build(deps): bump filelock from 3.25.2 to 3.29.0#20839
build(deps): bump filelock from 3.25.2 to 3.29.0#20839dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.25.2 to 3.29.0. - [Release notes](https://github.com/tox-dev/py-filelock/releases) - [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst) - [Commits](tox-dev/filelock@3.25.2...3.29.0) --- updated-dependencies: - dependency-name: filelock dependency-version: 3.29.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Changed
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 435a03b. Configure here.
| dnslib = ">=0.9.25" # dns lib | ||
| dnspython = ">=2.6.1" # Query DNS seeds | ||
| filelock = ">=3.16.1" # For reading and writing config multiprocess and multithread safely (non-reentrant locks) | ||
| filelock = ">=3.29.0" # For reading and writing config multiprocess and multithread safely (non-reentrant locks) |
There was a problem hiding this comment.
Minimum filelock version floor unnecessarily raised to 3.29.0
Low Severity
The minimum version constraint for filelock in pyproject.toml was bumped from >=3.16.1 to >=3.29.0, but the codebase only uses FileLock, BaseFileLock, and Timeout — APIs that have been stable since well before 3.16.1. No new 3.29.0 features (like SoftReadWriteLock or stale lock detection) are used anywhere. Raising the floor version unnecessarily tightens the dependency constraint and could cause resolution conflicts for downstream consumers or co-installed packages that depend on an older compatible filelock.
Reviewed by Cursor Bugbot for commit 435a03b. Configure here.
🤖 Cursor Dependency AnalysisSupply-Chain Malware ReviewVerifying how Chia uses Verdict: benign Why this reads as a normal upgrade
Scanner vs. interpretation: The report is warn-only with no IOCs; the items that look “scary” in a checklist (unicode, workflows, spawn) are consistent with benign upstream development once you separate repo CI/docs from published package contents. No conflict strong enough to overturn a benign verdict. Compatibility AnalysisSearching the codebase for 1) Where
|
| Location | Usage |
|---|---|
pyproject.toml |
Declared as filelock = ">=3.29.0" (comment: config read/write across processes/threads). |
poetry.lock |
Resolved to 3.29.0. |
chia/util/lock.py |
FileLock, BaseFileLock (typing), Timeout — acquire(timeout=..., poll_interval=...), release(), context manager. |
chia/simulator/block_tools.py |
with FileLock(...): (plot setup). |
chia/_tests/util/plot_cache.py, chia/_tests/util/blockchain.py |
Same FileLock context-manager pattern. |
chia/_tests/conftest.py |
Log level tweak for logger name "filelock" only. |
No AsyncFileLock, SoftFileLock, SoftReadWriteLock, or private filelock._* imports in chia/.
2) Overlap with changed APIs (3.25.2 → 3.29.0)
Upstream changes called out in the PR are mostly async (BaseAsyncFileLock / single-thread executor — PR #533), soft locks (stale detection on Windows — #534), SoftReadWriteLock (#528), and SoftFileLock PID / breaking (#524, #518).
Chia only uses synchronous FileLock plus Timeout and the stable acquire / release / context manager surface. That does not map to the async or soft-read/write APIs above. FileLock’s public contract is unchanged in the notes; updates are fixes/features on other code paths.
Edge case: On some Unix setups, FileLock can fall back to SoftFileLock (e.g. when flock is unavailable). Soft-lock behavior has evolved (stale/PID-related work). That could theoretically affect unusual filesystems, not the normal Windows WindowsFileLock / Unix flock path.
3) Risks / unknowns
- Low: No direct use of APIs that were heavily reworked in the changelog.
- Residual: Rare Unix → soft fallback or NFS-ish config/plot paths might see slightly different soft-lock behavior; still in the direction of bug fixes, not intentional breaking changes.
- Build: Same
requires-pythonband;filelockremains pure Python / standard wheel — no new native deps indicated.
4) Recommendation
Merge (or merge with minor caveats: if you have CI or manual checks on NFS-mounted chia dirs, a quick smoke test of config/plot locking is enough; not a reason to hold the bump).
Summary: Usage is narrow and sync-only; 3.25.2→3.29.0 churn is largely outside that surface. Proceed with the dependency bump.
Malware Scan Summary
- Status: warn
- Warn only mode:
true - Changed upstream files scanned:
27 - Resolution strategy:
tag_range - Changed node/vendor paths:
0 - Changed lockfiles:
0 - Resolved upstream range:
5b9872c523b20db569d8832da4fb640e9c175ce6..469b47f192b0a9f8c8b795d9b9f57212c716959b - Resolved refs: from=
5b9872c523b20db569d8832da4fb640e9c175ce6to=469b47f192b0a9f8c8b795d9b9f57212c716959b - Unicode findings (post-allowlist):
9 - Confusable findings (post-allowlist):
0 - IOC findings (post-allowlist):
0 - Heuristic findings (post-allowlist):
9
Top findings
.github/workflows/release.yaml:60unicode ::- name: 🏷️ Create temporary tag for hatch-vcs.github/workflows/release.yaml:114unicode ::- name: ⬇️ Download all the distsdocs/concepts.rst:325unicode ::lock = FileLock("data.txt") # ⚠️ Wrong!docs/tutorials.rst:154unicode ::FileLock("my.lock").acquire() # ⚠️ Don't do this.github/workflows/check.yaml:1unicode ::name: "🛠️ check".github/workflows/check.yaml:53unicode ::- name: "⚙️ Setup test suite".github/workflows/check.yaml:101unicode ::- name: "⚙️ Setup coverage tool".github/workflows/check.yaml:105unicode ::- name: "⬇️ Download coverage data".github/workflows/check.yaml:148unicode ::- name: "⚙️ Setup test suite"tests/soft_rw/test_soft_rw_sync.py:613shell_process_spawn ::# multiprocessing.spawn startup, the heartbeat thread scheduling, and the parent's mtime resolutiontests/soft_rw/test_soft_rw_sync.py:847shell_process_spawn ::ctx = mp.get_context("spawn")tests/soft_rw/test_soft_rw_sync.py:859shell_process_spawn ::ctx = mp.get_context("spawn")tests/soft_rw/test_soft_rw_sync.py:871shell_process_spawn ::ctx = mp.get_context("spawn")pyproject.toml:136shell_process_spawn ::"S603", # subprocess call: check for execution of untrusted inputpyproject.toml:151shell_process_spawn ::"S603", # subprocess call: check for execution of untrusted input.github/workflows/check.yaml:0workflow_path_touch ::path-touch.github/workflows/release.yaml:0workflow_path_touch ::path-touchfilelock:0maintainer_drift ::3.25.2->3.29.0
Coverage Report for CI Build 25075893407Coverage increased (+0.01%) to 91.203%Details
Uncovered ChangesNo uncovered changes found. Coverage Regressions16 previously-covered lines in 8 files lost coverage.
Coverage Stats
💛 - Coveralls |
Bumps filelock from 3.25.2 to 3.29.0.
Release notes
Sourced from filelock's releases.
Changelog
Sourced from filelock's changelog.
... (truncated)
Commits
469b47fRelease 3.29.0e85d072✨ feat(soft): enable stale lock detection on Windows (#534)f5ee171🐛 fix(async): use single-thread executor for lock consistency (#533)2a95458build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#530)55de20cRelease 3.28.0476b0e4🐛 fix(ci): unbreak release workflow, publish to PyPI again (#529)824713e✨ feat(rw): add SoftReadWriteLock for NFS and HPC clusters (#528)9879de9[pre-commit.ci] pre-commit autoupdate (#527)4cfab49Release 3.26.1734c9f2🐛 fix(asyncio): add exit to BaseAsyncFileLock and fix del loop handli...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Medium Risk
Dependency-only change, but
filelockimpacts cross-process/config locking behavior and this bump includes async and Windows lock-handling changes that could affect runtime concurrency edge cases.Overview
Updates the
filelockdependency requirement to>=3.29.0and refreshespoetry.lockaccordingly (newfilelockartifacts and lockfilecontent-hash).No application code changes; the PR is solely a dependency version bump affecting how file-based locking is provided at runtime.
Reviewed by Cursor Bugbot for commit 435a03b. Bugbot is set up for automated code reviews on this repo. Configure here.