timsaucer opened a new pull request, #1734: URL: https://github.com/apache/datafusion-python/pull/1734
# Which issue does this PR close? <!-- No issue; this consolidates open Dependabot PRs. --> Supersedes #1714, #1713, #1712, #1711, #1710, #1709, #1702, #1700, #1699, #1698, #1694, #1687, #1666, #1665, #1660, #1656, #1655, #1651, #1646, #1616, #1606. # Rationale for this change Dependabot has 22 open dependency PRs against `main`, and merging them one at a time means 22 separate full CI cycles that each invalidate the next PR's `Cargo.lock`/`uv.lock`. This PR applies all of them in a single change so CI runs once over the combined result. Two of the open PRs also cannot pass on their own. #1700 bumps `github/codeql-action/init` and #1699 bumps `github/codeql-action/analyze`, but the CodeQL action refuses to run when those two are on different versions, so each PR fails with `Loaded a configuration file for version '4.37.9', but running version '4.36.2'`. Applying both together is the only way either one goes green. # What changes are included in this PR? Cargo dependencies (`Cargo.lock` only — the workspace version ranges in `Cargo.toml` already admit these): | Crate | From | To | Supersedes | | --- | --- | --- | --- | | `arrow`, `arrow-array`, `arrow-schema`, `arrow-select` | 59.2.0 | 59.3.0 | #1712, #1709, #1711, #1714 | | `uuid` | 1.23.3 | 1.26.1 | #1713 | | `futures` | 0.3.32 | 0.3.34 | #1710 | | `log` | 0.4.32 | 0.4.34 | #1698 | | `async-trait` | 0.1.89 | 0.1.92 | #1687 | | `serde_json` | 1.0.150 | 1.0.151 | #1655 | | `tokio` | 1.52.3 | 1.53.1 | #1651 | | `quinn-proto` | 0.11.14 | 0.11.16 | #1660 | Python dependencies (`uv.lock`): | Package | From | To | Supersedes | | --- | --- | --- | --- | | `tornado` | 6.5.7 | 6.5.8 | #1702 | | `cryptography` | 49.0.0 | 50.0.0 | #1666 | | `setuptools` | 82.0.1 | 83.0.0 | #1646 | GitHub Actions: | Action | From | To | Supersedes | | --- | --- | --- | --- | | `actions/checkout` | v6 | v7 | #1606 | | `actions/setup-python` | v5, v6 | v7 | #1656 | | `actions/cache` | v5 | v6 | #1616 | | `taiki-e/install-action` | v2 | v2.85.5 | #1665 | | `astral-sh/setup-uv` | 8.2.0 | 10.0.1 | #1694 | | `github/codeql-action/init` and `/analyze` | 4.36.2 | 4.37.9 | #1700, #1699 | Two deliberate deviations from the Dependabot PRs as written: `actions/checkout` in `.github/workflows/codeql.yml` is pinned by commit SHA. #1606 moved it to `9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6`, which is a stale v6 commit rather than v7. This PR pins it to `3d3c42e5aac5ba805825da76410c181273ba90b1`, the commit `actions/checkout` v7 resolves to, so the SHA pin and the tag refs in the other workflows stay on the same major version. #1652 (`datafusion` 54.0.0 → 54.1.0) is not included. `main` is already on DataFusion 55.1.0 as of #1731, so that PR is obsolete and should be closed rather than merged. # Are there any user-facing changes? No. No public API changes and no behavior changes — this is dependency bumps only. The `arrow` 59.3.0 and `tokio` 1.53.1 bumps are patch-level upgrades within the ranges the package already declares, so the wheels resolve the same way for consumers. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
