Bump the ktsu group with 6 updates - #233
Merged
Merged
Conversation
Bumps ktsu.CodeBlocker from 2.1.0 to 2.1.2 Bumps ktsu.Coder from 3.14.0 to 3.14.3 Bumps ktsu.PreciseNumber from 2.0.2 to 2.0.3 Bumps ktsu.RoundTripStringJsonConverter from 1.0.58 to 1.0.60 Bumps ktsu.SourceGeneratorToolkit from 1.0.2 to 1.0.5 Bumps ktsu.SourceGeneratorToolkit.Testing from 1.0.2 to 1.0.5 --- updated-dependencies: - dependency-name: ktsu.CodeBlocker dependency-version: 2.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ktsu - dependency-name: ktsu.Coder dependency-version: 3.14.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ktsu - dependency-name: ktsu.PreciseNumber dependency-version: 2.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ktsu - dependency-name: ktsu.RoundTripStringJsonConverter dependency-version: 1.0.60 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ktsu - dependency-name: ktsu.SourceGeneratorToolkit dependency-version: 1.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ktsu - dependency-name: ktsu.SourceGeneratorToolkit.Testing dependency-version: 1.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ktsu ... Signed-off-by: dependabot[bot] <support@github.com>
matt-edmondson
added a commit
that referenced
this pull request
Sep 15, 2026
PythonNamesTheClassInsideItsOwnBases asserted that ktsu.Coder writes `class Length(IVector0[Length[T], T])` — a base list naming the class being declared, which Python evaluates eagerly and so raises `NameError` on import. That was never the desired output. The test pinned the defect deliberately, so that fixing it upstream would fail here rather than pass unnoticed, and ktsu-dev/Coder#64 is now fixed: Coder writes the string forward reference `IVector0["Length[T]", T]`, which is the idiom Python has for exactly this. So the failure on main is the pin doing its job, not a regression. The bump from ktsu.Coder 3.14.0 to 3.14.3 in #233 carried the fix in, and this is the update the pin's own remark said to make when that day came. The test is renamed to PythonQuotesTheClassInsideItsOwnBases and asserts the quoted form. Keeping it rather than deleting it pins the fix the same way round: a regression upstream fails here instead of shipping a module that cannot be imported. Verified in both directions — against 3.14.3 it passes, and pinning Directory.Packages.props back to 3.14.0 fails it on the new expectation, so it is a real guard rather than a restatement of current behaviour. Go is untouched. GoSpellsAGenericTypeItDidNotDeclare still passes, so ktsu-dev/Coder#63 is still open and still pinned. CLAUDE.md moves the probe's answer from five of seven to six of seven, drops Python from the table of targets whose toolchain refuses the output, and records what happened: the pin is how the fix was noticed at all, which is the argument for pinning rather than skipping. Testing: Semantics.Cpp.Test 33/33 and Semantics.Test 1248/1248 pass, the solution builds Release with 0 warnings, and rebuilding leaves no drift in the committed generator output or alias props. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GVN7XqiFpbqxgnBBpyCMsx
matt-edmondson
added a commit
that referenced
this pull request
Sep 15, 2026
SonarCloud reports githubactions:S8232 as a BLOCKER on the job's `if:`, and it is right. `github.event.workflow_run.actor.login` is not an authenticated statement about who opened the pull request: a re-run re-attributes the run to whoever pressed the button, and nothing in the payload is signed. The `dependabot/` branch prefix beside it was no better — a branch is named by whoever pushes it. Together they were the whole of what stood between an arbitrary pull request and an automatic merge with `contents: write`. The payload now only locates the pull request; GitHub is asked who opened it, and the answer decides. `.user.login` from the REST representation is the identity check, so a PR on a `dependabot/`-prefixed branch opened by anyone else is left alone rather than merged. Matching on the head SHA rather than the branch name also closes a hole this workflow existed to close. The only pull request that can match is one whose head is the exact commit CI just reported on, so a commit pushed after CI finished moves the head, nothing matches, and nothing is merged. Before this the lookup was by branch, and a push landing between the green report and the merge would have been merged without CI ever seeing it — the same failure as #233, reached by a different route. The SHA is checked to be a hex digest before it is interpolated into a jq filter, so nothing from the payload reaches the query as syntax. The `if:` keeps only what the event is rather than who it claims to be: a pull_request run that concluded successfully. That is a pre-filter, not a trust boundary, and the trust decision is the API lookup. Testing: the step was extracted from the YAML, so the shell and jq quoting is exactly what Actions runs, and driven against six fixtures with a stub gh — Dependabot with every check green merges; red CI and a still-running job each decline and name what is not green; a PR on a dependabot/-prefixed branch opened by someone else is refused; a head that moved since CI matches nothing; and a malformed SHA exits non-zero before any query is made. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GVN7XqiFpbqxgnBBpyCMsx
This was referenced Sep 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated ktsu.CodeBlocker from 2.1.0 to 2.1.2.
Release notes
Sourced from ktsu.CodeBlocker's releases.
2.1.2
v2.1.2 (patch)
Changes since v2.1.1:
What's Changed
Full Changelog: ktsu-dev/CodeBlocker@v2.1.1...v2.1.2
2.1.1
v2.1.1 (patch)
Changes since v2.1.0:
What's Changed
Full Changelog: ktsu-dev/CodeBlocker@v2.1.0...v2.1.1
Commits viewable in compare view.
Updated ktsu.Coder from 3.14.0 to 3.14.3.
Updated ktsu.PreciseNumber from 2.0.2 to 2.0.3.
Release notes
Sourced from ktsu.PreciseNumber's releases.
2.0.3
v2.0.3 (patch)
Changes since v2.0.2:
What's Changed
Full Changelog: ktsu-dev/PreciseNumber@v2.0.2...v2.0.3
Commits viewable in compare view.
Updated ktsu.RoundTripStringJsonConverter from 1.0.58 to 1.0.60.
Release notes
Sourced from ktsu.RoundTripStringJsonConverter's releases.
1.0.60
v1.0.60 (patch)
Changes since v1.0.59:
What's Changed
Full Changelog: ktsu-dev/RoundTripStringJsonConverter@v1.0.59...v1.0.60
1.0.59
v1.0.59 (patch)
Changes since v1.0.58:
What's Changed
Full Changelog: ktsu-dev/RoundTripStringJsonConverter@v1.0.58...v1.0.59
Commits viewable in compare view.
Updated ktsu.SourceGeneratorToolkit from 1.0.2 to 1.0.5.
Release notes
Sourced from ktsu.SourceGeneratorToolkit's releases.
1.0.5
v1.0.5 (patch)
Changes since v1.0.4:
What's Changed
Full Changelog: ktsu-dev/SourceGeneratorToolkit@v1.0.4...v1.0.5
1.0.4
v1.0.4 (patch)
Changes since v1.0.3:
What's Changed
Full Changelog: ktsu-dev/SourceGeneratorToolkit@v1.0.3...v1.0.4
1.0.3
v1.0.3 (patch)
Changes since v1.0.2:
What's Changed
New Contributors
Full Changelog: ktsu-dev/SourceGeneratorToolkit@v1.0.2...v1.0.3
Commits viewable in compare view.
Updated ktsu.SourceGeneratorToolkit.Testing from 1.0.2 to 1.0.5.
Release notes
Sourced from ktsu.SourceGeneratorToolkit.Testing's releases.
1.0.5
v1.0.5 (patch)
Changes since v1.0.4:
What's Changed
Full Changelog: ktsu-dev/SourceGeneratorToolkit@v1.0.4...v1.0.5
1.0.4
v1.0.4 (patch)
Changes since v1.0.3:
What's Changed
Full Changelog: ktsu-dev/SourceGeneratorToolkit@v1.0.3...v1.0.4
1.0.3
v1.0.3 (patch)
Changes since v1.0.2:
What's Changed
New Contributors
Full Changelog: ktsu-dev/SourceGeneratorToolkit@v1.0.2...v1.0.3
Commits viewable in compare view.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions