chore(python): bump `munch` to avoid `UserWarning`
What the developer wrote
Authored by Roman Zeyde
chore(python): bump `munch` to avoid `UserWarning`
[no changelog]
What changed, and why it matters
This commit simply updates a Python helper library called 'munch' from version 2.x to version 4.x in the project's dependency files. The stated reason is to remove a harmless user warning. There is no indication this change fixes or introduces a security problem.
No security action needed. Treat as routine dependency maintenance. If desired, verify that the project still builds and tests pass with munch 4.0.0.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff changes the ‘munch’ dependency specifier in pyproject.toml from ‘>=2.3.2,<3’ to ‘>=4,<5’ and updates the corresponding locked entry in uv.lock from 2.5.0 to 4.0.0. The new version drops the ‘six’ compatibility dependency. The commit message labels this as a chore to avoid a UserWarning and explicitly includes ‘[no changelog]’. No code changes are present.
Changed components
pyproject.tomluv.lockInspect captured patch +5 / −8
diff --git a/pyproject.toml b/pyproject.toml
index 5a6737792..1125cb53d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -29,7 +29,7 @@ dependencies = [
"flake8>=7",
"black>=24.2",
"mako>=1.0.7,<2",
- "munch>=2.3.2,<3",
+ "munch>=4,<5",
"autoflake",
"flake8-requirements>=2.1.0",
"pylint~=2.11",
diff --git a/uv.lock b/uv.lock
index e42c9fea6..78d2cbed9 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1005,14 +1005,11 @@ wheels = [
[[package]]
name = "munch"
-version = "2.5.0"
+version = "4.0.0"
source = { registry = "https://pypi.org/simple" }
-dependencies = [
- { name = "six" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/43/a1/ec48010724eedfe2add68eb7592a0d238590e14e08b95a4ffb3c7b2f0808/munch-2.5.0.tar.gz", hash = "sha256:2d735f6f24d4dba3417fa448cae40c6e896ec1fdab6cdb5e6510999758a4dbd2", size = 17015, upload-time = "2019-10-30T09:56:08.621Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e7/2b/45098135b5f9f13221820d90f9e0516e11a2a0f55012c13b081d202b782a/munch-4.0.0.tar.gz", hash = "sha256:542cb151461263216a4e37c3fd9afc425feeaf38aaa3025cd2a981fadb422235", size = 19089, upload-time = "2023-07-01T09:49:35.98Z" }
wheels = [
- { url = "https://files.pythonhosted.org/packages/cc/ab/85d8da5c9a45e072301beb37ad7f833cd344e04c817d97e0cc75681d248f/munch-2.5.0-py2.py3-none-any.whl", hash = "sha256:6f44af89a2ce4ed04ff8de41f70b226b984db10a91dcc7b9ac2efc1c77022fdd", size = 10347, upload-time = "2019-10-30T09:56:06.835Z" },
+ { url = "https://files.pythonhosted.org/packages/56/b3/7c69b37f03260a061883bec0e7b05be7117c1b1c85f5212c72c8c2bc3c8c/munch-4.0.0-py2.py3-none-any.whl", hash = "sha256:71033c45db9fb677a0b7eb517a4ce70ae09258490e419b0e7f00d1e386ecb1b4", size = 9950, upload-time = "2023-07-01T09:49:34.472Z" },
]
[[package]]
@@ -2067,7 +2064,7 @@ requires-dist = [
{ name = "isort", specifier = ">=5,<6" },
{ name = "mako", specifier = ">=1.0.7,<2" },
{ name = "mnemonic", specifier = ">=0.21,<0.22" },
- { name = "munch", specifier = ">=2.3.2,<3" },
+ { name = "munch", specifier = ">=4,<5" },
{ name = "nanopb", specifier = ">=0.4.3,<0.5" },
{ name = "noiseprotocol", specifier = ">=0.3.1,<0.4" },
{ name = "pillow", specifier = ">=11" },
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.