[reitblatt]

Description

Bump four transitive dependencies to their patched versions. Not entirely sure why dependabot missed these: pyasn1's bump was tied to setup-tools in #445, so blocked by that failing CI. I'm guessing the other ones were stuck behind that?

Note: fixed the dependabot logic in #570 to split these bumps to prevent needing to do this manually in the future

Package	From	To	Advisories
pyasn1	0.6.3	0.6.4	GHSA-8ppf-4f7h-5ppj, GHSA-hm4w-wwcw-mr6r, GHSA-m4p7-r5rc-7g4j
urllib3	2.7.0	2.8.0	GHSA-8988-9cw3-xx77, GHSA-vxq7-64xx-v4gw, GHSA-gh4c-6fx4-qh6g
virtualenv	21.4.2	21.14.13	GHSA-9h9j-4vrj-gf7g, GHSA-94p9-xgh2-xp45, GHSA-x78j-v8h9-3j2q, GHSA-p58f-9548-mpm2, GHSA-8rjx-v5ww-45pp, GHSA-c947-3pg5-gm8q, GHSA-5vjq-rrrf-7h2q, GHSA-vxj4-q4g9-crj7, GHSA-c978-59m8-c77v, GHSA-43mp-35q3-x3fq, GHSA-cw65-gx24-rc82, GHSA-558c-9hv2-4prj
opentelemetry-api	1.44.0	1.45.1	GHSA-xcq7-p3pf-p88h

Testing

• uv lock --check: lockfile consistent
• SKIP=prettier-osprey-ui,eslint-osprey-ui uv run pre-commit run --all-files: passed (ruff, ruff format, mypy and the file checks; the UI hooks need osprey_ui/node_modules and are left to CI)
• uv run mypy .: no issues in 396 source files
• uv tool run fawltydeps --check-unused --pyenv .venv: no unused dependencies
• ./run-tests.sh: exit 0; 1291 passed, 24 skipped, 5 xfailed
• Built osprey_worker/Dockerfile and confirmed the image installs pyasn1 0.6.4, urllib3 2.8.0, virtualenv 21.14.13 and opentelemetry-api 1.45.1

Checklist

• Tests pass locally
• uv run ruff check . passes (no unused imports or other lint errors)
• uv tool run fawltydeps --check-unused --pyenv .venv passes (no unused dependencies)
• Updated CHANGELOG.md with my changes, if applicable (not applicable: dependency bump)

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• uv.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration

• Source mode: Auto
• Repository: roostorg/osprey
• Branch: reitblatt/depalerts-uv-lock-refresh
• File: .coderabbit.yaml
• Commit: 9815437
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4c86ae3d-4387-48b8-a3d1-00cc80ef6795

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

No issues found across 1 file

_{View guided diff | Turn on auto-fix | Re-trigger cubic}