📦 Dependency management: requests>=2.32.4 floor + self-hosted Renovate #13

Merged

mat merged 4 commits from chore/deps-management into main

2026-07-04 09:09:46 +00:00

mat commented

2026-07-04 08:45:48 +00:00

Owner

Dependency management: fix the policy + add a Renovate bot

Fixes the library's dependency policy and adds automated dependency maintenance. This was the "point 22" item from the client audit.

Why

Two contradicting sources of truth: setup.py declared an unpinned requests, while requirements.txt hard-pinned requests==2.31.0 — a version affected by CVE-2024-35195 and CVE-2024-47081. A hard == pin is an application pattern; a library should declare a floor and let consumers resolve.

What changed

c99d640 — Migrate packaging setup.py → pyproject.toml (PEP 621).
- Declares a floor requests>=2.32.4 (clears both CVEs; 2.32.4 is the exact release the .netrc leak was fixed in, and it does not over-constrain consumers such as the Home Assistant integration).
- requires-python = ">=3.9" + classifiers 3.9–3.12 — codifies the Python range CI already tests (the old setup.py classifiers listed EOL 3.6–3.9 and no python_requires).
- Package discovery scoped to comwatt_client*, so the wheel no longer ships the tests package (the old bare find_packages() did).
- version stays 0.2.3; name, readme, authors preserved. Public API unchanged.
6b13b58 — Remove requirements.txt; repoint CI. Its only content (the == pin) is now the packaging floor. Both .forgejo/ and .github/ test workflows now install -r requirements-dev.txt and get requests via pip install -e .. requirements-dev.txt is untouched.
4e3353a — Self-hosted Renovate bot (Forgejo).
- renovate.json: extends config:recommended, enables osvVulnerabilityAlerts (OSV.dev — the platform-agnostic option; the GitHub-only vulnerabilityAlerts does nothing on Forgejo).
- .forgejo/workflows/renovate.yml: scheduled + manual, runs docker.io/renovate/renovate:43 with RENOVATE_PLATFORM: forgejo against this repo. No bot files under .github/ (GitHub is a read-only push-mirror where such PRs would be dead-ends).

Verification

python -m build → clean wheel; metadata shows Requires-Dist: requests>=2.32.4, Requires-Python: >=3.9; tests package excluded.
renovate-config-validator → Config validated successfully.
Test suite: 24 passed.

Manual follow-ups (maintainer — required for the bot to run)

Grant the renovate-bot account Write access to this repo (Settings → Collaborators) — needed to push branches and open PRs.
Provide RENOVATE_TOKEN = renovate-bot's Forgejo PAT (scopes: repo RW, user R, issue RW, organization R), as an account-level or repo-level Actions secret.
Provide RENOVATE_GH_COM_TOKEN = a github.com read-only PAT (no scopes) — avoids changelog rate-limiting. Note: Forgejo rejects secret names containing GITHUB, so it is stored as RENOVATE_GH_COM_TOKEN and mapped to Renovate's RENOVATE_GITHUB_COM_TOKEN env var in the workflow.
Confirm the runner can pull docker.io/renovate/renovate:43 and supports container: jobs (else adjust runs-on).
After Renovate's first successful run, optionally drop LOG_LEVEL: debug.

Out of scope (noted, not changed)

[project.urls] Homepage still points at the GitHub mirror (inherited from setup.py). Other audit items (README import bug, typed exceptions, request timeouts, get_site_time_series) are tracked separately.

## Dependency management: fix the policy + add a Renovate bot Fixes the library's dependency **policy** and adds automated dependency maintenance. This was the "point 22" item from the client audit. ### Why Two contradicting sources of truth: `setup.py` declared an **unpinned** `requests`, while `requirements.txt` **hard-pinned** `requests==2.31.0` — a version affected by **CVE-2024-35195** and **CVE-2024-47081**. A hard `==` pin is an application pattern; a library should declare a **floor** and let consumers resolve. ### What changed - **`c99d640` — Migrate packaging `setup.py` → `pyproject.toml` (PEP 621).** - Declares a floor `requests>=2.32.4` (clears both CVEs; `2.32.4` is the exact release the `.netrc` leak was fixed in, and it does not over-constrain consumers such as the Home Assistant integration). - `requires-python = ">=3.9"` + classifiers 3.9–3.12 — codifies the Python range CI already tests (the old `setup.py` classifiers listed EOL 3.6–3.9 and no `python_requires`). - Package discovery scoped to `comwatt_client*`, so the wheel no longer ships the `tests` package (the old bare `find_packages()` did). - `version` stays `0.2.3`; name, readme, authors preserved. **Public API unchanged.** - **`6b13b58` — Remove `requirements.txt`; repoint CI.** Its only content (the `==` pin) is now the packaging floor. Both `.forgejo/` and `.github/` test workflows now install `-r requirements-dev.txt` and get `requests` via `pip install -e .`. `requirements-dev.txt` is untouched. - **`4e3353a` — Self-hosted Renovate bot (Forgejo).** - `renovate.json`: extends `config:recommended`, enables `osvVulnerabilityAlerts` (OSV.dev — the platform-agnostic option; the GitHub-only `vulnerabilityAlerts` does nothing on Forgejo). - `.forgejo/workflows/renovate.yml`: scheduled + manual, runs `docker.io/renovate/renovate:43` with `RENOVATE_PLATFORM: forgejo` against this repo. No bot files under `.github/` (GitHub is a read-only push-mirror where such PRs would be dead-ends). ### Verification - `python -m build` → clean wheel; metadata shows `Requires-Dist: requests>=2.32.4`, `Requires-Python: >=3.9`; `tests` package excluded. - `renovate-config-validator` → *Config validated successfully*. - Test suite: `24 passed`. ### Manual follow-ups (maintainer — required for the bot to run) 1. Grant the `renovate-bot` account **Write** access to this repo (Settings → Collaborators) — needed to push branches and open PRs. 2. Provide `RENOVATE_TOKEN` = `renovate-bot`'s Forgejo PAT (scopes: `repo` RW, `user` R, `issue` RW, `organization` R), as an account-level or repo-level Actions secret. 3. Provide `RENOVATE_GH_COM_TOKEN` = a github.com read-only PAT (no scopes) — avoids changelog rate-limiting. Note: Forgejo rejects secret names containing `GITHUB`, so it is stored as `RENOVATE_GH_COM_TOKEN` and mapped to Renovate's `RENOVATE_GITHUB_COM_TOKEN` env var in the workflow. 4. Confirm the runner can pull `docker.io/renovate/renovate:43` and supports `container:` jobs (else adjust `runs-on`). 5. After Renovate's first successful run, optionally drop `LOG_LEVEL: debug`. ### Out of scope (noted, not changed) `[project.urls] Homepage` still points at the GitHub mirror (inherited from `setup.py`). Other audit items (README import bug, typed exceptions, request timeouts, `get_site_time_series`) are tracked separately.

mat added 3 commits

2026-07-04 08:45:48 +00:00