chore(deps): bump xmlschema, bandit, diff-cover and ruff - #220
Merged
Conversation
Consolidates four Dependabot pull requests that could not be merged
individually. Each rewrites poetry.lock, so merging any one of them made
the other three conflict — the queue never converged. They are applied
here as one manifest change and one lock regeneration.
xmlschema >=3.4.0,<4.0.0 -> >=4.3.2,<5.0.0
bandit ^1.7.0 -> ^1.9.4
diff-cover ^8.0.0 -> ^10.5.0
ruff ^0.15.0 -> ^0.16.2 (resolves 0.16.3)
xmlschema is a major bump and this project validates ISO 20022 messages
against XSDs, so it was checked beyond the suite passing: 6 of the 34
bundled schemas were loaded directly under 4.3.2, and the xml- and
validation-tagged tests were run as their own groups.
ruff 0.15 -> 0.16 can introduce new rules; `ruff check` and
`ruff format --check` were run at the exact resolved version rather
than assumed.
pytest 1468 passed, 9 skipped
ruff check . exit 0
ruff format --check . 223 files already formatted
poetry check --lock exit 0
Authorship note: these could not be cherry-picked — every one conflicts
on the lock — so the manifest edits were reapplied by hand. Credit for
the bumps belongs to Dependabot (#210, #212, #213, #215).
Signed-off-by: Sebastien Rousseau <sebastian.rousseau@gmail.com>
Assisted-by: Claude:claude-opus-4-7
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #220 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 79 79
Lines 3854 3854
Branches 467 467
=========================================
Hits 3854 3854
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This was referenced Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates #210, #212, #213 and #215.
Why they could not go in individually
Each rewrites
poetry.lock. Merging any one made the other three conflict, and the next merge invalidated the one after it — the queue never converged. They are applied here as one manifest change and one lock regeneration.xmlschema>=3.4.0,<4.0.0>=4.3.2,<5.0.0bandit^1.7.0^1.9.4diff-cover^8.0.0^10.5.0ruff^0.15.0^0.16.2→ resolves 0.16.3The two that deserved more than a green tick
xmlschema3 → 4 is a major bump, and this project validates ISO 20022 messages against XSDs — the one thing it must not get wrong. Beyond the suite passing, 6 of the 34 bundled schemas were loaded directly under 4.3.2, and thexml- andvalidate-tagged tests were run as their own groups (140 and 177 passed).ruff0.15 → 0.16 can introduce new lint rules that fire on existing code. Bothruff checkandruff format --checkwere run at the exact resolved version, not an approximation.Verification
pytestruff check .ruff format --check .poetry check --lockAuthorship
These could not be cherry-picked — every one conflicts on the lock — so the manifest edits were reapplied by hand. Credit for the bumps belongs to Dependabot (#210, #212, #213, #215), which is why those are referenced rather than silently closed.