-
fix: improve OSSF Scorecard Pinned-Dependencies score (#1427)
frostbyte_neo 发布于
2025-12-21 21:11:17 +00:00 - fix: improve OSSF Scorecard Pinned-Dependencies score
Dockerfile:
- Pin pip==24.3.1, pdm==2.22.3, playwright==1.49.1 (was unpinned)
- Use npm ci instead of npm install for reproducible builds
- Copy package-lock.json files for test directories
Workflows:
- Pin pdm to exact version ==2.22.3 (was range >=2.20,<3)
-
chore: auto-bump version to 1.3.22
-
fix: update PDM from 2.22.3 to 2.26.2 to fix hishel 1.0.0 compatibility
PDM 2.22.3 has an incompatibility with hishel 1.0.0 which removed
the _serializers module, causing ImportError when running pdm install.PDM 2.26.2 has the fix for this issue.
- fix: update Playwright from 1.49.1 to 1.57.0
Playwright 1.49.1 fails to install chromium with exit code 100 on
the current Debian/Python 3.13 base image. Updating to 1.57.0 (latest)
to fix browser installation.- fix: add hishel<1.0.0 constraint to fix PDM compatibility
PDM 2.26.2 has a known issue with hishel 1.0.0 that causes
ImportError when running pdm install.See: https://github.com/pdm-project/pdm/issues/3657
Co-authored-by: GitHub Action action@github.com
下载附件