3 Commits

Include renames

Author	SHA1	Message	Date
dependabot[bot]	6707d201aa	build(deps): bump opentelemetry-api in /cmake/requirements ... Bumps [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python) from 1.37.0 to 1.45.1. - [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-python/compare/v1.37.0...v1.45.1) --- updated-dependencies: - dependency-name: opentelemetry-api dependency-version: 1.45.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>	2026-11-10 15:09:17 +00:00
Niels Lohmann	9ed8f85b21	build(deps): bump semgrep from 1.168.0 to 1.184.0 in /cmake/requirements (#6052) ... Regenerate the hash-pinned requirements file. This raises the transitive pins pyjwt 2.13.0 -> 2.15.1 and mcp 1.23.3 -> 1.29.0 (also click 8.1.8 -> 8.4.2, new structlog 26.1.0), closing 18 of the 23 open Dependabot alerts. The remaining alerts cannot be fixed until Semgrep relaxes its pins: mcp needs 1.30.0 (Semgrep pins mcp==1.29.0) and opentelemetry-api needs 1.45.1 (Semgrep pins ~=1.37.0). Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-11-10 15:25:03 +01:00
Niels Lohmann	eac1b4343b	ci: install the remaining pip dependencies with --require-hashes (#6050) ... Install Semgrep from a new hash-pinned requirements file in cmake/requirements (covered by Dependabot) instead of a version-only "pip install semgrep==1.168.0", and pass --require-hashes to the astyle and natvis installs in check_amalgamation.yml, whose requirements files got their hashes in #6046. Addresses the Scorecard Pinned-Dependencies code-scanning alerts for semgrep.yml and check_amalgamation.yml. Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-11-10 08:33:30 +01:00