From 4a5a19d34fcc4818614cfa4a36211b9fa929de89 Mon Sep 17 00:00:00 2001 From: Corrin Lakeland Date: Sun, 30 Aug 2026 20:56:58 +1200 Subject: [PATCH] cryptography is a declared dependency, not a transitive one scripts/ops/extract_v1_credentials.py and its test import cryptography for the v1 Fernet decryption, but only xero-python was pulling it in, so deptry fails CI on main (DEP003) since #112 merged. Main rather than dev group: the extract runs on the production host during cutover phase 0, whose venv is installed with `uv sync --frozen --no-dev`. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01H4YMRsFzJQrHHzBkXHfYFC --- docs/rewrite-status.md | 2 +- pyproject.toml | 5 +++++ uv.lock | 2 ++ 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/docs/rewrite-status.md b/docs/rewrite-status.md index 8f036f65..8e56aad1 100644 --- a/docs/rewrite-status.md +++ b/docs/rewrite-status.md @@ -46,7 +46,7 @@ done only when that spec is green. | E2E specs ported | **47 spec files** (v1 shipped 40; the specs still to port are listed under MUST) — green is the only measure that counts | | Backend operations still to port | **58** (see below; 32 more exist but nothing calls them) | | API operations v2 exposes | 237 (`frontend/schema.v2.yml`, kept fresh by its own gate) | -| Unit tests | 2764 (all passing) | +| Unit tests | 2773 (all passing) | | Coverage | above the 88.4 fail_under floor (coverage's own gate on CI's pytest --cov run; ratchets up per slice — never down) | | Type/lint debt | zero mypy baseline, every suppression counted in [`code-quality.md`](code-quality.md), all gates on every commit | | Behaviour ledger | 121 recorded deviations | diff --git a/pyproject.toml b/pyproject.toml index 2a476ccb..7fe3fe65 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -44,6 +44,11 @@ dependencies = [ # rejects the result at employee-creation time. "python-stdnum>=2.1", "tinytag>=2.3.0", + # Main, not dev: scripts/ops/extract_v1_credentials.py decrypts v1's + # Fernet columns on the production host during cutover phase 0, in the + # `uv sync --frozen --no-dev` venv. Was only transitive before, which + # deptry rightly refuses (DEP003). + "cryptography>=46.0", ] [dependency-groups] diff --git a/uv.lock b/uv.lock index e20f60f7..e43acaec 100644 --- a/uv.lock +++ b/uv.lock @@ -587,6 +587,7 @@ source = { virtual = "." } dependencies = [ { name = "beautifulsoup4" }, { name = "celery" }, + { name = "cryptography" }, { name = "django" }, { name = "django-celery-results" }, { name = "django-eventstream" }, @@ -649,6 +650,7 @@ dev = [ requires-dist = [ { name = "beautifulsoup4", specifier = ">=4.13.4" }, { name = "celery", specifier = ">=5.5" }, + { name = "cryptography", specifier = ">=46.0" }, { name = "django", specifier = ">=6.0,<6.2" }, { name = "django-celery-results", specifier = ">=2.5" }, { name = "django-eventstream", specifier = ">=5.3.4" },