CI: dependabot pyasn updates

[mr-tz]

In extension to #2824

Via @Maijin

For the pyasn actually a better fix is that you can change the rule to adapt the frequency based on vivisect release frequency if you control it. Or alternatively, create an inter-dependancy.

[Eshaan-byte]

Hi @mr-tz can I work on this issue? Thank you!

[ritikyadav1333-gif]

Hi @mr-tz,

I hope you're doing well. I’m Ritik Kumar Yadav, a beginner contributor and I’d love to work on this issue since it’s labeled as a good first issue. It looks like a great opportunity for me to understand the CI and Dependabot workflow better.

If it’s okay, could you please assign this issue to me? I’ll do my best to follow the existing contribution guidelines and keep you updated on my progress.

Thank you!

[codebynikhil08]

Hi @mr-tz
I think can solve this issue.

[jaiswalism]

Hi @mr-tz,
I’ll take a look at this.
I’m planning to group pyasn and vivisect in dependabot.yml so they’re updated together, rather than adjusting the update frequency. That should help avoid version mismatches and reduce unnecessary CI failures.
I’ll put up a PR shortly.

[jaiswalism]

Hi @mr-tz,
Quick follow-up, I noticed that PR #2830 already added a vivisect group that includes pyasn1 and pyasn1-modules.

Just wanted to check: is the issue that the current grouping isn’t working as expected, or is there another change you had in mind?

[mr-tz]

Yeah, the current implementation fails. We don't control vivisect but they have some dependency boundaries we'd like to cover with a proper fix.

[jaiswalism]

Ahh okay, so it’s not about grouping, but about keeping pyasn1 within the version range that vivisect expects.

I’ll dig into vivisect’s dependency constraints and come back with a proper fix that respects those boundaries instead of just tweaking the grouping.

[jaiswalism]

Hey @mr-tz,

I’ve been digging into this a bit more, and instead of trying to tweak Dependabot again, I think it’s cleaner to enforce the limit in the project itself.

I’ll add pyasn1>=0.5.1,<0.6.0 to pyproject.toml so the constraint is defined at the metadata level. I’ll also add a pip check step in CI so if anything breaks vivisect’s requirements in the future, the workflow fails right away. And I’ll keep requirements.txt aligned with the same range.

That way it’s enforced by the project and CI, not just the bot.

If that sounds good, I’ll open a PR.

[mr-tz]

hm, do you think that's worth any additional trouble - ie the benefits outweigh the extra work here?

[mike-hunhoff]

I believe this has been addressed in #2939. Let's not over complicate things unless this issue pops up again.