Update setuptools-scm requirement from >=8 to >=9.2.2 - #321
Conversation
Updates the requirements on [setuptools-scm](https://github.com/pypa/setuptools-scm) to permit the latest version. - [Release notes](https://github.com/pypa/setuptools-scm/releases) - [Changelog](https://github.com/pypa/setuptools-scm/blob/v9.2.2/CHANGELOG.md) - [Commits](pypa/setuptools-scm@setuptools-scm-v10.0.0...v9.2.2) --- updated-dependencies: - dependency-name: setuptools-scm dependency-version: 9.2.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
rtibblesbot
left a comment
There was a problem hiding this comment.
setuptools-scm >=8 → >=9.2.2 — major lower-bound bump, build-system only, CI passing.
Semver risk: major (crosses v8→v9). Dependency type: [build-system].requires — not installed at runtime, no production exposure.
Changelog highlights across the range:
- v9.0.0:
git_describe_commandmigrated to new scm config — morango sets this key; CI passing confirms it is still honoured. - v9.0.0: Commit ID added to default version file template — affects the auto-generated
morango/_version.py(untracked), no functional impact. - v9.0.0: Python version build-tag fix — not applicable; morango uses tag-based versioning with no such suffixes.
- v9.2.0: New
[simple]extra — opt-in, no effect on existing configs. - v9.2.1/v9.2.2: Bugfixes only.
- Security fixes: none. Peer-dependency changes: none.
Yanked versions: v9.0.0, v9.1.0, v9.1.1 were yanked for regressions. Dependabot correctly floors at >=9.2.2, the first stable v9 release.
Open ceiling (>=9.2.2) admits v10.x, which exists — pre-existing policy, unchanged by this PR.
CI passing is the meaningful signal here; it validates the git_describe_command config and version file generation against v9.x. No code changes required.
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
Updates the requirements on setuptools-scm to permit the latest version.
Changelog
Sourced from setuptools-scm's changelog.
... (truncated)
Commits
e56b78fMerge pull request #1232 from RonnyPfannschmidt/fix-1231-dont-warn-when-no-guess4f55e95docs: update changelog for v9.2.2 patch release95a0c47fix: don't warn about tool.setuptools.dynamic.version when only using file fi...338f562Merge pull request #1226 from RonnyPfannschmidt/prepare-releasea893634Prepare release v9.2.1ad83282Merge pull request #1225 from pypa/pre-commit-ci-update-config20a4464[pre-commit.ci] pre-commit autoupdate70f6942Merge pull request #1219 from RonnyPfannschmidt/fix-1216-explicitly-deprecate...14d85c0Install Mercurial on Windows runners via Chocolatey8c5cec9Fix API stability check workflow to install griffe and improve reportingYou can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)