From 017a3ce0011545104c319ae41be318ec61750553 Mon Sep 17 00:00:00 2001 From: Niels Lohmann Date: Wed, 11 Nov 2026 09:18:40 +0100 Subject: [PATCH] ci: revert importlib-metadata to 8.7.1 to fix Semgrep install (#6064) The Dependabot bump to 10.1.0 (#6059) conflicts with the pinned opentelemetry-api 1.37.0 (importlib-metadata<8.8.0), so the Semgrep job failed with ResolutionImpossible. Ignore importlib-metadata in Dependabot since semgrep pins it indirectly. Signed-off-by: Niels Lohmann --- .github/dependabot.yml | 1 + cmake/requirements/requirements-semgrep.txt | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 727429823..9f1f7dd8d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -67,3 +67,4 @@ updates: - dependency-name: mcp - dependency-name: boltons - dependency-name: "opentelemetry-*" + - dependency-name: importlib-metadata diff --git a/cmake/requirements/requirements-semgrep.txt b/cmake/requirements/requirements-semgrep.txt index 0ed7fad86..ba66d32c4 100644 --- a/cmake/requirements/requirements-semgrep.txt +++ b/cmake/requirements/requirements-semgrep.txt @@ -391,9 +391,9 @@ httpx-sse==0.4.3 \ idna==3.20 \ --hash=sha256:a7db850025b95ded1eae8a46181a1a6c56c92c96f0e2b005d9ff8dc0210cab44 \ --hash=sha256:ab7ae7122974553370f0bdb919e1a960b2cd1bc1ef0276416d896db81c14582c -importlib-metadata==10.1.0 \ - --hash=sha256:82b04047fa09792c1a8cfeddfe08bec79e4b13c29c8469b0d3949860f61017e8 \ - --hash=sha256:cf45ce66a929c64e994185a809c04840d0501db17e663810d993d0f4829265c7 +importlib-metadata==8.7.1 \ + --hash=sha256:49fef1ae6440c182052f407c8d34a68f72efc36db9ca90dc0113398f2fdde8bb \ + --hash=sha256:5a1f80bf1daa489495071efbb095d75a634cf28a8bc299581244063b53176151 jsonschema==4.25.1 \ --hash=sha256:3fba0169e345c7175110351d456342c364814cfcf3b964ba4587f22915230a63 \ --hash=sha256:e4a9655ce0da0c0b67a085847e00a3a51449e1157f4f75e9fb5aa545e122eb85