wt/json
1
0 Fork 0
mirror of https://github.com/nlohmann/json.git synced 2026-11-11 16:40:54 +00:00
Code Issues Packages Projects Releases Wiki Activity
5,507 Commits 21 Branches 57 Tags
e0a12df00a6912b28e09f0437f240e67dacc1cfe
Commit Graph
5 Commits
Author SHA1 Message Date
dependabot[bot] e0a12df00a build(deps): bump peewee from 3.19.0 to 4.5.3 in /cmake/requirements 
Bumps [peewee](https://github.com/coleifer/peewee) from 3.19.0 to 4.5.3.
- [Release notes](https://github.com/coleifer/peewee/releases)
- [Changelog](https://github.com/coleifer/peewee/blob/master/CHANGELOG.md)
- [Commits](https://github.com/coleifer/peewee/compare/3.19.0...4.5.3)

---
updated-dependencies:
- dependency-name: peewee
  dependency-version: 4.5.3
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-11-11 09:30:54 +00:00
Niels Lohmann 017a3ce001 ci: revert importlib-metadata to 8.7.1 to fix Semgrep install (#6064) 
The Dependabot bump to 10.1.0 (#6059) conflicts with the pinned
opentelemetry-api 1.37.0 (importlib-metadata<8.8.0), so the Semgrep job
failed with ResolutionImpossible. Ignore importlib-metadata in Dependabot
since semgrep pins it indirectly.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>
 2026-11-11 09:18:40 +01:00
dependabot[bot] 0dbeb39811 build(deps): bump importlib-metadata in /cmake/requirements (#6059) 
Bumps [importlib-metadata](https://github.com/python/importlib_metadata) from 8.7.1 to 10.1.0.
- [Release notes](https://github.com/python/importlib_metadata/releases)
- [Changelog](https://github.com/python/importlib_metadata/blob/main/NEWS.rst)
- [Commits](https://github.com/python/importlib_metadata/compare/v8.7.1...v10.1.0)

---
updated-dependencies:
- dependency-name: importlib-metadata
  dependency-version: 10.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-11-10 21:44:55 +01:00
Niels Lohmann 9ed8f85b21 build(deps): bump semgrep from 1.168.0 to 1.184.0 in /cmake/requirements (#6052) 
Regenerate the hash-pinned requirements file. This raises the transitive
pins pyjwt 2.13.0 -> 2.15.1 and mcp 1.23.3 -> 1.29.0 (also click 8.1.8 ->
8.4.2, new structlog 26.1.0), closing 18 of the 23 open Dependabot alerts.

The remaining alerts cannot be fixed until Semgrep relaxes its pins:
mcp needs 1.30.0 (Semgrep pins mcp==1.29.0) and opentelemetry-api needs
1.45.1 (Semgrep pins ~=1.37.0).

Signed-off-by: Niels Lohmann <mail@nlohmann.me>
 2026-11-10 15:25:03 +01:00
Niels Lohmann eac1b4343b ci: install the remaining pip dependencies with --require-hashes (#6050) 
Install Semgrep from a new hash-pinned requirements file in
cmake/requirements (covered by Dependabot) instead of a version-only
"pip install semgrep==1.168.0", and pass --require-hashes to the astyle
and natvis installs in check_amalgamation.yml, whose requirements files
got their hashes in #6046. Addresses the Scorecard Pinned-Dependencies
code-scanning alerts for semgrep.yml and check_amalgamation.yml.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>
 2026-11-10 08:33:30 +01:00