chore: combine annotated-logger dependency updates

[sophiagavrila]

Note

Combined on-call dependency patching PR for Week 2 of the vuln-mgmt-eng on-call rotation, tracked by github/vuln-mgmt-eng#9583.
Generated with dependaswat and finished by hand.

What this PR does

Consolidates both open Dependabot PRs for this repo into a single reviewable change, and repairs the lint break that ruff 0.16 introduced.

Area	Updates
Python (pip)	1 Dependabot PR merged, 8 pinned dev/runtime packages
GitHub Actions	1 Dependabot PR merged, 3 action pins refreshed
Docker	none open
Vendored packages	n/a — this repo has no requirements-vendored.txt
Lint config	CPY001 + PLR0917 added to lint.ignore; Markdown excluded from the formatter

🔄 Dependabot PRs consolidated

PR	Title	Disposition
#152	[actions] (deps): Bump the dev-dependencies group across 1 directory with 3 updates	✅ Merged into this branch — close as superseded
#154	[pip] (deps): Bump the dev-dependencies group across 1 directory with 8 updates	✅ Merged into this branch — close as superseded (was red on ruff; fixed here)

Python packages (requirements.txt, requirements/requirements-dev.txt)

Package	Previous	New
certifi	2026.6.17	2026.7.22
coverage	7.15.1	7.15.4
filelock	3.29.7	3.32.2
packaging	26.2	26.3
platformdirs	4.10.0	4.11.0
pre-commit	4.6.0	4.6.1
ruff	0.15.21	0.16.1
virtualenv	21.6.1	21.7.1

certifi is the only one that reaches the published package's runtime dependency set; the rest are dev-only.

GitHub Actions pins

Action	Previous	New
actions/setup-python	v6	v7
pypa/gh-action-pypi-publish	cef2210 (v1.14.0)	dc37677 (v1.14.2)
sigstore/gh-action-sigstore-python	5b79a39 (v3.4.0)	790bc6b (v3.5.0)

Touches pytest.yaml, pyright.yaml, ruff.yaml, and publish-to-pypi.yaml.

sigstore/gh-action-sigstore-python runs only in github-release, which needs: publish-to-pypi and is therefore gated behind if: startsWith(github.ref, 'refs/tags/') — this PR does not exercise it.

pypa/gh-action-pypi-publish is exercised. publish-to-testpypi has no tag guard and the workflow triggers on push, so v1.14.2 ran on this branch and reached the upload step. That surfaced a long-standing red check, fixed here — see below.

Both sit on the supply-chain path for the published artifact and are worth a reviewer's eye.

🛡️ Security findings accounted for

No open Dependabot alerts on this repo at time of writing:

gh api repos/github/annotated-logger/dependabot/alerts?state=open  ->  []

This PR is routine maintenance patching, not a vulnerability remediation.

🔧 Lint repair (not a dependency change)

Bumping ruff to 0.16.1 broke lint in two independent ways. Both are fixed in pyproject.toml config only — no source or documentation content was rewritten.

1. Two preview rules stabilized into ALL (20 findings across 19 files):

Rule	Findings	Why it is ignored
CPY001 missing-copyright-notice	19	This project does not use per-file copyright headers; it ships a top-level LICENSE.txt.
PLR0917 too-many-positional-arguments	1	AnnotatedLogger.__init__ (annotated_logger/__init__.py:273) takes 6 positional args. This is the public constructor of a published package — changing its signature is a breaking API change and does not belong in a dependency-patch PR.

2. The formatter began reformatting Markdown. ruff 0.16 formats Python code blocks embedded in Markdown files, and CI runs ruff format --check .. README.md's ```python blocks deliberately show sample JSON log output underneath the source:

{"created": 1708476277.102495, "levelname": "INFO", ... "annotated": true}

Those lines parse as valid Python expressions, so the formatter rewrote each one into a multi-line dict literal — turning a realistic one-line log sample into something that no longer resembles the tool's actual output. Since this package's entire purpose is demonstrating log shape, that diff destroys the documentation.

Markdown is therefore excluded from the formatter rather than accepting the rewrite:

[tool.ruff.format]
exclude = ["*.md"]

ruff check still lints normally; only the formatter is scoped. README.md is byte-for-byte unchanged in this PR.

Validation

All run locally against Python 3.12.4 on the combined branch, with requirements.txt + requirements/requirements-dev.txt installed as pinned:

Command	Result
ruff check . (0.16.1)	✅ All checks passed
ruff format --check . (0.16.1)	✅ 19 files already formatted
pytest	✅ 76 passed, 100.00% coverage (required: 100%)
pytest on 3.10 and 3.14 (matrix bounds)	✅ 76 passed, 100.00% coverage on each
pyright	✅ 0 errors, 0 warnings, 0 informations

Remote CI runs the suite across Python 3.10 – 3.14 and is the final gate.

⚠️ The remote matrix does not actually provide that coverage, and this PR does not change that. pytest.yaml declares a 3.10–3.14 matrix but pins the setup step to python-version: '3.x', so all 15 jobs run one interpreter. Copilot raised this in review and I did apply the one-line binding (91eac8c) — but it surfaced a pre-existing failure unrelated to dependency patching: on macos-latest + 3.11, hatch env create dev fails with Environment `dev` has unknown type: pip-compile, reproducibly across two runner allocations, while the identical command and the full suite pass locally on macOS arm64 / CPython 3.11.14. With no fail-fast: false, that one job cancels the other 14. I reverted the binding in 8818bb0 to keep this PR scoped, and filed #156 with the full evidence and a suggested order of work.

🔧 Fixed a permanently-red publish job. Publish to TestPyPI had been failing on every PR in this repo, including on main (confirmed against the last four main runs). publish-to-testpypi runs on every push, but the project version only changes at release time, so each run rebuilt the current version and re-uploaded a file TestPyPI already had:

Uploading annotated_logger-1.3.4-py3-none-any.whl
400 File already exists ('annotated_logger-1.3.4-py3-none-any.whl', ...)

6324a9a sets skip-existing: true on that step — the canonical input on pypa/gh-action-pypi-publish at the pinned SHA dc37677 (skip_existing is the deprecated alias). Verified against the action's action.yml at that exact SHA rather than assumed. It is deliberately not set on the real publish-to-pypi job, where a duplicate upload means someone re-released an existing version and should keep failing loudly.

This PR is now fully green: 23 checks pass, 0 fail. The two skipping entries are the tag-gated PyPI and Sigstore release jobs, correctly inactive on a branch push.

Deployment monitoring

Not applicable. annotated-logger is a shared library published to PyPI and consumed by other services in the platform (vulnerability-aggregator, scan-engine, vuln-notifier, wiz-therapy, and others). It has no config/moda/ directory and is not deployed to a Kubernetes namespace, so there is no staging/production rollout to baseline.

Downstream exposure only happens when a consuming service re-resolves its own lockfile and picks up a new release — and this PR does not cut a release or bump the package version.

No Splunk baseline was captured, and none is claimed.

Isolation / not touched

This PR changes requirements.txt, requirements/requirements-dev.txt, four workflow files, and pyproject.toml.

It does not modify:

• any runtime source under annotated_logger/ — no behavior change
• any file under example/ or test/ — no test or assertion was altered
• README.md or any documentation content (explicitly protected from the formatter, see above)
• the public API surface, including AnnotatedLogger.__init__'s signature
• the package version, release configuration, or changelog
• the publish-to-testpypi tag guard — the job still runs on every push; only its duplicate-upload handling changed
• release semantics for the real PyPI index — publish-to-pypi still fails on a duplicate upload
• the pytest.yaml version matrix — binding it exposes a pre-existing macOS/3.11 environment failure, tracked in Pytest matrix runs a single interpreter; binding it exposes a macOS/3.11 hatch env failure #156
• coverage thresholds (still 100%)
• workflow triggers, permissions, or job structure

Beyond the dependency pins, there are exactly two non-dependency edits:

1. pyproject.toml — two rules appended to the existing curated lint.ignore array, plus a new [tool.ruff.format] section with a single exclude key (13 lines).
2. .github/workflows/publish-to-pypi.yaml — skip-existing: true on the TestPyPI upload step only (6324a9a), fixing a permanently-failing check.

[Copilot]

Pull request overview

Consolidates routine dependency updates and adjusts Ruff configuration for 0.16.1 compatibility.

Changes:

• Updates eight Python dependency pins.
• Refreshes three GitHub Actions dependencies.
• Excludes Markdown formatting and suppresses two newly stabilized Ruff rules.

Show a summary per file

File	Description
requirements/requirements-dev.txt	Updates development dependency pins.
requirements.txt	Updates runtime certifi.
pyproject.toml	Adjusts Ruff configuration.
.github/workflows/ruff.yaml	Upgrades setup-python.
.github/workflows/pytest.yaml	Upgrades setup-python.
.github/workflows/pyright.yaml	Upgrades setup-python.
.github/workflows/publish-to-pypi.yaml	Updates setup and publishing actions.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 6/7 changed files
• Comments generated: 2
• Review effort level: Balanced

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.