hutch-stats.git, branch dependabot/uv/setuptools-gte-83.0.0

chore(deps-dev): update setuptools requirement from >=69 to >=83.0.0

2026-07-27T09:36:38+00:00

Updates the requirements on [setuptools](https://github.com/pypa/setuptools) to permit the latest version. - [Release notes](https://github.com/pypa/setuptools/releases) - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst) - [Commits](https://github.com/pypa/setuptools/compare/v69.0.0...v83.0.0) --- updated-dependencies: - dependency-name: setuptools dependency-version: 83.0.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot]

Merge pull request #5 from zerolabsco/dependabot/uv/pydantic-2.13.4

2026-07-20T17:17:54+00:00

chore(deps): bump pydantic from 2.12.5 to 2.13.4

Merge pull request #1 from zerolabsco/dependabot/uv/apscheduler-3.11.3

2026-07-20T17:16:42+00:00

chore(deps): bump apscheduler from 3.11.2 to 3.11.3

Merge pull request #10 from zerolabsco/chore/pytest-9

2026-07-20T17:16:05+00:00

chore(deps): allow pytest 9 and upgrade to 9.1.1

2026-07-20T17:13:25+00:00

Closes CVE-2025-71176 (tmpdir handling). Test-only dependency, never in the runtime image. Floor raised to 9.0.3 rather than just dropping the <9.0 ceiling: with the floor left at 8.2 a fresh resolve could still land on a vulnerable 8.x and the advisory would stay open.

chore(deps): bump pydantic from 2.12.5 to 2.13.4

2026-07-20T17:04:53+00:00

Bumps [pydantic](https://github.com/pydantic/pydantic) from 2.12.5 to 2.13.4. - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](https://github.com/pydantic/pydantic/compare/v2.12.5...v2.13.4) --- updated-dependencies: - dependency-name: pydantic dependency-version: 2.13.4 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot]

Merge pull request #8 from zerolabsco/fix/idempotency-test-time-bomb

2026-07-20T17:02:33+00:00

fix: make todo idempotency test timestamps relative to now

2026-07-20T17:00:19+00:00

test_todo_ingestion_is_idempotent used hardcoded May 2026 event timestamps, but the poller computes `since` as now - 30 days. Once wall-clock time passed 2026-06-01 the fixture events fell outside that window, were skipped by the todo since filter, and the test asserted 0 inserted instead of 3. Anchor the three fixture timestamps to datetime.now(UTC) while keeping their original relative ordering, so the test stays inside the poller's lookback window regardless of when it runs.

chore(deps): upgrade starlette, mako, idna and pydantic-settings

2026-07-20T16:59:47+00:00

Clears eight open Dependabot alerts. None were exploitable against this service as written -- it exposes no form endpoints, mounts no StaticFiles, never reads request.url, sets no secrets_dir, and runs on Linux while several of the advisories are Windows-only -- but the bumps are cheap and that analysis only holds until the surface changes. starlette 1.0.0 -> 1.3.1 resolves five advisories on its own and requires fastapi 0.135.3 -> 0.139.2 to satisfy its pin. Mako is a transitive alembic dependency used only to scaffold migrations. pytest is left at 8.4.2; its advisory is test-only and the fix would need the <9.0 constraint in pyproject.toml relaxed across a major version.

chore(deps): bump apscheduler from 3.11.2 to 3.11.3

2026-07-20T16:46:36+00:00

Bumps [apscheduler](https://github.com/agronholm/apscheduler) from 3.11.2 to 3.11.3. - [Release notes](https://github.com/agronholm/apscheduler/releases) - [Commits](https://github.com/agronholm/apscheduler/compare/3.11.2...3.11.3) --- updated-dependencies: - dependency-name: apscheduler dependency-version: 3.11.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot]