Skip to content

보안(deps): Update filelock requirement from <4,>=3.20 to >=3.20,<5 - #172

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/filelock-gte-3.20-and-lt-5
Closed

보안(deps): Update filelock requirement from <4,>=3.20 to >=3.20,<5#172
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/filelock-gte-3.20-and-lt-5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 1, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on filelock to permit the latest version.

Release notes

Sourced from filelock's releases.

4.0.4

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@4.0.3...4.0.4

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.0.7 (2026-09-29)

  • File locks now raise ValueError at construction when mode denies the owner read or write, such as mode=0o444, instead of failing on a later acquire and staying broken until someone deletes the lock file. :pr:760

4.0.6 (2026-09-28)

  • Reject negative blocking timeouts other than -1 before reentrant ReadWriteLock and SoftReadWriteLock acquisition. Preserve unlimited waits and nonblocking acquisition. :pr:756

4.0.5 (2026-09-28)

  • Fix MarkerSoftFileLock acquisition and prevent contenders from evicting live protocol-2 owners after two seconds. Reclaim recognized records after owner death; preserve unknown contracts. :pr:749
  • Honor instance timeout and blocking settings in sync and async ReadWriteLock acquisition, including waits between tasks on one instance. Preserve explicit per-call overrides. :pr:750
  • Skip access-denial checks when the process can read mode-0o000 files. Keep mode-bit checks enabled for privileged processes on filesystems that support POSIX permissions. :pr:753
  • Skip vanished StrictSoftFileLock claims after a read-permission retry expires. Recheck the directory before raising a protocol error so concurrent removal does not turn a stale claim listing into an acquisition failure. :pr:754
  • Reject negative timeouts other than -1 in blocking AsyncReadWriteLock and AsyncSoftReadWriteLock acquisitions. Keep -1 as an unlimited wait and ignore timeouts when blocking=False. :pr:755

4.0.4 (2026-09-26)

  • Hostnames that still differ after their first 253 escaped characters now publish distinct owners, so a soft lock no longer takes another such host's live holder for its own and reclaims its marker. :pr:748

4.0.3 (2026-09-23)

  • Importing filelock on CPython 3.10 or 3.11 no longer makes new threads fail with RuntimeError: Cannot install a trace function while another trace function is being installed under coverage or a debugger. filelock skips its fork-safety

... (truncated)

Commits
  • 8ffba8a Release 4.0.4
  • 79a2e81 🐛 fix(identity): digest the cut tail of long hostnames (#748)
  • 5283806 Release 4.0.3
  • fd10e07 🐛 fix(api): skip the fork audit hook on CPython <3.12 (#747)
  • 2d4530f Release 4.0.2
  • 6c46312 🐛 fix(async-rw): give each task its own hold (#746)
  • fe0e99d 🐛 fix(api): serialize concurrent transitions on shared locks (#745)
  • b26beda build(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0 in the github-acti...
  • 10572ec fix: ignore broken sphinx-llm release (#742)
  • 6c10af3 [pre-commit.ci] pre-commit autoupdate (#741)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file security 보안 업데이트 (Dependabot) labels Oct 1, 2026
@dependabot
dependabot Bot requested a review from eddmpython as a code owner October 1, 2026 00:11
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file security 보안 업데이트 (Dependabot) labels Oct 1, 2026
@dependabot @eddmpython
보안(deps): Update filelock requirement from <4,>=3.20 to >=3.20,<5
28ab464 
Updates the requirements on [filelock](https://github.com/tox-dev/py-filelock) to permit the latest version.
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.20.0...4.0.4)

---
updated-dependencies:
- dependency-name: filelock
  dependency-version: 4.0.4
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@eddmpython
eddmpython force-pushed the dependabot/pip/filelock-gte-3.20-and-lt-5 branch from 47e4678 to 28ab464 Compare October 12, 2026 13:40
eddmpython added a commit that referenced this pull request Oct 12, 2026
@eddmpython
개선: huggingface-hub 허용 범위를 <3, filelock 을 <5 로 넓힌다 (#172, #173)
4b284cf 
Dependabot PR #172, #173 의 범위 완화를 uv.lock 의 requires-dist 와 함께 반영한다. PR 을 그대로 병합하면
pyproject 와 lock 이 어긋나, --locked 없이 uv sync 하는 데이터 파이프라인이 러너에서 다시 해석해
huggingface-hub 2.x 로 올라갈 수 있다. 잠긴 버전(huggingface-hub 0.36.2, filelock 3.x)은 그대로다.

- huggingface-hub 2.x 는 HTTP 스택을 httpx2 로 바꿨다. src 에는 requests 직접 사용과 HTTP 백엔드 설정이
  없고, 2.2.0 에서 huggingface_hub.utils 오류 import, 404 -> EntryNotFoundError(response.status_code),
  HfFileSystem 열기, list_repo_tree, retryHfCall 의 429 판정을 실제 HF 로 확인했다. PR #173 의 test-fast 는
  신선 해석으로 huggingface_hub 2.2.0 을 깔고 8,420 통과했다.
- filelock 4.1.1 에서 FileLock·Timeout 사용(mappingLedger, secrets)이 같게 동작한다.

검증: uv lock --check 통과, lock diff 는 specifier 2 줄.
@eddmpython

eddmpython commented Oct 12, 2026

Copy link
Copy Markdown
Owner

같은 범위 변경(filelock <5)을 uv.lock 의 requires-dist 와 함께 4b284cf 로 반영했습니다. filelock 4.1.1 에서 FileLock·Timeout 사용이 같게 동작함을 확인했습니다.

@eddmpython eddmpython closed this Oct 12, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/pip/filelock-gte-3.20-and-lt-5 branch October 12, 2026 15:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@eddmpython eddmpython Awaiting requested review from eddmpython eddmpython is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file security 보안 업데이트 (Dependabot)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@eddmpython