chore(deps): update dependency coverage to v7.15.4 - #252
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — trivial patch bump of the coverage dev dependency (7.15.2 → 7.15.3) in requirements-dev.txt.
Extended reasoning...
Overview
Single-line change to requirements-dev.txt, an auto-generated pip-compile lockfile. It bumps coverage (used transitively via pytest-cov) from 7.15.2 to 7.15.3, a patch release containing a warning-on-misconfiguration fix and two internal performance improvements — no breaking changes per the release notes.
Security risks
None. coverage is a dev/test-only dependency, not shipped in the published package, and does not touch auth, crypto, or any runtime code path.
Level of scrutiny
Minimal scrutiny is appropriate: this is a mechanical Renovate-generated dependency bump to a pinned dev dependency, patch version only, with no other files touched.
Other factors
No outstanding review comments in the PR timeline, no CODEOWNER-sensitive paths involved, and the diff is a single pinned version line plus the corresponding lockfile hash region.
renovate
Bot
changed the title
387a54b to
f749461
Compare
There was a problem hiding this comment.
LGTM — trivial dev-dependency patch bump.
What was reviewed: the single-line change bumping coverage (test-only dev dependency, via pytest-cov) from 7.15.2 to 7.15.4 in the lockfile; confirmed no other lines changed and no production code or dependencies are affected.
Extended reasoning...
Overview
This PR is an automated Renovate dependency update that bumps the coverage package pin in requirements-dev.txt from 7.15.2 to 7.15.4. The diff touches exactly one line in one autogenerated lockfile; no application code, configuration, or CI workflow files are modified.
Security risks
None. coverage is a dev/test-only dependency (used transitively via pytest-cov) and is never included in the shipped package or runtime environment. The upstream changelog for 7.15.3/7.15.4 lists only minor fixes (HTML report escaping, LCOV control-character handling, sysmon/dynamic-contexts warning, performance improvements, Python 3.15 wheels) — none of which affect this repo's usage since it doesn't ship coverage reports as untrusted output.
Level of scrutiny
Minimal scrutiny is appropriate: this is a mechanical, autogenerated lockfile change with a single version pin bump, no ambiguity, and no risk to production behavior.
Other factors
No CODEOWNER-sensitive paths or security-sensitive code are touched. No prior review comments exist on this PR that need addressing.
This PR contains the following updates:
==7.15.2→==7.15.4Release Notes
coveragepy/coveragepy (coverage)
v7.15.4Compare Source
Fix: in the HTML report, a source file name containing a double quote (legal
on POSIX) wasn't escaped where it's dropped into the
hrefof the indexand prev/next links, so it could close the attribute early and inject markup.
Page URLs are now escaped. Thanks,
Rajath Mohare <pull 2227_>_.Fix: the LCOV report wrote file names and other fields into its
line-oriented records without neutralizing control characters. A measured
file whose name contained a newline (legal on POSIX) could forge extra
records, inflating the coverage seen by tools that read the report. Control
characters in a field are now replaced. Thanks,
Rajath Mohare <pull 2226_>_.Wheels are now provided for Python 3.15.
.. _pull 2226: #2226
.. _pull 2227: #2227
.. _changes_7-15-3:
v7.15.3Compare Source
Fix: the sysmon core is incompatible with dynamic contexts. Previously, the
combination would be prevented when read from the coverage.py configuration.
But using the context API as pytest-cov does, contexts would be silently
dropped. Now a warning is issued, thanks to
Jisang Han <pull 2234_>.Closes
issue 2200.A performance improvement in the low-level line number bookkeeping when
combining data files, thanks to
Kevin Turcios <pull 2239_>_.Performance improvement in HTML reporting by reducing the number of times
files have to be parsed, thanks to
Kevin Turcios <pull 2240_>_... _issue 2200: #2200
.. _pull 2234: #2234
.. _pull 2239: #2239
.. _pull 2240: #2240
.. _changes_7-15-2:
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.