Repository navigation
build(deps-dev): bump coverage from 7.16.2 to 7.17.0 - #64
Closed
dependabot[bot] wants to merge 432 commits into
Closed
dependabot[bot] wants to merge 432 commits into
dependabot[bot] wants to merge 432 commits into
Conversation
…and offline sync - import_steam collects per-library OSErrors into an errors list; the import route returns them so a read-only mount names its path (row 12) - RetroAchievements 401/403 becomes a credentials ValueError (row 13) - metadata sync translates URLError/TimeoutError into a connection error for the job panel instead of a raw socket message (row 11) - tests cover non-UTF8 scan names, read-only steamapps, offline LBDB sync, and the RA 401 path
- ui_smoke gains hardening checks: 400-char names truncate with ellipsis, deleting the selected game clears selection and re-renders, ten rapid platform toggles leave filteredGames consistent - test_launch_doctor stops writing a probe ROM into the real HOME
- VERSION 1.12.1 across updates.py, README, metainfo, PARITY, SUPPORT, flathub checklist, bug template, gen_sbom fallback - coverage floors ratchet to 83.0 total / 58.0 web_app (measured 84/59) - reliability.md: zero Manual rows left, all scenarios Tested or Gated - changelog and release notes for the hardening patch
CI filesystems stat through chmod-000 dirs but fail on read, so libraryfolders.vdf could raise PermissionError out of import_steam. Catch OSError at the steam_libraries boundary too, and mock the failure in the test so it is deterministic on every platform.
…weep Badge href/alt to v1.12.1, coverage floors 83/58, SQLite wording, native-contract persistence, SUPPORT env vars, .env.example aliases, flathub/archive notes, RELEASE_NOTES 1.12.1 items.
Add a second supported platform alongside Linux: - native_host_win.c: WebView2 host that owns the Python server's lifetime, renders the same UI over loopback, exposes the existing window.openboxNative bridge, remembers window geometry, provides tray icon and minimize-to-tray, handles openbox:// deeplinks, enforces one instance per data directory, and stops the server gracefully (job object fallback). scripts/build_native_host_windows.ps1 builds it; the release job and the windows-latest CI job both build it, and the release refuses to publish a zip without the compiled host. - Launchers openbox.cmd, openbox.ps1 and openbox-native.ps1 mirror the Linux ladder (native window, then browser app window), and scripts/install.ps1 installs the signed portable zip into %LOCALAPPDATA%, registers the Start Menu shortcut, the openbox:// protocol handler and PATH, and keeps the previous tree for rollback. The in-app updater stages the same signed zip. - pkg/platform_compat.py owns the platform differences: data root under %LOCALAPPDATA%, process liveness without os.kill(pid, 0) (which terminates the target on Windows), POSIX separators in stored paths, launcher and Python resolution. Runtime stays stdlib-only; every bundled emulator definition carries its Windows executable name. - Tests: tests/test_platform_compat.py, IS_WINDOWS guards for Linux-only packaging tests, and scripts/run_windows_tests.py (dev tool) for per-file runs with timeouts. The windows-latest CI job runs that suite, builds the native host, and runs the portable gates (runtime modules, v1 contract, version sync, i18n, CSP, design tokens). - Release prep: version 1.13.0, ratcheted coverage floors, changelog, README, RELEASE_NOTES and ADR 0048; superseded Windows handoff archived under docs/archive/.
The Windows port resolved the .sh fallback through shutil.which, so a stored launch recorded /usr/bin/bash instead of the portable name, and two new shebang files landed without the executable bit (invisible on Windows, EXE001 on the Linux gate).
terminate_process_tree coerced a truthy pgid with int(), and int() of a non-numeric object is 1. On POSIX that turned a failed-launch rollback into SIGTERM for process group 1 - the CI runner's own group, which is why both Linux test jobs died with 'the runner has received a shutdown signal' - and a persisted session with pgid 0/1 would have force-killed the server's own group at shutdown. Only an integer group id above 1 is trusted, PID 1 is refused outright, and everything else falls back to the process's own group.
The port relaxed '/media/moments/' to two path-part checks; assert the segment order again, with separators normalised for Windows.
The JSON report dies with the runner, so failures in the windows-latest job arrived with no diagnostics.
Three consecutive runs failed the gate before its compile/coverage stages because registry.npmjs.org answered 503 for the audit endpoint. Retry only that endpoint error (a real advisory still fails immediately) with bounded backoff, and still fail closed when the service stays down.
Bumps [coverage](https://github.com/coveragepy/coveragepy) from 7.16.0 to 7.16.1. - [Release notes](https://github.com/coveragepy/coveragepy/releases) - [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst) - [Commits](coveragepy/coveragepy@7.16.0...7.16.1) --- updated-dependencies: - dependency-name: coverage dependency-version: 7.16.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [puppeteer](https://github.com/puppeteer/puppeteer) from 25.10.0 to 25.11.0. - [Release notes](https://github.com/puppeteer/puppeteer/releases) - [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md) - [Commits](puppeteer/puppeteer@puppeteer-v25.10.0...puppeteer-v25.11.0) --- updated-dependencies: - dependency-name: puppeteer dependency-version: 25.11.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [ruff](https://github.com/astral-sh/ruff) from 0.16.6 to 0.16.8. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.16.6...0.16.8) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.16.8 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Three defects the newly-reachable test stages exposed. state_dir_for validated the resolved directory but returned the unresolved spelling, so a data root reached through an 8.3 alias put two spellings of the same directory in one argv: the resolved state file next to an unresolved --appendconfig path. It returns the resolved directory now. The POSIX reveal_path branch opened a path that does not exist yet instead of its containing folder, because it keyed on is_file() rather than is_dir(). Eight emulator defs spelled Windows core paths in double quotes, where a backslash starts an escape: '\cores\' is valid YAML but '\c' is not, and only the vendored fallback parser tolerates it. With PyYAML installed the whole registry failed to import. Single quotes keep the backslashes literal under both parsers.
The scan keyed roots on the spelling the caller configured, so one folder reached through an 8.3 short name, a differing case, or a trailing separator counted as several roots and every screenshot under it imported again. Key on the resolved path instead.
Nine files failed on windows-latest because the fixture kept %TEMP% in its 8.3 short form while production resolves the paths it stores and hands back, so exact-string assertions compared two spellings of one directory. Resolve the fixture root once at setup instead: clips, trash, parity API, memories, perf cache, shared media, saves, and updates. test_saves also stops calling os.path.relpath across drives (Windows cannot spell a relative path between them); it runs the relative-entry case from the fixture root, which pins the same contract. test_updates compares the canonical launcher, which is what the shortcut and the protocol registry hold.
An unreachable configured root (embedded NUL) must be reported as skipped instead of aborting discovery, and the canonical-key dedupe falls back to the raw spelling in that case.
…mand line The gate runs the suite through the coverage console script, and a shebang wrapper is what the kernel records for /proc/<pid>/comm on POSIX, so the test process itself reports "coverage" there and the assertion failed only in the Linux gate (the plain suite passes). Assert the identity probe against a child spawned directly: that is the process shape the runtime tracks.
The vendored fallback parser accepts a backslash escape the YAML
specification does not define, and requirements-dev.txt installs no
PyYAML, so CI loads the defs with the tolerant parser only. Eight defs
therefore shipped "{EmulatorDir}\cores\mame_libretro.dll", which made
the whole adapter registry fail to import for any install that had PyYAML
present.
Checks the double-quoted scalars textually against the same rules a strict
loader applies (defined escapes, hex widths), leaving single-quoted
scalars, comments, and block scalars alone, where a backslash is literal.
The verdict matches PyYAML on a 12-case corpus, and both tests fail on the
spelling the eight defs carried.
The Windows job prints each file's stderr tail inline, and 12 lines cut the frames naming the failing assertion, which is why several port failures needed a local rerun to identify.
The harness had 154 guards of the form 'if (!x) process.exit(1);' with no
message, so a failure surfaced as a bare exit code after the last printed
block. Reading which check failed meant diffing every flag in the block
against the source, and the first failure hid the rest.
Each guard now records into a failures list that the run prints, so the
report names every failed check ('SMOKE FAIL 2 check(s): partySmoke.wheel;
the party wheel lists at least one up-next game') and one run reports all
of them. The a11y focus check also records the state it saw (open dialogs,
menu, active element), because that is the check that failed once on CI
without reproducing locally.
Guard conditions are unchanged: the 154 condition texts are identical to
the previous revision, only their reporting moved.
The released zip already carries native_host.exe, but a source checkout had to install MSVC and the WebView2 SDK to get a native window. The release job now copies the host it builds to OpenBox-x86_64-windows-native-host.exe, hashes it, attests it, and runs it through the same sign/verify ladder as the zip before uploading it, so the same binary is available on its own with a .sha256 and .sig. Documents the asset in the changelog, release notes, README, and ADR 0048, and pins it in the packaging test.
test_get_radio_reuses_fresh materialized the managed playlist at the fixture's fixed NOW (2026-09-12) and then asserted the handler reused it, but the handler decides staleness with datetime.now against RADIO_STALE_DAYS (7). The suite therefore failed as soon as it ran more than a week after that constant, which would have failed the release gate too. Materialize at the current time so the test keeps testing reuse instead of the calendar.
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- keep auth token in sessionStorage so reloads stay signed in - project import_batch_id so 'View imported games' filters correctly - strip ':<id>' suffixes in job title fallback; show detected titles in setup readiness rows - drop bogus updated count from save-scan toast - collapsible Play Insights panel (persisted) - hidden sidebar sections as checkboxes instead of free text - hide Prev/Next in add-game mode Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
…ation and rollback
…report, typed schemas
…outes, 2.0 version
The Windows CI failed five files. Each was a real defect or a stale expectation, not a test-environment quirk. The rollback confirmation asked a terminal that could not answer: a console-less child gets a NUL device, so reading the prompt raised EOFError and the command died with a traceback instead of refusing. The CLI now treats an unusable stdin as non-interactive and refuses with the "--yes" hint the plan requires. A corrupt search projection kept its file handle open, and Windows refuses to unlink a file that is still open, so the projection could never be discarded. The connection is now released before the discard. The remaining three were expectations that only held on POSIX: an unreadable path needs POSIX permission bits, the stored library root is normalized to forward slashes, an expanded path carries the platform separator, and the Windows ARM64 artifact is published under the arm64 tag. Also reads a trash stamp written in UTC, so an entry restored from a backup expires like any other.
dependabot
Bot
added
the
dependencies
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
The Windows and macOS jobs still invoked scripts/check_v1_contract.py, which 2.0 replaced with check_api_contract.py, so both failed before the new gates ran. Wire the full ratchet list into all three jobs and refresh the stale v1 references in AGENTS, the Makefile, and the tree docs. The no-regression gate now compares medians. A p95 from five runs on a shared runner is one scheduler stall away from a false failure, and the 20k write median was unchanged while a single outlier failed the job. The Windows process-cleanup test now uses WaitForSingleObject instead of os.kill(pid, 0), which signals a terminated-but-unreaped process object on Windows.
The release body carries only 2.0.0. The 1.19.1 section and the stale top paragraph described the previous release, so they are gone. The changelog and AppStream entries now carry the release date.
…runners The no-regression gate compared informational measurements too. On a shared runner coverflow moved from 16 to 26 ms with no code change, so a constant-time POST failed a 10% gate. Compare the operations that carry a budget; the rest stay in the report for context. The 10k import throughput test now takes the same CI headroom as the other wall-clock tests. The Windows ARM64 runner blocks a helper freshly compiled in its temp folder, so that host-parsing test skips there; the release job still builds the real ARM64 host from the same source.
The import benchmark now allows CI overhead like the other wall-clock tests, and this gate read the old expression out of the file. The behavior test already enforces the budget; pinning the literal made a deliberate change fail on every runner.
The job measured current twice and used the second reading. Machine drift between the baseline and that late run moved the 20k library median from 55 to 64 ms, while the gated run minutes earlier matched the baseline. Write the gated report and compare it with the baseline measured in the same job, so the pair sits next to each other and one fewer suite runs.
Hiding the menu while its item holds focus hands focus to the body after the keydown handler returns, so the card focus was lost intermittently and Escape stopped returning the user to the game. Focus the current card again on the next frame, re-querying it in case a render replaced the node.
The same 1.19.1 build measured a 461 ms and an 853 ms facet median on the same shared runner in one day. A 10% gate cannot separate that noise from a regression. The fixed 10k/20k budgets remain blocking; the baseline table still runs and reports drift in the log.
The stable task is done: annotated v2.0.0 tag, both release workflows green, every artifact published and signed. The baseline perf comparison is advisory because one shared runner measured the same 1.19.1 build at 461 ms and 853 ms for the facet median.
Lead with the three 2.0 promises, add per-platform downloads and upgrade steps, and keep the breaking-change table. The publish list now carries the x86_64 native host checksum, which the build uploads and the release already verifies.
Sweep of both the app docs and the public site against the 2.0 tree: retire the deleted v1 gate from AGENTS/Makefile/CI references, correct release-note upgrade and ARM64 claims, document problem-details errors, the host channel and the portable-library symlink behavior truthfully, fix ledger/ADR/route-count drift, add the missing changelog entries, and publish the missing x86_64 host sha256 sidecar in the release workflow. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
…e advisory Lead the release with the three 2.0 promises, add per-platform downloads and the upgrade walkthrough, and correct the v1 and unversioned route wording from the docs sweep. Restore the gated perf report and the advisory baseline comparison so runner drift cannot fail CI.
Retire the v1 API bridge in favour of /api/v2-only dispatch, make backups write format 2 only while keeping format 1 restores, version every frontend API URL, and move Flatpak to runtime 51. Record the 2.1 compatibility, backup-write, Python 3.10, and Flatpak runtime policies as ADRs 0102-0106, add the 2.1 task ledger and upgrade guide, and cover the retired surfaces, deep-link readiness, and script entrypoint with tests.
Bumps [coverage](https://github.com/coveragepy/coveragepy) from 7.16.2 to 7.17.0. - [Release notes](https://github.com/coveragepy/coveragepy/releases) - [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst) - [Commits](coveragepy/coveragepy@7.16.2...7.17.0) --- updated-dependencies: - dependency-name: coverage dependency-version: 7.17.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/pip/master/coverage-7.17.0
branch
from
November 2, 2026 11:57
c040acf to
210a4e3
Compare
vindeckyy
force-pushed
the
master
branch
2 times, most recently
from
November 2, 2026 12:02
af93679 to
c284f7c
Compare
Contributor
Author
|
A newer version of coverage exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged. |
Owner
|
Closing as stale: this branch is 437 commits behind master with a failing macOS check, and coverage 7.17.0 requires Python >=3.11 while OpenBoxGL still supports Python 3.10. Keeping coverage pinned at 7.16.2 until Python 3.10 support is dropped; Dependabot can recreate this once that happens. |
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps coverage from 7.16.2 to 7.17.0.
Release notes
Sourced from coverage's releases.
Changelog
Sourced from coverage's changelog.
... (truncated)
Commits
393ac71docs: prep for 7.17.014257d3test: check that 100% files haven't lost coveragedb056acdocs: keep the ukraine banner #23446033660fix: update the data file hash when a parallel data file is saved again (#2339)99024b5fix: clamp rate in XML report to prevent false 1.0/0.0 rounding and scientifi...ff62a02refactor: remove unused caching branches24d0b67fix: KeyError for a with statement at the end of a finally clause (#2336)934f5b8chore: upgrade pip==26.2.2 certifi==2026.10.19f95c980fix: triply nestedwithstatements don't cause false branch misses #19876aaa858docs: more changelog gardening