Skip to content

Update dependency prompt-toolkit to v3.0.53 #1368

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update dependency prompt-toolkit to v3.0.53 #1368

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion requirements-test.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -968,7 +968,7 @@ pluggy==1.6.0 \
# via
# pytest
# pytest-cov
prompt-toolkit==3.0.52 \
prompt-toolkit==3.0.53 \

@fullsend-ai-review fullsend-ai-review Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] hash-mismatch

Same issue as requirements.txt: the hyphenated entry prompt-toolkit has its version bumped to 3.0.53 but retains the 3.0.52 hashes (28cde192... and 9aac639a...) on lines 972-973, while a new duplicate underscore entry prompt_toolkit==3.0.53 is appended at line 1532 with the correct 3.0.53 hashes (01c0891d... and 9ec8a0ad...). This will cause hash verification failures or duplicate-entry errors during pip install --require-hashes.

Suggested fix: Re-run pip-compile --allow-unsafe --generate-hashes to regenerate the test requirements file cleanly.

@fullsend-ai-review fullsend-ai-review Bot Aug 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] hash mismatch / duplicate dependency entry

Same issue as requirements.txt: the PR bumps prompt-toolkit from 3.0.52 to 3.0.53 at line 971 but leaves the old v3.0.52 hashes (28cde192..., 9aac639a...) unchanged. A duplicate prompt_toolkit==3.0.53 entry at line 1532 carries the correct v3.0.53 hashes. This creates the same duplicate-entry / conflicting-hash problem that will cause pip hash verification failures.

Suggested fix: Regenerate requirements-test.txt with pip-compile --generate-hashes to produce a single, correctly-hashed prompt-toolkit==3.0.53 entry. Alternatively, manually remove the duplicate prompt_toolkit entry at line 1532 and replace the stale hashes at lines 972-973 with the correct v3.0.53 hashes.

@fullsend-ai-review fullsend-ai-review Bot Aug 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] hash-mismatch

Same issue as requirements.txt: the version string for prompt-toolkit was bumped to 3.0.53 but the hashes remain those of 3.0.52. A duplicate entry prompt_toolkit==3.0.53 with different hashes is appended at line 1532, creating an invalid requirements file with two entries for the same package.

Suggested fix: Remove the duplicate prompt_toolkit==3.0.53 entry at lines 1532-1534. Update the hashes on the existing prompt-toolkit==3.0.53 entry at line 971 to the correct 3.0.53 hashes. Re-running pip-compile would produce the correct output.

@fullsend-ai-review fullsend-ai-review Bot Aug 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] hash-mismatch

Same issue as requirements.txt: the prompt-toolkit==3.0.53 entry retains the old 3.0.52 hashes while a duplicate prompt_toolkit==3.0.53 entry appended at line ~1532 carries the actual 3.0.53 hashes. This creates a duplicate-with-stale-hashes situation.

Suggested fix: Keep a single prompt-toolkit==3.0.53 entry with the correct 3.0.53 hashes and remove the duplicate prompt_toolkit==3.0.53 block at the end of the file.

@fullsend-ai-review fullsend-ai-review Bot Sep 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] logic-error

Same Renovate bot error: version string bumped from 3.0.52 to 3.0.53 but hashes not updated. A duplicate 'prompt_toolkit==3.0.53' entry appended at line 1532 with the correct hashes.

Suggested fix: Remove the duplicate prompt_toolkit==3.0.53 block at line 1532. Replace the stale hashes on the existing entry (lines 972-973) with the correct 3.0.53 hashes. Alternatively, re-run pip-compile to regenerate the file cleanly.

@fullsend-ai-review fullsend-ai-review Bot Sep 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] stale hashes / hash mismatch

The version pin for prompt-toolkit was bumped from 3.0.52 to 3.0.53, but the two hashes on lines 972-973 (sha256:28cde192... and sha256:9aac639a...) are the old 3.0.52 hashes carried over unchanged from the base branch. A separate duplicate entry prompt_toolkit==3.0.53 with the correct new hashes (sha256:01c0891d... and sha256:9ec8a0ad...) was appended at line 1532. pip normalizes both names identically and unions hashes across duplicate entries, so all four hashes (two stale, two correct) will be accepted -- the stale 3.0.52 hashes remain valid for hash verification, which is a supply-chain security concern. Additionally, the duplicate entry uses underscore naming (prompt_toolkit) inconsistent with the rest of the file.

Suggested fix: Replace the stale hashes on the prompt-toolkit==3.0.53 entry (lines 972-973) with the correct 3.0.53 hashes (sha256:01c0891d... and sha256:9ec8a0ad...), and remove the duplicate prompt_toolkit==3.0.53 block appended at lines 1532-1534. Alternatively, re-run pip-compile to regenerate the file cleanly.

--hash=sha256:28cde192929c8e7321de85de1ddbe736f1375148b02f2e17edd840042b1be855 \

@fullsend-ai-review fullsend-ai-review Bot Sep 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] stale hashes / incorrect hash association

Same issue as requirements.txt: prompt-toolkit was bumped to 3.0.53 but the hashes remain from 3.0.52. The correct hashes exist only in the duplicate prompt_toolkit entry at EOF.

Suggested fix: Update the hashes on lines 972-973 to the correct 3.0.53 hashes and remove the duplicate prompt_toolkit==3.0.53 entry appended at the end of the file.

--hash=sha256:9aac639a3bbd33284347de5ad8d68ecc044b91a762dc39b7c21095fcd6a19955
# via
Expand Down Expand Up @@ -1529,3 +1529,6 @@ setuptools==83.0.0 \
--hash=sha256:025bccbbf0fa05b6192bc64ae1e7b16e001fd6d6d4d5de03c97b1c1ade523bef \
--hash=sha256:29b23c360f22f414dc7336bb39178cc7bcbf6021ed2733cde173f09dba19abb3
# via -r requirements-test.in
prompt_toolkit==3.0.53 \

@fullsend-ai-review fullsend-ai-review Bot Sep 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] naming-convention

Same duplicate naming inconsistency as requirements.txt: 'prompt-toolkit' (hyphen, line 971) and 'prompt_toolkit' (underscore, line 1532) both at 3.0.53 with different hash sets.

Suggested fix: Remove the appended 'prompt_toolkit==3.0.53' block and retain only the canonical hyphen-named entry with corrected hashes.

--hash=sha256:01c0891d7f9237d5e339f7d3e42cdae80b7534abb1c7c0e3352efba6231492f2 \
--hash=sha256:9ec8a0ad96d5c56148b3f914aa79c1564c3fde5d2e6b876e7bc327e353cf8fa6
5 changes: 4 additions & 1 deletion requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -787,7 +787,7 @@ packaging==26.2 \
# opentelemetry-instrumentation
# opentelemetry-instrumentation-flask
# opentelemetry-instrumentation-sqlalchemy
prompt-toolkit==3.0.52 \
prompt-toolkit==3.0.53 \

@fullsend-ai-review fullsend-ai-review Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] hash-mismatch

The version on the hyphenated entry prompt-toolkit is bumped from 3.0.52 to 3.0.53, but the hash values on lines 791-792 are NOT updated — they remain the hashes for 3.0.52 (28cde192... and 9aac639a...). A new underscore-named duplicate entry prompt_toolkit==3.0.53 is appended at line 1299 with the correct 3.0.53 hashes (01c0891d... and 9ec8a0ad...). Under PEP 503 name normalization these are the same package, creating a duplicate entry with conflicting hashes. This will cause pip install --require-hashes to fail.

Suggested fix: Re-run pip-compile --generate-hashes to regenerate the requirements file cleanly, producing a single prompt-toolkit==3.0.53 entry with the correct hashes.

@fullsend-ai-review fullsend-ai-review Bot Aug 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] hash mismatch / duplicate dependency entry

The PR bumps prompt-toolkit from 3.0.52 to 3.0.53 at line 790 but leaves the old v3.0.52 hashes (28cde192..., 9aac639a...) unchanged on the existing entry (they are context lines in the diff, not modified). A duplicate prompt_toolkit==3.0.53 entry (underscore name variant) is appended at line 1299 with different hashes (01c0891d..., 9ec8a0ad...). pip normalizes both names to the same package, resulting in duplicate entries with conflicting hash sets. Depending on pip version behavior with duplicates, installation may fail with hash verification errors or reject the file as malformed.

Suggested fix: Regenerate requirements.txt with pip-compile --generate-hashes to produce a single, correctly-hashed prompt-toolkit==3.0.53 entry. Alternatively, manually remove the duplicate prompt_toolkit entry at line 1299 and replace the stale hashes at lines 791-792 with the correct v3.0.53 hashes.

@fullsend-ai-review fullsend-ai-review Bot Aug 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] hash-mismatch

The version string for prompt-toolkit was bumped to 3.0.53 but the hashes were NOT updated — they still contain the hashes for 3.0.52 (sha256:28cde192929c8e7321de85de1ddbe736f1375148b02f2e17edd840042b1be855 and sha256:9aac639a3bbd33284347de5ad8d68ecc044b91a762dc39b7c21095fcd6a19955). pip's hash-checking mode will fail at install time. Additionally, a duplicate entry prompt_toolkit==3.0.53 (underscore-normalized name) was appended at line 1299 with the correct 3.0.53 hashes, creating an invalid requirements file with two entries for the same package.

Suggested fix: Remove the duplicate prompt_toolkit==3.0.53 entry at lines 1299-1301. Update the hashes on the existing prompt-toolkit==3.0.53 entry at line 790 to the correct 3.0.53 hashes. Ideally, re-run pip-compile to regenerate the lockfile correctly.

@fullsend-ai-review fullsend-ai-review Bot Aug 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] hash-mismatch

The version was bumped from 3.0.52 to 3.0.53 on the prompt-toolkit entry but the hashes were not updated — they still correspond to the 3.0.52 release (28cde1..., 9aac63...). Additionally, a duplicate entry using the underscore variant prompt_toolkit==3.0.53 was appended at the end of the file (line ~1299) with the correct 3.0.53 hashes (01c089..., 9ec8a0...). pip normalizes both names identically (PEP 503), creating two entries for the same package with conflicting hash sets.

Suggested fix: Keep a single prompt-toolkit==3.0.53 entry with the correct 3.0.53 hashes (01c0891d... and 9ec8a0ad...) and remove the duplicate prompt_toolkit==3.0.53 block at the end of the file.

@fullsend-ai-review fullsend-ai-review Bot Sep 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] logic-error

Renovate bot bumped the version string from 3.0.52 to 3.0.53 on the existing entry but left the hashes unchanged — they still correspond to version 3.0.52. A duplicate entry 'prompt_toolkit==3.0.53' (underscore form) was appended at line 1299 with different hashes that are the correct 3.0.53 hashes. This creates stale hashes on the primary entry and a duplicate with inconsistent naming.

Suggested fix: Remove the duplicate prompt_toolkit==3.0.53 block at line 1299. Replace the stale hashes on the existing prompt-toolkit==3.0.53 entry (lines 791-792) with the correct 3.0.53 hashes. Alternatively, re-run pip-compile to regenerate the file cleanly.

@fullsend-ai-review fullsend-ai-review Bot Sep 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] stale hashes / hash mismatch

Same pattern as requirements-test.txt: the version pin for prompt-toolkit was bumped to 3.0.53 but the accompanying hashes on lines 791-792 are still the old 3.0.52 hashes (confirmed identical to base branch). A duplicate entry prompt_toolkit==3.0.53 with the correct hashes was appended at line 1299 using underscore naming inconsistent with the rest of the file. pip will union all four hashes, leaving the stale 3.0.52 hashes accepted.

Suggested fix: Replace the stale hashes on the prompt-toolkit==3.0.53 entry (lines 791-792) with the correct 3.0.53 hashes (sha256:01c0891d... and sha256:9ec8a0ad...), and remove the duplicate prompt_toolkit==3.0.53 block at lines 1299-1301. Alternatively, re-run pip-compile to regenerate the file cleanly.

--hash=sha256:28cde192929c8e7321de85de1ddbe736f1375148b02f2e17edd840042b1be855 \

@fullsend-ai-review fullsend-ai-review Bot Sep 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] stale hashes / incorrect hash association

The version of prompt-toolkit was bumped from 3.0.52 to 3.0.53, but the hashes were NOT updated — they are still the 3.0.52 hashes (28cde1..., 9aac63...). The correct 3.0.53 hashes (01c089..., 9ec8a0...) were appended as a separate duplicate entry at EOF under the underscore-normalized name prompt_toolkit==3.0.53. While pip currently installs successfully because it sees both hash sets, the primary entry carries stale hashes that widen the accepted hash set, weakening supply-chain integrity. If the duplicate entry is ever removed, installation will break.

Suggested fix: Update the hashes on lines 791-792 to the correct 3.0.53 hashes and remove the duplicate prompt_toolkit==3.0.53 entry appended at the end of the file.

--hash=sha256:9aac639a3bbd33284347de5ad8d68ecc044b91a762dc39b7c21095fcd6a19955
# via click-repl
Expand Down Expand Up @@ -1296,3 +1296,6 @@ zipp==3.23.1 \
--hash=sha256:0b3596c50a5c700c9cb40ba8d86d9f2cc4807e9bedb06bcdf7fac85633e444dc \
--hash=sha256:32120e378d32cd9714ad503c1d024619063ec28aad2248dc6672ad13edfa5110
# via importlib-metadata
prompt_toolkit==3.0.53 \

@fullsend-ai-review fullsend-ai-review Bot Sep 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] naming-convention

Two entries exist for the same package using inconsistent naming: 'prompt-toolkit' (hyphen, line 790) and 'prompt_toolkit' (underscore, line 1299), both at version 3.0.53 with different hash sets. The established convention uses hyphens. The duplicate underscore-named entry is a Renovate artifact.

Suggested fix: Remove the appended 'prompt_toolkit==3.0.53' block and merge any needed hashes into the single canonical hyphen-named entry.

--hash=sha256:01c0891d7f9237d5e339f7d3e42cdae80b7534abb1c7c0e3352efba6231492f2 \
--hash=sha256:9ec8a0ad96d5c56148b3f914aa79c1564c3fde5d2e6b876e7bc327e353cf8fa6
Loading