chore(deps-dev): bump configobj from 5.0.8 to 5.0.9 - #15084
chore(deps-dev): bump configobj from 5.0.8 to 5.0.9#15084dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
🔵 Review postedLast updated: 2026-08-02 19:15 UTC |
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #15084 bumps configobj 5.0.8 → 5.0.9.
- Semver: patch version number, but effectively breaking — 5.0.9 raises its own
requires-pythonto>=3.7, dropping Python 2 / <3.7 support (PR #246). - Dependency type: production. Declared in the
baseruntime group (pyproject.toml:75) and bundled into the WHL, despite thedeps-devPR title (that label comes from Dependabot config, not the actual group). - Security fix: 5.0.9 fixes CVE-2023-26112 (ReDoS) — worth revisiting once the 3.6 question is settled.
- API compatibility: the
ConfigObj/flatten_errors/get_extra_valuessurface Kolibri uses (kolibri/utils/options.py) is unchanged. Source-compatible on Python ≥3.7; the only breaking element is the Python floor. - Peer deps: none.
- CI: failing — Build WHL, WHL smoke tests, and Morango 3.6 all fail at dependency resolution because Kolibri still declares
requires-python = ">=3.6, <3.15"(pyproject.toml:14) and exercises Python 3.6, whichconfigobj==5.0.9(>=3.7) cannot satisfy.
Blocker: the Python 3.6 conflict is a hard, CI-confirmed failure. This cannot merge as-is. Resolution is a maintainer support-matrix decision, not something to fold silently into a Dependabot PR:
- If Python 3.6 must stay supported: this bump can't be taken — close the PR (or pin below 5.0.9), and track CVE-2023-26112 separately.
- If Python 3.6 is being dropped: raise
requires-pythonto>=3.7and remove the 3.6 CI legs first, then land this on top.
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #15084 — configobj 5.0.8 → 5.0.9 in the base (production runtime) group. Minor bump, but a blocking incompatibility persists on the same HEAD 3fcdb401 (no new commits since my prior CHANGES_REQUESTED).
1 of 1 prior finding still open.
Blocking — configobj 5.0.9 drops Python 3.6. The release raised its floor to Python>=3.7, but Kolibri still targets 3.6 (pyproject.toml:14 requires-python = ">=3.6, <3.15"; the Build WHL step resolves kolibri/dist with --python-version 3.6). CI is red on exactly this:
× No solution found when resolving dependencies:
╰─▶ Because the requested Python version (>=3.6) does not satisfy Python>=3.7
and configobj==5.0.9 depends on Python>=3.7, we can conclude that
configobj==5.0.9 cannot be used.
make: *** [Makefile:174: staticdeps] Error 1
This cascades to Build WHL, WHL smoke tests, and the Morango Integration Tests (3.6/3.7 without-uv legs). Despite the chore(deps-dev) title, configobj is a bundled production dependency, so this affects shipped installs.
The bump is desirable (5.0.9 addresses CVE-2023-26112, a ReDoS), but it cannot land as-is. Dependabot cannot make the required change — this is blocked on a human decision:
- Drop Python 3.6 support first (raise
requires-pythonand the dist--python-versionto 3.7), then take this bump; or - Hold until 3.6 is dropped on
develop; or - Keep 3.6 and pin configobj via an environment marker (
>=5.0.8,<5.0.9for 3.6,5.0.9for>=3.7) — more complexity than this bump warrants.
CI: failing.
Prior-finding status
UNADDRESSED — pyproject.toml:75 — configobj 5.0.9 requires Python >=3.7, incompatible with Kolibri's 3.6 support (same SHA, CI still red)
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
Bumps [configobj](https://github.com/DiffSK/configobj) from 5.0.8 to 5.0.9. - [Release notes](https://github.com/DiffSK/configobj/releases) - [Changelog](https://github.com/DiffSK/configobj/blob/release/CHANGES.rst) - [Commits](DiffSK/configobj@v5.0.8...v5.0.9) --- updated-dependencies: - dependency-name: configobj dependency-version: 5.0.9 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
3fcdb40 to
75e1f2d
Compare
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #15084 — configobj 5.0.8 → 5.0.9, a production/runtime dependency ([dependency-groups] base, vendored into kolibri/dist). Patch-level version number, but not a patch-level change in practice.
1 of 1 prior finding still open (rebase only; the dependency change is byte-identical to the previous round).
Breaking change: 5.0.9 raises its floor to Python>=3.7 (DiffSK/configobj#246), dropping the six Python-2 shim. Kolibri still declares requires-python = ">=3.6, <3.15" (pyproject.toml:14) and resolves kolibri/dist with uv pip install --python-version 3.6 --group base (Makefile:174), so the bump is unresolvable.
Security: the release carries the fix for CVE-2023-26112 (ReDoS in ConfigObj's validation regex) — worth tracking, but it doesn't change the compatibility verdict.
CI: failing. Build WHL, WHL smoke tests, Morango Integration Tests (3.6), and Python unit tests for Python versions without uv support (3.6) all red on 75e1f2d6, run 30762281166:
× No solution found when resolving dependencies:
╰─▶ Because the requested Python version (>=3.6) does not satisfy
Python>=3.7 and configobj==5.0.9 depends on Python>=3.7, we can conclude
that configobj==5.0.9 cannot be used.
make: *** [Makefile:174: staticdeps] Error 1
blocking — this needs a maintainer decision Dependabot can't make: either drop 3.6 first (raise requires-python and the staticdeps --python-version to 3.7, remove the 3.6 CI legs) and then land this, or hold/close and track CVE-2023-26112 separately.
Prior-finding status
UNADDRESSED — pyproject.toml:75 — configobj 5.0.9 requires Python >=3.7, incompatible with Kolibri's 3.6 support
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
|
Can't merge this without dropping Python 3.6 |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
2 participants
Bumps configobj from 5.0.8 to 5.0.9.
Release notes
Sourced from configobj's releases.
Changelog
Sourced from configobj's changelog.
Commits
242dfd0release 5.0.98857b08Merge pull request #246 from DiffSK/python-versiond6f7597Update minimum python to 3.7 everywhere, and add 3.128ffcf0cMerge pull request #241 from yegorich/license5e2f143Merge pull request #245 from jelmer/extra-2014fdf3634Drop extra '2014' in LICENSE file. Fixes #2333480a6eMerge pull request #237 from jelmer/drop-python2008165cDrop python 3.5 from GitHub action, since it now fails to download861383cDrop support for Python < 3.57c618b0Merge pull request #236 from cdcadman/cve_2023_26112