build(deps): bump python-dotenv from 1.1.1 to 1.2.2 in /integration-tests

[dependabot]

Bumps python-dotenv from 1.1.1 to 1.2.2.

Release notes

Sourced from python-dotenv's releases.

v1.2.2

Added

• Support for Python 3.14, including the free-threaded (3.14t) build. (#)

Changed

• The dotenv run command now forwards flags directly to the specified command by @​bbc2 in theskumar/python-dotenv#607
• Improved documentation clarity regarding override behavior and the reference page.
• Updated PyPy support to version 3.11.
• Documentation for FIFO file support.
• Support for Python 3.9.

Fixed

• Improved set_key and unset_key behavior when interacting with symlinks by @​bbc2 in #790c5
• Corrected the license specifier and added missing Python 3.14 classifiers in package metadata by @​JYOuyang in theskumar/python-dotenv#590

Breaking Changes

• dotenv.set_key and dotenv.unset_key used to follow symlinks in some situations. This is no longer the case. For that behavior to be restored in all cases, follow_symlinks=True should be used.

• In the CLI, set and unset used to follow symlinks in some situations. This is no longer the case.

• dotenv.set_key, dotenv.unset_key and the CLI commands set and unset used to reset the file mode of the modified .env file to 0o600 in some situations. This is no longer the case: The original mode of the file is now preserved. Is the file needed to be created or wasn't a regular file, mode 0o600 is used.

Misc

• skip 000 permission tests for root user by @​burnout-projects in theskumar/python-dotenv#561
• Bump actions/checkout from 5 to 6 in the github-actions group by @​dependabot[bot] in theskumar/python-dotenv#593
• Add Windows testing to CI by @​bbc2 in theskumar/python-dotenv#604
• Improve workflow efficiency with best practices by @​theskumar in theskumar/python-dotenv#609
• Remove the use of sh in tests by @​bbc2 in theskumar/python-dotenv#612

New Contributors

• @​JYOuyang made their first contribution in theskumar/python-dotenv#590
• @​burnout-projects made their first contribution in theskumar/python-dotenv#561
• @​cpackham-atlnz made their first contribution in theskumar/python-dotenv#597

Full Changelog: theskumar/python-dotenv@v1.2.1...v1.2.2

v1.2.1

What's Changed

... (truncated)

Changelog

Sourced from python-dotenv's changelog.

[1.2.2] - 2026-03-01

Added

• Support for Python 3.14, including the free-threaded (3.14t) build. (#588)

Changed

• The dotenv run command now forwards flags directly to the specified command by [@​bbc2] in #607
• Improved documentation clarity regarding override behavior and the reference page.
• Updated PyPy support to version 3.11.
• Documentation for FIFO file support.
• Dropped Support for Python 3.9.

Fixed

• Improved set_key and unset_key behavior when interacting with symlinks by [@​bbc2] in [790c5c0]
• Corrected the license specifier and added missing Python 3.14 classifiers in package metadata by [@​JYOuyang] in #590

Breaking Changes

• dotenv.set_key and dotenv.unset_key used to follow symlinks in some situations. This is no longer the case. For that behavior to be restored in all cases, follow_symlinks=True should be used.

• In the CLI, set and unset used to follow symlinks in some situations. This is no longer the case.

• dotenv.set_key, dotenv.unset_key and the CLI commands set and unset used to reset the file mode of the modified .env file to 0o600 in some situations. This is no longer the case: The original mode of the file is now preserved. Is the file needed to be created or wasn't a regular file, mode 0o600 is used.

[1.2.1] - 2025-10-26

• Move more config to pyproject.toml, removed setup.cfg
• Add support for reading .env from FIFOs (Unix) by [@​sidharth-sudhir] in #586

[1.2.0] - 2025-10-26

• Upgrade build system to use PEP 517 & PEP 518 to use build and pyproject.toml by [@​EpicWink] in #583
• Add support for Python 3.14 by [@​23f3001135] in #579
• Add support for disabling of load_dotenv() using PYTHON_DOTENV_DISABLED env var. by [@​matthewfranglen] in #569

Commits

• 36004e0 Bump version: 1.2.1 → 1.2.2
• eb20252 docs: update changelog for v1.2.2
• 790c5c0 Merge commit from fork
• 43340da Remove the use of sh in tests (#612)
• 09d7cee docs: clarify override behavior and document FIFO support (#610)
• c8de288 ci: improve workflow efficiency with best practices (#609)
• 7bd9e3d Add Windows testing to CI (#604)
• 1baaf04 Drop Python 3.9 support and update to PyPy 3.11 (#608)
• 4a22cf8 ci: enable testing on Python 3.14t (free-threaded) (#588)
• e2e8e77 Fix license specifier (#597)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[hermes-exosphere]

✅ Auto-approved: all 4 CI checks passing. Ready to merge.

[hermes-exosphere]

Your PR is awaiting review by a moderator. Till then you can join the Discord for conversation: https://discord.gg/qaFM2uYFb

[hermes-exosphere]

Automated code review started - full review. Results will be posted here.

[hermes-exosphere]

Automated review: Approved. ✅

[hermes-exosphere]

Automated code review started - full review. Results will be posted here.

[hermes-exosphere]

⏳ [progress] Review context collected; now inspecting the complete diff, prior discussion, and validation setup.

[hermes-exosphere]

🔎 [progress] Full dependency diff and integration-test usage are under review. Next: lockfile integrity, installation, and the integration suite.

[hermes-exosphere]

🐳 Starting Docker environment... Detected state-manager/docker-compose.yml; validating the project’s containerized service before running the integration suite.

[hermes-exosphere]

✅ Build & test complete. Results:

• Dependency lock: PASS — uv lock --check and uv sync --locked --dry-run resolved 55 packages, including python-dotenv==1.2.2.
• Installation: PASS — clean uv sync --locked built both local packages and installed 52 packages.
• Lint: PASS — uv run ruff check . reported All checks passed!.
• Integration suite: PASS — 4 passed in 57.49s using Python 3.12.3 and an ephemeral MongoDB 7 container.
• Docker Compose: attempted state-manager/docker-compose.yml; validation is blocked by the repository-local missing state-manager/.env (and reports the pre-existing obsolete version attribute). The integration suite was nevertheless exercised against a healthy MongoDB 7 container.

[hermes-exosphere]

🔍 Automated Code Review

📋 Executive Summary

This Dependabot PR raises the integration-tests direct dependency python-dotenv from 1.1.1 to 1.2.2 and regenerates its uv lockfile entries. The change is narrowly scoped, the declared constraint and lock resolution agree, and the integration suite, lint, and lock validation passed. No blocking correctness, security, API, schema, or compatibility regression was found in this repository’s observed load_dotenv() usage.

---

📊 Change Architecture

graph TD
    A[integration-tests/pyproject.toml] -->|minimum version 1.2.2| B[uv resolver]
    B -->|locked artifact hashes| C[integration-tests/uv.lock]
    C -->|installs| D[python-dotenv 1.2.2]
    D -->|load_dotenv| E[Integration-test configuration]
    E -->|connects to| F[MongoDB-backed API tests]
    style A fill:#87CEEB
    style C fill:#87CEEB
    style D fill:#90EE90
    style F fill:#87CEEB

Loading

Legend: 🟢 New dependency version | 🔵 Modified project/lock metadata | 🟡 Breaking-change risk

---

🔴 Breaking Changes

✅ No repository-facing breaking changes detected.

Upstream 1.2.2 changes behavior for dotenv.set_key, dotenv.unset_key, and the dotenv set/unset CLI around symlinks and file modes. This repository’s integration-test code imports only load_dotenv() (integration-tests/conftest.py:7,102); it does not use those affected APIs. The PR does not modify database schema, endpoint contracts, public APIs, configuration keys, or serialization formats.

---

⚠️ Issues Found

None. No inline review comments were posted because there are no actionable code issues in the two changed dependency files.

---

🔬 Logical / Bug Analysis

• Reviewed every changed line in integration-tests/pyproject.toml and integration-tests/uv.lock (5 additions, 5 deletions across 2 files).
• The direct requirement (python-dotenv>=1.2.2) matches the lockfile requires-dist constraint and selected package version (1.2.2).
• The changed lockfile package URL, SHA-256 hashes, sizes, and release timestamp correspond to the Python package artifact selection produced by uv.
• uv lock --check succeeded, and uv sync --locked --dry-run resolved the expected 55-package graph without rewriting the lock.
• A clean locked installation built the local exospherehost and state-manager packages and installed python-dotenv==1.2.2.
• No code path changed, so no new races, null handling paths, resource lifetimes, API paths, or async behavior were introduced.

---

🧪 Evidence — Build & Test Results

Lock and installation output

uv 0.11.21
uv lock --check: Resolved 55 packages
uv sync --locked --dry-run: Resolved 55 packages
Would install: python-dotenv==1.2.2
uv sync --locked: Built exospherehost and state-manager
Installed 52 packages in 8.25s

Lint output

uv run ruff check .
All checks passed!

Integration-test output

platform linux -- Python 3.12.3, pytest-8.4.2
collected 4 items

test_fan_out.py::test_upsert_graph PASSED
test_health.py::test_health_endpoint PASSED
test_upsert_graph.py::test_upsert_graph PASSED
test_upsert_graph.py::test_valid_invalid_valid_upsert_graph PASSED

4 passed in 57.49s

The suite ran against a verified healthy ephemeral MongoDB 7 container (db.runCommand({ping:1}).ok returned 1). There is no web UI in this change, so browser validation is not applicable.

Docker Compose was attempted because the repository contains state-manager/docker-compose.yml. Its build/config validation could not proceed because the repository-local state-manager/.env is absent; Compose also warns that its version attribute is obsolete. This is unrelated to the modified integration-test dependency and did not prevent exercising the actual integration suite with MongoDB.

---

🔗 Issue Linkage

⚠️ No linked issue. This is a Dependabot dependency-maintenance PR; the dependency update itself provides traceability.

---

👥 Human Review Feedback

No human review feedback or inline review threads exist on this PR. There were also no unresolved hermes-exosphere review threads to resolve.

---

💡 Suggestions

• Consider replacing the integration workflow’s non-locked uv sync --group dev invocation with uv sync --locked --group dev to ensure CI verifies the committed lockfile exactly. This is outside the scope of this Dependabot update and is not blocking.
• Consider documenting or supplying a non-secret local Compose environment template for state-manager/.env so the service Compose path is reproducible for contributors. This is unrelated to the PR.

---

🏆 Verdict

VERDICT: APPROVED

[hermes-exosphere]

Automated review: Approved. ✅ Dependency constraint/lockfile integrity, lint, and the MongoDB-backed integration suite passed.

[hermes-exosphere]

Automated review: Approved. ✅