Repository navigation
Conversation
charzl
previously approved these changes
Oct 16, 2026
Apply the requirement bumps from the dependabot group update, except urllib3 and opentelemetry, which are handled separately in saltstack#70356 and pip-compile hooks. Deviations from the dependabot diff: - Keep multidict at >=6.6.0. Every available aiohttp requires multidict<7.0, so >=7.0.0 cannot resolve. - Add python_version markers so Python 3.9 stays on the last compatible release for cffi, jaraco.text, pytest, sqlparse and websocket-client, which now require Python 3.10+. Refs saltstack#70349
Apply the requirement bumps from the dependabot group update, except urllib3 and opentelemetry, which are handled separately in saltstack#70356 and pip-compile hooks. Deviations from the dependabot diff: - Keep multidict at >=6.6.0. Every available aiohttp requires multidict<7.0, so >=7.0.0 cannot resolve. - Add python_version markers so Python 3.9 stays on the last compatible release for cffi, jaraco.text, pytest, sqlparse and websocket-client, which now require Python 3.10+. Refs saltstack#70349
python-gnupg 0.5.7 declares setuptools>=68,<75 in its build-system requirements, which conflicts with the setuptools>=82.0.1 --build-constraint used for the onedir build and fails with ResolutionImpossible. It is pure Python with a universal wheel, so add it to the --only-binary lists alongside zc.lockfile. Related to saltstack#70349
The lint lock files moved from pylint 3.1.1 to 3.3.9, which adds possibly-used-before-assignment (E0606) and makes used-before-assignment (E0601) stricter. Disable possibly-used-before-assignment in .pylintrc, since the existing hits are mostly conditional imports and branch-assigned variables, and add inline disables for the remaining E0601, E1102 and E1123 false positives. Related to saltstack#70349
Use a disable/enable block around the used-before-assignment pragma in states.git so black leaves the line alone, disable using-constant-test for the verify_func lookup in gitfs, and use rsplit with maxsplit in the formulas conftest. Refs saltstack#70349
pip 26.2.x build isolation breaks macOS source builds of packages without a cp314 wheel (watchdog): relenv's sysconfig override is not applied, so extensions link with gcc -shared and fail with undefined Python symbols. The packaged pip is pinned separately in tools/pkg/build.py. Refs saltstack#70349
pytest 9 changed importorskip to skip only on ModuleNotFoundError. On
distros whose glibc is older than pynacl's wheel needs (Debian 11,
Amazon Linux 2, Photon 4, Rocky 8), importing nacl raises a plain
ImportError ("GLIBC_2.33 not found"), so test collection now errors
instead of skipping.
Pass exc_type=ImportError so these tests skip as they did under
pytest 8.
Refs saltstack#70349
query() built the connection's conv mapping by pointing every key at str so results come back as strings. That also replaced the encoders keyed by Python type, which pymysql uses to escape values it sends, such as the SET AUTOCOMMIT argument. Escaping a bool then called str(False, mapping) and raised "TypeError: str() argument 'encoding' must be str, not dict", which broke query and the password hash tests against MariaDB and Percona. Only override the decoders, which are keyed by integer field type, and leave the encoders as the library defines them. Refs saltstack#70349
pynacl 1.6.x wheels ship a _sodium.abi3.so that needs glibc >= 2.33. Amazon Linux 2, Debian 11, Photon OS 4 and Rocky Linux 8 do not provide it, so importing nacl fails there and test modules that import it error at collection. Keep Linux CI on pynacl 1.5.x and leave macOS, Windows and FreeBSD on 1.6.2. pynacl is only a CI requirement, so the shipped product is unaffected. Follow-up to saltstack#70349 and saltstack#70358.
The pip-compile hooks listed constraints.lock and base/zeromq/pytest/ crypto.lock in their files patterns, but those are .txt files. Editing requirements/constraints.txt or requirements/base.txt therefore never re-ran the hooks, which let stale lock files drift from the requirements (e.g. filelock on Python 3.10 in saltstack#70358).
requirements/base.txt and requirements/static/ci/common.txt require filelock<4.0.0 on Python 3.10, but requirements/constraints.txt allowed up to 4.1.0 and the pkg lock was stale at 4.0.12, so the Python 3.10 and py3.9 FreeBSD pip-compile hooks could not resolve. Align the constraint and regenerate the locks, which also finishes the pynacl cap from the previous commit for Python 3.10 (saltstack#70358, saltstack#70349).
The exc_type=ImportError workaround only existed for the glibc >= 2.33 requirement of the pynacl 1.6.x wheels. Linux CI is now capped to pynacl 1.5.x, so nacl imports normally and a real ImportError should fail loudly instead of silently skipping (saltstack#70358, saltstack#70349). This reverts the test changes from commit 312184c.
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Apply the requirement bumps from the dependabot group update, except urllib3 and opentelemetry, which are handled separately in #70356 and pip-compile hooks.
Deviations from the dependabot diff:
What issues does this PR fix or reference?
Refs #70349
Merge requirements satisfied?
[NOTICE] Bug fixes or features added to Salt require tests.
Commits signed with GPG?
Yes