3 Commits

Include renames

Author	SHA1	Message	Date
dependabot[bot]	0dbeb39811	build(deps): bump importlib-metadata in /cmake/requirements (#6059) ... Bumps [importlib-metadata](https://github.com/python/importlib_metadata) from 8.7.1 to 10.1.0. - [Release notes](https://github.com/python/importlib_metadata/releases) - [Changelog](https://github.com/python/importlib_metadata/blob/main/NEWS.rst) - [Commits](https://github.com/python/importlib_metadata/compare/v8.7.1...v10.1.0) --- updated-dependencies: - dependency-name: importlib-metadata dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-11-10 21:44:55 +01:00
Niels Lohmann	9ed8f85b21	build(deps): bump semgrep from 1.168.0 to 1.184.0 in /cmake/requirements (#6052) ... Regenerate the hash-pinned requirements file. This raises the transitive pins pyjwt 2.13.0 -> 2.15.1 and mcp 1.23.3 -> 1.29.0 (also click 8.1.8 -> 8.4.2, new structlog 26.1.0), closing 18 of the 23 open Dependabot alerts. The remaining alerts cannot be fixed until Semgrep relaxes its pins: mcp needs 1.30.0 (Semgrep pins mcp==1.29.0) and opentelemetry-api needs 1.45.1 (Semgrep pins ~=1.37.0). Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-11-10 15:25:03 +01:00
Niels Lohmann	eac1b4343b	ci: install the remaining pip dependencies with --require-hashes (#6050) ... Install Semgrep from a new hash-pinned requirements file in cmake/requirements (covered by Dependabot) instead of a version-only "pip install semgrep==1.168.0", and pass --require-hashes to the astyle and natvis installs in check_amalgamation.yml, whose requirements files got their hashes in #6046. Addresses the Scorecard Pinned-Dependencies code-scanning alerts for semgrep.yml and check_amalgamation.yml. Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-11-10 08:33:30 +01:00