9caa63fad8241257ae401b5ff0a64026c6adb36b8e86cbe8782d9ea505daf6 \
-    --hash=sha256:252f883290d1cdb728eb7fe1d9a7221b88af5a329aae0bc91ddee4dafb820331 \
-    --hash=sha256:2880350b13d3eae69a0d70bc1fb6c9bfaca4dbd0e20ba8cd1aa483080b56ff06 \
-    --hash=sha256:293cc1c5bfa741f8e3fbe8175b9c07beee487c9a6fdbb25a5acad9f1df2d30a9 \
-    --hash=sha256:2d39a56282cfcc0d8eeea37267c754be59c98d48505c23b1dae5c6011f3813dd \
-    --hash=sha256:2efa40b068197d5efb62655b43baadb842ed71c4958cccd3e8b86a35726f0119 \
-    --hash=sha256:31883542dd6c94d178f5db3d32fbd69c5eb88b3a7c018e7ac8cc0c45195ddbed \
-    --hash=sha256:3926fa117b5e65019853a2969966d11c7175af377a3425991f3fe73784412405 \
-    --hash=sha256:39e92ff8e8cb45947fe9007174b2950e1fb098e6abd00266a13cd3bcf6675068 \
-    --hash=sha256:3a8660fe66667b76a6e9dccd1d33e66b229fde3b308db991c041609226c005b6 \
-    --hash=sha256:3ccebbed24f1281062d5852353c72c47502955926cfcb8345ffb3a44d87ff3d3 \
-    --hash=sha256:3d822605fa7bb326ef868d25fafced7fc660fa46d9b90c02ea86d5e2f5d325f7 \
-    --hash=sha256:40a57b73731be45da4fa41430c4d5dc94a24b3a4faba7b9e069978c0402064ea \
-    --hash=sha256:43dd6d596879bb1cb8a12cc9dae7bb10090a39a35883026c24f82488a195619a \
-    --hash=sha256:485f1113af805e9e170b95ef993ca3fbd4f89c04bab25c58b4fc632d854801ab \
-    --hash=sha256:4c38b915511e32bc718c49dbce98ff9af36bac0ad6a604f58000cd5e3aecdba7 \
-    --hash=sha256:4ca7e6fd1ad845d1cc649dc2ecd499db2f8f46af5bf8da7b70dd858774cc038b \
-    --hash=sha256:5075b9da3ef807eda752502446dfecea3b381c4900b7e27a5d5f4f899eb39951 \
-    --hash=sha256:54f95b486018d262bcb387a9afd96f0da74508b442762b80c769454a6fbb3ee3 \
-    --hash=sha256:6102f2f985c2e542be85cd857678ec9356fefa792b93cadfadd31139f5696f27 \
-    --hash=sha256:6479d9722a4cd21b578f5478074c41e6169f04811996ec881655560f703a5bba \
-    --hash=sha256:6c37c43e4004dfb42d321ddedc569dc17ff4259296f3af577c9ea46a809bc010 \
-    --hash=sha256:6f18048fe9f6dd266bd577cdec48bdcecb74faaa01fe941324435483b013ed2a \
-    --hash=sha256:77308ae6c5cf5264cc0f01a7c556ec77a9e68eb1f61b093534d698139fdc3b14 \
-    --hash=sha256:861794565b06337005c1447ef23103a3d5a627d08bdc827870d00d0b28ef5f51 \
-    --hash=sha256:86b8a1e6d90467345356098b040150e82fbc26d24a7a202224b13dc1f6264ca0 \
-    --hash=sha256:8c9d537f59e936392cfd3597789d1390304dd659efc3c486ce7f40fb6b8a9f53 \
-    --hash=sha256:8d53a23f27e1ed3a36b2d26fd2a1a6228c8e85a1ed62ff7cdb44bd610769f20a \
-    --hash=sha256:9118ad3e369727060b2696fc4078f250ecffca4248ba87f537f55cea9f9dce06 \
-    --hash=sha256:96abc072ad29db8d02194afd47d68987322622787daceae82398d7b69f3ba2e6 \
-    --hash=sha256:9830ff7e764f74d9eefb01170c61a9f0fd2c027dac5fcb72e064decd57d56371 \
-    --hash=sha256:9a2ef9cf12f2de4f1028c42c1dd7d775255e0fb3e5bb48896c97e35ef52366fe \
-    --hash=sha256:9d187197d234aa45d6cfa2b096be5f666e8cc2e7eb3722d0ab8926293cf5720c \
-    --hash=sha256:9da7330f3e235bf7da89b8d39205c6350fc0c08a85379743f2df9fff87d6d980 \
-    --hash=sha256:a02cbed7d8bfdcdee88edaac12bd50d53d9953aaa2e1852ef078625be5f1c0b5 \
-    --hash=sha256:a63bed264e818cd83eec11feed0f50aa162542b91132ef58afebc857182763a5 \
-    --hash=sha256:ab0f9a59f7d63d0d441b56b9a818b273705264352d5115cfee12e940e816d958 \
-    --hash=sha256:ac4f0a83c55a9b782f79ad55a5247b7db123c1db405959791c2ef886e9710c9f \
-    --hash=sha256:b2a5978662fd4db463dfb4b974d2b10ac6430b98f5333aabc7051909df3561d0 \
-    --hash=sha256:bd84d60bca7079e741be4ac5dbe237751a59d7f6f9f0126b11880d63822cbe16 \
-    --hash=sha256:c85d8d18db5b2dfcb3b7e38a4d600ca35504c0ed8a6f75cd1c811e4ffe248a15 \
-    --hash=sha256:d8b3c8eee4c1baef9d4e84d2a59a805501617127be42615cb48970b15b0892b6 \
-    --hash=sha256:db1b957291bca08c7e72f43a12357b2948e20775d970e3fc3dac0aa3160ab725 \
-    --hash=sha256:ddd3b61f45c132da66c5476b281891e08c1fd87fbdabe8a6973e1622efc85f06 \
-    --hash=sha256:e0910c3442a75216dde0f102d854ba2aaa71d2482e0ee213630b9bf29584fba3 \
-    --hash=sha256:e1bd223df0f6c96b396975fa604cb33bce53d9b4a0185490be4c4a289f7c9c87 \
-    --hash=sha256:e7266307e5fba39836edb79def8608887af48820508bff3c5f2941e1e04d1534 \
-    --hash=sha256:e94f9121d13fa36cbf21314783c77d05ae3a0868decd18cf5233fdcc6de49ac8 \
-    --hash=sha256:f0190a33d7f97c65e9069f7a7f40499eea6b5cbe260c558378109caf20ce934b \
-    --hash=sha256:f3186969ee66a9863b00acc6523ace44c56974eecb348a7ea4b228d9f0b80e19 \
-    --hash=sha256:f359df4bd921918af8bebd142a376c77511d7151cc8ba852760b587b5a4a54f3 \
-    --hash=sha256:f7cc5f10386994c0f4844f1e6d6a97127e9b478660eb6dec2b257644f0acab64 \
-    --hash=sha256:fa70ed4dea0bb18b30a1789c77baa701d0ef30c474f2ccabdea61e25623a8827 \
-    --hash=sha256:fdc0d5b18ff8fb364e87923e47c0a91d0d69dbcaeaa274591f7fd26892cc3a3a \
-    --hash=sha256:ffa5e7cb08f96fed9121f77b224151e41caf88feab9d652bb46c78202b6fbeda
+ast_serialize==0.11.1 \
+    --hash=sha256:00adb748034c7b1938ec56925f9f6230ffcd9c56d47355fe32485df29b90b977 \
+    --hash=sha256:021afb3482d27d1dace9c8999724a13083e96c7ece785e53e418bf5df3b50e0a \
+    --hash=sha256:0bc94b81878a3f999fe4cdb606bf00ef7dff6b4f66d0e089b2cf7bfc00d59beb \
+    --hash=sha256:110386eebccf200446d5f4dcc215f80866a5d3d3d054d3ced6ec1bf386cd3f02 \
+    --hash=sha256:13903a3f212ab9e5d05a6c3f2337288f4f8f4c18e6ab3817417ae7a3d46dee14 \
+    --hash=sha256:1e8d20700766171a8a17f89cf53d7bd9712c509460d28a51f7f98340577b78aa \
+    --hash=sha256:20b3371c0403099cd55d59f4bcedb6d3994d9db3fa41711c648760a89ef2a575 \
+    --hash=sha256:27eef0739e0110f5db1ff5dfa38b3dadfcb6f0c31975a2b412f9f2bd72139cea \
+    --hash=sha256:2db9df3bca1431da25946ee8f2c50df01212e34e6029532bc90b92d05fa8d7a0 \
+    --hash=sha256:2f8f33e416a4c7aad12ad757e895c676e953b4027b80b90718dccea83d45111a \
+    --hash=sha256:311333c5f58f55fc04121be2c5adffa42a19e1038a43a2cef862fdf58c45bf4f \
+    --hash=sha256:31df8649761d5cb6eb0de2209bd4a167c7477c0516147c70c0b2f5bddc7839bb \
+    --hash=sha256:341dfc9e6b4e47e5c37e1b7257a77d39f407cf49a371ee90225ab624c2fe8b36 \
+    --hash=sha256:38f7141881e783bccc362d201d7fd7437934216b669b9fef39febc2f63fd2d9b \
+    --hash=sha256:3eebd3dd25a81839ac7d25b5f3fb3527f6141b35eca29f63d2613fe6254307fd \
+    --hash=sha256:4ab6df9898600ff45149b86c12bb5aa3359cc71843ad99ad0c924d11392469ab \
+    --hash=sha256:4dd7218870c203eff4533cfc04a39f29077d6789b20f5b746e7648fe5762a548 \
+    --hash=sha256:57b7d52d1f5c92905cd648bda9efc83cac33097de1e5bb68de8feca9b5f7e87a \
+    --hash=sha256:5c2358b341aca08bd2e1005713bc480bc06eee9f345b67fcb826829aa7b8d0d3 \
+    --hash=sha256:651a7890558896c3e08089e51ab3b3a43710eab15b72ad861c400bc9a51923ba \
+    --hash=sha256:65c836d1ab7af65e64a1dd73de82572566e838dd27529b1124eac0ac86f35e76 \
+    --hash=sha256:68929da7fb1c7375f69641baac9519d5c41ee441cd09a591ea5dfc83107ffe6f \
+    --hash=sha256:6a57e0e025e9dcee48e466b3cf909178e298d238148664e796fc0f60ded5e52e \
+    --hash=sha256:6b43f5a9b9a8dd20ba3124914e63aa7d7427de761ac849081cda403c2112fda0 \
+    --hash=sha256:74093ed682ba58456f0d4450da7fb62b826fddd97824d44fc4a81ca6e0bf9e23 \
+    --hash=sha256:753afabcc4abf295f515ea33185cf997a1990b88a29d3a3336a9acf62ea85950 \
+    --hash=sha256:7b524cb1b08e15db0f116075c39ab51674b6d3c8103ec1a59c8ca464be83e28a \
+    --hash=sha256:7b9a6089f1337838492b217707e9a55d0b9b407fe9169a960fa12282abf2234c \
+    --hash=sha256:82359d00ea808c260c327e43955c0190bb7baef152a01ae0b5c74d05387b9552 \
+    --hash=sha256:8945557ed3015173dbf8d44184da9621add9162720acbc0ac4832b5a091b4e8a \
+    --hash=sha256:8b54e44763a851c336ca137c60a2434511f0d155e0b924ef374bfbc8d8db8927 \
+    --hash=sha256:8ca9e48edf246f09fd9bdb64fbd9cd8d18cd2a69ffc24d44891466e17595094f \
+    --hash=sha256:98b8aba6bb682b9e8859c628382b4881c0600b28056d63c3168c227c449f3284 \
+    --hash=sha256:9961abcb93bf03652ab09c00862a2396abacd57551c769ad34490a2ae508a61d \
+    --hash=sha256:a015ede631eeb098a23de8ec0cfe11a1dd02159ab7a26bdc7c6bde2befbbc7b4 \
+    --hash=sha256:a579ea6f473aab3958a64734194b22fbaec108ec45d994c28d3bd721e1e1da32 \
+    --hash=sha256:aa8d0a9f6d02e7626cdf540555bc2f5313eabe803dcca04854fc628ddf4b1058 \
+    --hash=sha256:aecb606f67f21fd1c0ffba1826470d2ee400e41b23881ad9a1b2157306865b1a \
+    --hash=sha256:b391becd31e9889da438d388aac0362e3dfd222affbe45d920580c351486c787 \
+    --hash=sha256:b77d6a2267227d68d8221cfca177f8c6d9f68019f3250401d0355d2638db9fb9 \
+    --hash=sha256:b9cbed53bb8992b72e587dd47d0ca71703f5f715420f48ed57587c06c2fcd213 \
+    --hash=sha256:b9e61143a5904f46daa0cde74ba60d3b7c0e3e000752ee138e2bc68e126a5803 \
+    --hash=sha256:c1dc60251d93beff32d4147ecd4ccc518b0f022a900093f6f3021c2012416f0f \
+    --hash=sha256:cc1a78b913f8665dda145999b1b4805ad2ef442ecbe3b819512cf7f95e70498a \
+    --hash=sha256:cc5db2983805f6be786488aac8c5998d5b71965488d1b18c44d435a2205a5cb4 \
+    --hash=sha256:d1ef9c478d8c8ca83499704d13e5ac32c840ed7ca7884aaaf716166aca5a2806 \
+    --hash=sha256:daec16b026c5741950a00c708acdf698c4f17babbe4829dd8232324822e9514f \
+    --hash=sha256:e209a797fdf8680d58d2e969a9ddb25058ea682f6cff59dbabc98d8aef4e0db1 \
+    --hash=sha256:e47b9b028efbc0486263a49f782ad0ae3e879855fe5a2897b59feefb78e1c40c \
+    --hash=sha256:e5a9c53e64732118ae8235d0e57eb90e2333e90ff749a1a7dca6f8bfdfa5200e \
+    --hash=sha256:e68ac7d7fd1a5d42a3a6d726d7cc8a7e0c9987934f11c6a5162aa2cf68e81e24 \
+    --hash=sha256:ed449d786b9032a7b85fcd6c2f7f54c4cd0e1e1ad254d396805ff922096bf08d \
+    --hash=sha256:ef3950747f3a588f692cf4d6f2937eedd1a2d5e199f863af29e8ec7da78a4f36 \
+    --hash=sha256:f35bb9ddeed4008c7d3e272dd1999885d712e1ce623b0a65ba8a8ed1d51c35cf \
+    --hash=sha256:f7ca1557553fdab313999ad69156de154ff87152cae963698be2e765164bb6c0 \
+    --hash=sha256:f9454960bbf185d33c669ccd5c9b76c96709a4542a95a65e27342c4d10dd8e20 \
+    --hash=sha256:ff8ddc1453bfe7934292409c7b8e9f68b0a6cff4e4c12535e4b4a66fd83aca0c
 chardet==7.6.0 \
     --hash=sha256:089e3bb81a0a07e94f15461ded9f9ee66d349615b1a9fd557d4de1003e2fc12e \
     --hash=sha256:0ad9bc6dab4f338673353fa3f0dc96122f559aaf746087408106e2fcbf132fe8 \

tests/test_dependency_gate.py

@@ -75,6 +75,16 @@ def test_an_exception_is_a_named_package_with_a_reason_beside_it():
     check("the same licence on any other package still blocks",
           len(blocked) == 1 and blocked[0][0] == "denied", f"({blocked})")
 
+    # The other shape an entry covers: a licence GitHub could not determine at
+    # all. ast_serialize is MIT at its source and `null` in the review data, and
+    # the name must win before the unknown-licence rule gets to look.
+    blocked, passed = dependency_gate.split([_dep(name="ast_serialize", licence=None)])
+    check("the named lint dependency passes with no licence in the data",
+          not blocked and len(passed) == 1, f"(blocked={blocked})")
+    blocked, _passed = dependency_gate.split([_dep(name="something-else", licence=None)])
+    check("and no licence on any other package still blocks",
+          len(blocked) == 1 and blocked[0][0] == "unknown", f"({blocked})")
+
 
 def test_a_compound_expression_is_judged_by_its_worst_half():
     ok, _ = dependency_gate.split([_dep(licence="MIT OR Apache-2.0")])

tools/dependency_gate.py

@@ -63,6 +63,22 @@
     # first version to declare the expression this way.
     "pyinstaller": "build tool, and the shipped bootloader carries the "
                    "PyInstaller bootloader exception (THIRD-PARTY-NOTICES.md)",
+    # GitHub reports `license: null` for ast_serialize, and the package is MIT
+    # in every place a person can look: the LICENSE file at the tag,
+    # `license = "MIT"` in its pyproject.toml and `license_expression: MIT` in
+    # the PyPI metadata. What is missing is the LEGACY `license` field and the
+    # trove classifier, which is all the dependency graph reads (the PEP 639
+    # expression is not picked up), and the LICENSE file opens with a preamble
+    # about the bundled Ruff crates, which stops licensee matching it on the
+    # repository side too. A detection gap, then, not an unknown licence.
+    #
+    # It is also mypy's dependency in requirements-lint.txt: it runs on a
+    # runner, is never imported by the program and never reaches a user.
+    # Recorded on 2026-09-21, when 0.11.1 was the first version of it the gate
+    # ever saw (0.8.0 entered in #134 without appearing in that review at all).
+    "ast_serialize": "MIT at the source (LICENSE, pyproject.toml, PyPI "
+                     "license_expression) that GitHub reads as null, and a "
+                     "lint-only dependency of mypy that never ships",
 }