GeezerVison

All reactions

Add version bounds to the runtime dependencies: requests was fully
unbounded and typing-extensions had no upper bound, so a fresh install
could resolve either to any just-published release. As a library,
socketdev declares bounded ranges rather than exact pins - exact pins
in package metadata would conflict with consumers that pin their own
dependencies, including socket-python-cli, which pins its entire
runtime closure (socketsecurity 2.5.10+) and relies on this package's
ranges staying compatible.

Floors match the versions already resolved and tested in uv.lock;
ceilings exclude the next major. Also pins the hatchling build backend
used for sdist builds. Dependabot (uv ecosystem, 7-day cooldown)
already keeps the lockfile fresh within these bounds.

Companion to the socket-python-cli dependency pinning work (CE-359).

Co-Authored-By: Claude Fable 5 <[email protected]>
Signed-off-by: lelia <[email protected]>

lelia temporarily deployed to socket-firewall August 6, 2026 02:31 — with GitHub Actions Inactive

Seed a changelog in the socket-python-cli format, starting at 3.4.3,
with a pointer to GitHub releases for earlier history.

Co-Authored-By: Claude Fable 5 <[email protected]>
Signed-off-by: lelia <[email protected]>

lelia temporarily deployed to socket-firewall August 6, 2026 02:34 — with GitHub Actions Inactive

Import all 53 published releases (v1.0.15 through v3.4.2) from the
auto-generated GitHub release notes: one dated entry per version,
pre-releases labeled, body headings demoted one level so version
headings stay the top-level structure.

Co-Authored-By: Claude Fable 5 <[email protected]>
Signed-off-by: lelia <[email protected]>

lelia temporarily deployed to socket-firewall August 6, 2026 02:40 — with GitHub Actions Inactive

The new requests floor is a newly binding constraint for consumers on
older versions, so this warrants a minor bump rather than a patch.

Co-Authored-By: Claude Fable 5 <[email protected]>
Signed-off-by: lelia <[email protected]>

lelia temporarily deployed to socket-firewall August 6, 2026 02:57 — with GitHub Actions Inactive

Copy link

Copy Markdown

Contributor Author

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Incomplete package version bump
  • Updated pyproject.toml and uv.lock from 3.4.2 to 3.5.0 so packaging metadata matches socketdev/version.py and CHANGELOG.md.

Or push these changes by commenting:

@cursor push 804710c344

Preview (804710c344)

diff --git a/pyproject.toml b/pyproject.toml
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@
 
 [project]
 name = "socketdev"
-version = "3.4.2"
+version = "3.5.0"
 requires-python = ">= 3.9"
 dependencies = [
     'requests>=2.32.5,<3',

diff --git a/uv.lock b/uv.lock
--- a/uv.lock
+++ b/uv.lock
@@ -1353,7 +1353,7 @@
 
 [[package]]
 name = "socketdev"
-version = "3.4.2"
+version = "3.5.0"
 source = { editable = "." }
 dependencies = [
     { name = "requests" },

_{You can send follow-ups to the cloud agent here.}

Copy link

Copy Markdown

Contributor Author

Copy link

Copy Markdown

David Larsen (dc-larsen) left a comment

Two blockers before this can ship, both matching what Bugbot flagged. I confirmed the first empirically.

1. [project].version in pyproject.toml is still 3.4.2. No dynamic = ["version"], so the static field wins and [tool.hatch.version] is inert. On this branch: hatch version returns 3.4.2, uv build produces socketdev-3.4.2.tar.gz/.whl (bounds are correct in the metadata, just under the old number), and uv.lock still carries version = "3.4.2" for the project entry. So tagging v3.5.0 aborts at the Get Version gate with Error: Git tag (v3.5.0) does not match hatch version (v3.4.2), and tagging v3.4.2 hits pypi_exists=true and skips build/publish, so the new bounds never ship. Bumping line 7 to 3.5.0 fixes it (verified: hatch version then returns 3.5.0 and the build produces socketdev-3.5.0).

Note check_version passes here because version-check.yml reads __version__ from socketdev/version.py only and never looks at pyproject.toml, so it can't see the drift. Declaring dynamic = ["version"] and dropping the static field would close that gap permanently.

2. hatchling==1.31.0 requires Python >=3.10, but this package declares requires-python = ">= 3.9". 1.27.0 is the newest hatchling allowing 3.9. Sdist builds on 3.9 fail to resolve the backend; wheel installs are unaffected. Either pin 1.27.0, use >=1.27,<2, or drop 3.9 (classifiers already start at 3.10).

Rest looks right: test suite matches the main baseline exactly (183 passed, same 14 failures / 19 errors from credential-gated integration tests), uv sync --locked clean, and ranges-not-pins is the correct call for a library.

The [project] version in pyproject.toml is static ([tool.hatch.version]
is only consulted when version is declared dynamic), so bumping
version.py alone left the packaging metadata and uv.lock at 3.4.2.
Set the static version to 3.5.0 to match.

Pin hatchling to 1.27.0 instead of 1.31.0: 1.28+ requires Python 3.10,
while this package's requires-python still includes 3.9, so the newer
pin would break sdist builds on 3.9.

Addresses PR#103 review findings.

Co-Authored-By: Claude Fable 5 <[email protected]>
Signed-off-by: lelia <[email protected]>

lelia temporarily deployed to socket-firewall August 6, 2026 03:33 — with GitHub Actions Inactive

Per review on PR#103: with dynamic = ["version"], hatchling reads
socketdev/version.py (the file version-check.yml already validates),
so packaging metadata can never drift from the checked version again.

Co-Authored-By: Claude Fable 5 <[email protected]>
Signed-off-by: lelia <[email protected]>

Copy link

Copy Markdown

Contributor Author

lelia temporarily deployed to socket-firewall August 6, 2026 03:34 — with GitHub Actions Inactive

Copy link

Copy Markdown

Contributor Author

cursor Bot left a comment

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 64898c3. Configure here.}

David Larsen (dc-larsen) left a comment

Both blockers fixed, and the dynamic-version route is the better fix than just bumping the static field. Re-verified locally on 64898c3:

• hatch version returns 3.5.0, so the release Get Version gate now passes for tag v3.5.0 (and correctly rejects v3.4.2)
• uv build produces socketdev-3.5.0.tar.gz/.whl with Requires-Python: >=3.9 and requests<3,>=2.32.5 / typing-extensions<5,>=4.12.2
• 3.5.0 is not on PyPI yet (404), so pypi_exists=false and publish will actually run
• uv sync --locked clean (picks up 3.4.2 -> 3.5.0); uv.lock correctly drops the root version line now that it's dynamic
• hatchling 1.27.0 declares requires_python >=3.8, so the 3.9 sdist path is covered
• Test suite still matches the main baseline exactly (183 passed, same 14 failures / 19 errors from credential-gated integration tests)

Diff since my last pass is just those two files, nothing else.

lelia deployed to socket-firewall August 6, 2026 03:43 — with GitHub Actions Active