build(deps): bump diff-cover from 10.3.0 to 10.4.1 by dependabot[bot] · Pull Request #21235 · Chia-Network/chia-blockchain

dependabot · 2026-08-04T20:28:14Z

Bumps diff-cover from 10.3.0 to 10.4.1.

Release notes

Version 10.4.1

What's Changed

Handle low confidence chardet detection for undeclared encodings by @Bachmann1234 in Bachmann1234/diff_cover#611

Dependencies

Bump setuptools from 80.9.0 to 83.0.0 by @dependabot[bot] in Bachmann1234/diff_cover#609

Full Changelog: Bachmann1234/diff_cover@v10.4.0...v10.4.1

Version 10.4.0

What's Changed

Add --branch-coverage flag to respect partial branch coverage by @mofr in Bachmann1234/diff_cover#608

Dependency bumps

Bump ruff from 0.15.12 to 0.15.15 by @dependabot[bot] in Bachmann1234/diff_cover#602

Bump black from 26.3.1 to 26.5.1 by @dependabot[bot] in Bachmann1234/diff_cover#603

Bump actions/cache from 5 to 6 by @dependabot[bot] in Bachmann1234/diff_cover#604

Bump actions/checkout from 6 to 7 by @dependabot[bot] in Bachmann1234/diff_cover#605

Bump ruff from 0.15.15 to 0.15.20 by @dependabot[bot] in Bachmann1234/diff_cover#606

Bump pylint from 4.0.5 to 4.0.6 by @dependabot[bot] in Bachmann1234/diff_cover#607

New Contributors

@mofr made their first contribution in Bachmann1234/diff_cover#608

Full Changelog: Bachmann1234/diff_cover@v10.3.0...v10.4.0

Changelog

Sourced from diff-cover's changelog.

8/08/2026 v10.5.0

Support PHPUnit clover reports (PR 617)[https://redirect.github.com/Support PHPUnit clover reports (silently reported as zero coverage) Bachmann1234/diff_cover#617] Thanks @Eljees

8/06/2026 v10.4.2

Honor format option from config file- (PR 612)[https://redirect.github.com/fix(config): honor format option from config file Bachmann1234/diff_cover#612] Thanks @Sanjays2402

Accept reports/options in diff_cover_report_quality hookspec- (PR 613)[https://redirect.github.com/fix(plugins): accept reports/options in diff_cover_report_quality hookspec Bachmann1234/diff_cover#613] Thanks @Sanjays2402

7/23/2026 v10.4.1

Handle low confidence chardet detection for undeclared encodings. Fixes a failing test for chardet 7 and upgrades the tested suite to chardet7 (PR 611)[https://redirect.github.com/Handle low confidence chardet detection for undeclared encodings Bachmann1234/diff_cover#611] (bachmann1234)

7/21/2026 v10.4.0

Add --branch-coverage flag to diff-cover to treat partially covered branches in Cobertura XML reports as uncovered PR 608 Thanks @mofr

05/30/2026 v10.3.0

Add --show-covered flag to highlight covered diff lines in HTML report PR 600 Thanks @duxiaocheng

Update readme with cli flags PR 601 Thanks me

05/23/2026 v10.2.1

Fix --help hiding most CLI options in diff-cover/diff-quality PR 599 Thanks @duxiaocheng

01/08/2026 v10.2.0

Fixes issue where diff quality could not be run from subfolders PR 574 Issue 573 Thanks @eacherkan-via

12/30/2025 v10.1.0

Add support for floating-point total percentage in reports PR 565 thanks @tilaven

12/09/2025 v10.0.0

Remove python 3.9 support

Add python 3.14 support

Normalize exlude/include in pyproject.toml to support string or list

11/10/2025 v9.7.2

Fix file path issue on windows. Thanks @amos-chen PR 553

09/25/2025 v9.7.1

... (truncated)

Commits

8111a37 Version 10.4.1
291ee94 Handle low confidence chardet detection for undeclared encodings (#611)
147b410 Bump setuptools from 80.9.0 to 83.0.0 (#609)
8881685 Version 10.4.0
ca4effc Add --branch-coverage flag to respect partial branch coverage (#608)
b746a1b Bump pylint from 4.0.5 to 4.0.6 (#607)
85c493c Bump ruff from 0.15.15 to 0.15.20 (#606)
c61cc9c Bump actions/checkout from 6 to 7 (#605)
4e02dae Bump actions/cache from 5 to 6 (#604)
42632b3 Bump black from 26.3.1 to 26.5.1 (#603)
Additional commits viewable in compare view

Note

Low Risk
Dev-only tooling version bump with no changes to application logic; CI diff-coverage behavior should stay the same unless new diff-cover flags are enabled.

Overview
Bumps the optional dev dependency diff-cover from 10.3.0 to 10.4.1 by raising the minimum in pyproject.toml to >=10.4.1 and refreshing poetry.lock (package metadata, wheel/tarball hashes, and lock content-hash).

This only affects how CI runs diff-cover for PR diff coverage (e.g. .diffcover.toml and the workflow that calls diff-cover against coverage.xml). Upstream 10.4.0 adds an optional --branch-coverage flag for Cobertura partial branches; 10.4.1 improves chardet handling for undeclared encodings. No blockchain or runtime code paths change unless you adopt new CLI flags in CI.

^{Reviewed by Cursor Bugbot for commit d0dfafd. Bugbot is set up for automated code reviews on this repo. Configure here.}

socket-security · 2026-08-04T20:28:37Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/diff-cover@10.3.0 ⏵ 10.4.1	⁺¹

View full report

github-actions · 2026-08-04T20:41:25Z

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the upstream diff-cover 10.3.0→10.4.1 changes against the malware checklist and scanner findings.Verdict: benign

Supply-chain review of diff-cover 10.3.0→10.4.1 finds no compromise indicators.

Evidence

Functional diffs are a small opt-in --branch-coverage flag and a chardet low-confidence encoding fallback (cp1252)—no obfuscation, network I/O, persistence, or credential handling.
Upstream .github/workflows/ edits are only actions/checkout v6→v7 and actions/cache v5→v6; no new jobs/secrets/exfil steps.
Scanner Unicode hits are emoji in CodeQL workflow comments (ℹ️, ✏️), not zero-width/bidi/PUA payloads. No invisible Unicode in changed Python sources.
subprocess / shell_process_spawn hits are pre-existing tests/changelog/pytest-subprocess lock text, not new runtime spawn logic.
Lockfile churn is version bumps of known tools (black, chardet, pylint, ruff, setuptools); maintainer_drift and transitive_dependencies_added are generic heuristics without malicious package injection.
IOC/confusable findings: none. Typosquat risk: none (same package/repo/publisher).

Compatibility Analysis

I'll inspect local diff-cover usage and the upstream 10.3.0→10.4.1 changes to assess compatibility.Recommendation: merge

1) Local usage

Dev/optional dep: pyproject.toml (diff-cover >=10.4.1, in dev extra); locked at 10.4.1 in poetry.lock.
CI CLI only: .github/workflows/test.yml runs
diff-cover --config-file=.diffcover.toml --compare-branch=… --fail-under=100 --format html:…,markdown:… coverage.xml
then consumes stdout / diff-cover.md for PR comments and the job summary.
Config: .diffcover.toml only sets exclude.
No library imports of diff_cover under chia/.

2) Intersection with upstream changes (10.3.0 → 10.4.1)

Change	Default / nature	Hits our usage?
`--branch-coverage` (opt-in; default `False`)	Treats partial Cobertura branches as uncovered	No — we don’t pass the flag and config doesn’t set it. (We do collect branch data via `.coveragerc` `branch=True`, but that only matters if the flag is enabled later.)
Low-confidence chardet fallback for HTML snippets	Encoding decode hardening	Negligible — sources are normal UTF-8 Python
Upstream tooling bumps (setuptools/ruff/black/Actions/pylint)	Upstream-only	No consumer impact

Existing flags we use (--config-file, --compare-branch, --fail-under, --format) are unchanged.

3) Risks / unknowns

Low. Default scoring / fail-under behavior should match 10.3.0.
Only watch-out: enabling --branch-coverage later could make --fail-under=100 stricter because we already emit branch-aware Cobertura XML.
No signal that console/markdown output shape used by the PR-comment parser changed.

4) Verdict

Merge — additive, opt-in feature plus a decode fix; no required adoption changes for this repo’s CLI usage.

Malware Scan Summary

Status: warn
Warn only mode: true
Changed upstream files scanned: 11
Resolution strategy: tag_range
Changed node/vendor paths: 0
Changed lockfiles: 1
Resolved upstream range: 6f7eb72ed91490017f12bd24b153ef9c2ee87cec..8111a37dd22b925f2bde3f9c025b13a4112dc54b
Resolved refs: from=6f7eb72ed91490017f12bd24b153ef9c2ee87cec to=8111a37dd22b925f2bde3f9c025b13a4112dc54b
Unicode findings (post-allowlist): 2
Confusable findings (post-allowlist): 0
IOC findings (post-allowlist): 0
Heuristic findings (post-allowlist): 14

Top findings

.github/workflows/codeql-analysis.yml:51 unicode :: # ℹ️ Command-line programs to run using the OS shell.
.github/workflows/codeql-analysis.yml:54 unicode :: # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
CHANGELOG:743 shell_process_spawn :: * If we get an OSError on calling subprocess, display the failing command
poetry.lock:906 shell_process_spawn :: test = ["build[virtualenv] (>=1.0.3)", "filelock (>=3.4.0)", "ini2toml[lite] (>=0.14)", "jaraco.develop (>=7.21) ; python_version >= \"3.9\" and sys_platform != \"cygwin\"", "jaraco.envs (>=2.2)", "jaraco.path (>=3.7.2)", "jaraco.test (>=5.5)", "packaging (>=24.2)", "pip (>=19.1)", "pyproject-hooks (!=1.1)", "pytest (>=6,!=8.1.*)", "pytest-home (>=0.5)", "pytest-perf ; sys_platform != \"cygwin\"", "pytest-subprocess", "pytest-timeout", "pytest-xdist (>=3)", "tomli-w (>=1.0.0)", "virtualenv (>=13...[truncated]
tests/test_violations_reporter.py:7 shell_process_spawn :: import subprocess
tests/test_violations_reporter.py:10 shell_process_spawn :: from subprocess import Popen
tests/test_violations_reporter.py:51 shell_process_spawn :: mocked_subprocess = mocker.patch("diff_cover.command_runner.subprocess")
tests/test_violations_reporter.py:1847 shell_process_spawn :: self._mock_communicate = mocker.patch.object(subprocess, "Popen")
tests/test_violations_reporter.py:2092 shell_process_spawn :: self._mock_communicate = mocker.patch.object(subprocess, "Popen")
tests/test_violations_reporter.py:2114 shell_process_spawn :: """Error in subprocess call(s)"""
tests/test_violations_reporter.py:2118 shell_process_spawn :: # when you create a new subprocess.Popen() object and call .communicate()
tests/test_violations_reporter.py:2125 shell_process_spawn :: "diff_cover.command_runner.subprocess.Popen", return_value=popen_instance
.github/workflows/codeql-analysis.yml:0 workflow_path_touch :: path-touch
.github/workflows/verify.yaml:0 workflow_path_touch :: path-touch
poetry.lock:0 transitive_dependencies_added :: 102
diff-cover:0 maintainer_drift :: 10.3.0->10.4.1

coveralls-official · 2026-08-04T22:37:01Z

Coverage Report for CI Build 31415861413

Coverage decreased (-0.02%) to 91.929%

Details

Coverage decreased (-0.02%) from the base build.
Patch coverage: No coverable lines changed in this PR.
31 coverage regressions across 6 files.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

31 previously-covered lines in 6 files lost coverage.

File	Lines Losing Coverage	Coverage
chia/_tests/core/util/test_lockfile.py	21	77.42%
chia/server/node_discovery.py	3	80.52%
chia/server/server.py	3	84.8%
chia/full_node/full_node.py	2	88.66%
chia/full_node/full_node_api.py	1	88.67%
chia/_tests/simulation/test_simulation.py	1	96.5%

Coverage Stats


Relevant Lines:	125522
Covered Lines:	115555
Line Coverage:	92.06%
Relevant Branches:	12358
Covered Branches:	11197
Branch Coverage:	90.61%
Branches in Coverage %:	Yes
Coverage Strength:	1.84 hits per line

💛 - Coveralls

dependabot · 2026-08-06T17:23:39Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

emlowe · 2026-08-10T15:16:37Z

@dependabot recreate

github-actions · 2026-08-10T15:21:24Z

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the upstream diff and scanner findings for supply-chain compromise indicators.Checking workflow diffs, lockfile changes, and how Chia uses this package.Verdict: benign

Top evidence

Upstream v10.3.0→v10.4.1 matches release notes: optional --branch-coverage (default off) and a chardet low-confidence decode fallback to cp1252. No obfuscation, exfil, or unexpected network/FS behavior.
Scanner warn findings are false positives: emoji/U+FE0F in GitHub workflow comments; subprocess only in existing tests/CHANGELOG/lock metadata; workflow edits are Dependabot actions/checkout/cache bumps; lock churn is black/chardet/pylint/ruff/setuptools; maintainer_drift is the version bump itself (same publisher pattern).
No IOCs; tags v10.3.0/v10.4.1 exist. Chia uses this as a dev/CI tool without --branch-coverage, so runtime behavior should be unchanged aside from the encoding fallback.

Compatibility Analysis

I'll analyze how diff-cover is used here and whether the 10.3.0→10.4.1 changes touch those call sites.## Compatibility verdict: merge

Dev-only CLI bump; no intersection with this repo’s invocation, and behavioral changes are opt-in or internal hardening.

1) Where it’s used

Declared: optional dev dep in pyproject.toml (diff-cover >=10.4.1); locked at 10.4.1 in poetry.lock
Runtime/CI: only CLI in .github/workflows/test.yml — diff-cover --config-file=.diffcover.toml --compare-branch=… --fail-under=100 --format html:…,markdown:… coverage-reports/coverage.xml
Config: .diffcover.toml — [tool.diff_cover] exclude only
Consumers: same workflow parses stdout (regex for missing lines / totals) and appends diff-cover.md to the job summary
Not used as a Python library in this repo (no import diff_cover)

2) Intersection with upstream changes (10.3.0 → 10.4.1)

Change	Affects this repo?
`--branch-coverage` (opt-in; default `False`) — treat partial Cobertura branches as uncovered	No — flag not passed; default path unchanged
chardet low-confidence fallback (HTML snippet decoding)	Negligible — only snippet decode; CI uses UTF-8 Python sources
Upstream setuptools / ruff / black / GHA bumps	No — not shipped to consumers

.coveragerc has branch=True, so XML may contain branch metadata, but without --branch-coverage scoring stays line-hit based as before.

3) Risks / unknowns

Low: stdout shape used by the PR-comment regex is not part of the release notes; no indication it changed
None material: no CLI flags removed; Python requires >=3.10 (compatible); chardet remains a transitive dep (>=3.0.0; lock has 5.2.0)
Not a production/runtime dependency — CI/dev gate only

4) Recommendation

merge — additive opt-in flag + encoding robustness; existing flags/config/--fail-under=100 path should behave the same.

Malware Scan Summary

Status: warn
Warn only mode: true
Changed upstream files scanned: 11
Resolution strategy: tag_range
Changed node/vendor paths: 0
Changed lockfiles: 1
Resolved upstream range: 6f7eb72ed91490017f12bd24b153ef9c2ee87cec..8111a37dd22b925f2bde3f9c025b13a4112dc54b
Resolved refs: from=6f7eb72ed91490017f12bd24b153ef9c2ee87cec to=8111a37dd22b925f2bde3f9c025b13a4112dc54b
Unicode findings (post-allowlist): 2
Confusable findings (post-allowlist): 0
IOC findings (post-allowlist): 0
Heuristic findings (post-allowlist): 14

Top findings

.github/workflows/codeql-analysis.yml:51 unicode :: # ℹ️ Command-line programs to run using the OS shell.
.github/workflows/codeql-analysis.yml:54 unicode :: # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
CHANGELOG:754 shell_process_spawn :: * If we get an OSError on calling subprocess, display the failing command
tests/test_violations_reporter.py:7 shell_process_spawn :: import subprocess
tests/test_violations_reporter.py:10 shell_process_spawn :: from subprocess import Popen
tests/test_violations_reporter.py:51 shell_process_spawn :: mocked_subprocess = mocker.patch("diff_cover.command_runner.subprocess")
tests/test_violations_reporter.py:1910 shell_process_spawn :: self._mock_communicate = mocker.patch.object(subprocess, "Popen")
tests/test_violations_reporter.py:2155 shell_process_spawn :: self._mock_communicate = mocker.patch.object(subprocess, "Popen")
tests/test_violations_reporter.py:2177 shell_process_spawn :: """Error in subprocess call(s)"""
tests/test_violations_reporter.py:2181 shell_process_spawn :: # when you create a new subprocess.Popen() object and call .communicate()
tests/test_violations_reporter.py:2188 shell_process_spawn :: "diff_cover.command_runner.subprocess.Popen", return_value=popen_instance
poetry.lock:906 shell_process_spawn :: test = ["build[virtualenv] (>=1.0.3)", "filelock (>=3.4.0)", "ini2toml[lite] (>=0.14)", "jaraco.develop (>=7.21) ; python_version >= \"3.9\" and sys_platform != \"cygwin\"", "jaraco.envs (>=2.2)", "jaraco.path (>=3.7.2)", "jaraco.test (>=5.5)", "packaging (>=24.2)", "pip (>=19.1)", "pyproject-hooks (!=1.1)", "pytest (>=6,!=8.1.*)", "pytest-home (>=0.5)", "pytest-perf ; sys_platform != \"cygwin\"", "pytest-subprocess", "pytest-timeout", "pytest-xdist (>=3)", "tomli-w (>=1.0.0)", "virtualenv (>=13...[truncated]
.github/workflows/codeql-analysis.yml:0 workflow_path_touch :: path-touch
.github/workflows/verify.yaml:0 workflow_path_touch :: path-touch
poetry.lock:0 transitive_dependencies_added :: 102
diff-cover:0 maintainer_drift :: 10.3.0->10.4.1

Bumps [diff-cover](https://github.com/Bachmann1234/diff-cover) from 10.3.0 to 10.4.1. - [Release notes](https://github.com/Bachmann1234/diff-cover/releases) - [Changelog](https://github.com/Bachmann1234/diff_cover/blob/main/CHANGELOG) - [Commits](Bachmann1234/diff_cover@v10.3.0...v10.4.1) --- updated-dependencies: - dependency-name: diff-cover dependency-version: 10.4.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added Changed Required label for PR that categorizes merge commit message as "Changed" for changelog dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 4, 2026

dependabot Bot requested a review from a team as a code owner August 4, 2026 20:28

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code Changed Required label for PR that categorizes merge commit message as "Changed" for changelog labels Aug 4, 2026

dependabot Bot temporarily deployed to windows-code-signing August 4, 2026 20:41 Inactive

emlowe removed the Changed Required label for PR that categorizes merge commit message as "Changed" for changelog label Aug 5, 2026

github-actions Bot added the merge_conflict Branch has conflicts that prevent merge to main label Aug 6, 2026

dependabot Bot force-pushed the dependabot/pip/diff-cover-10.4.1 branch from fe9db2f to 024a0c9 Compare August 10, 2026 15:19

github-actions Bot removed the merge_conflict Branch has conflicts that prevent merge to main label Aug 10, 2026

dependabot Bot temporarily deployed to windows-code-signing August 10, 2026 15:19 Inactive

github-actions Bot added the merge_conflict Branch has conflicts that prevent merge to main label Aug 10, 2026

dependabot Bot force-pushed the dependabot/pip/diff-cover-10.4.1 branch from 024a0c9 to d0dfafd Compare August 10, 2026 17:48

github-actions Bot removed the merge_conflict Branch has conflicts that prevent merge to main label Aug 10, 2026

dependabot Bot temporarily deployed to windows-code-signing August 10, 2026 17:50 Inactive

ibutterbot mentioned this pull request Aug 11, 2026

build(deps): consolidated dependabot updates (2026-08-11) #21254

Open

Navigation Menu

Uh oh!

build(deps): bump diff-cover from 10.3.0 to 10.4.1 - #21235

build(deps): bump diff-cover from 10.3.0 to 10.4.1#21235
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/diff-cover-10.4.1

dependabot Bot commented on behalf of github Aug 4, 2026 •

edited by cursor Bot

Loading

Uh oh!

socket-security Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

coveralls-official Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Aug 6, 2026

Uh oh!

emlowe commented Aug 10, 2026

Uh oh!

github-actions Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 4, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Version 10.4.1

What's Changed

Dependencies

Version 10.4.0

What's Changed

Dependency bumps

New Contributors

Uh oh!

socket-security Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 4, 2026

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

Compatibility Analysis

1) Local usage

2) Intersection with upstream changes (10.3.0 → 10.4.1)

3) Risks / unknowns

4) Verdict

Malware Scan Summary

Top findings

Uh oh!

coveralls-official Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report for CI Build 31415861413

Coverage decreased (-0.02%) to 91.929%

Details

Uncovered Changes

Coverage Regressions

Coverage Stats

💛 - Coveralls

Uh oh!

dependabot Bot commented on behalf of github Aug 6, 2026

Uh oh!

emlowe commented Aug 10, 2026

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

Compatibility Analysis

1) Where it’s used

2) Intersection with upstream changes (10.3.0 → 10.4.1)

3) Risks / unknowns

4) Recommendation

Malware Scan Summary

Top findings

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Aug 4, 2026 •

edited by cursor Bot

Loading

socket-security Bot commented Aug 4, 2026 •

edited

Loading

coveralls-official Bot commented Aug 4, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading