Skip to content

chore: fix packaging metadata, dependency alerts and Docker tag guidance - #36

Merged
marevol merged 1 commit into
mainfrom
chore/post-030-cleanup
Aug 24, 2026
Merged

chore: fix packaging metadata, dependency alerts and Docker tag guidance#36
marevol merged 1 commit into
mainfrom
chore/post-030-cleanup

Conversation

@marevol

@marevol marevol commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

Summary

Three follow-ups noticed while cutting the 0.3.0 release. No runtime code changes.

1. typer[all] is not a real extra

typer 0.16.0 publishes no all extra, so every install prints:

warning: The package `typer==0.16.0` does not have an extra named `all`

Relocking after removing it changes no resolved package, which confirms the extra
was already a no-op — plain typer pulls click, rich, shellingham and
typing-extensions on its own.

2. Dependency alerts

All nine open Dependabot alerts are transitive packages in uv.lock. Upgraded with
targeted uv lock --upgrade-package so the pinned direct dependencies
(httpx==0.28.1, pyyaml==6.0.2, typer==0.16.0) stay exactly as they are:

package before after patched at
urllib3 2.5.0 2.7.0 2.7.0 (4 alerts, high)
idna 3.11 3.19 3.15
requests 2.32.5 2.34.2 2.33.0
pytest 9.0.1 9.1.1 9.0.3
python-dotenv 1.2.1 1.2.3 1.2.2
pygments 2.19.2 2.21.0 2.20.0

3. Docker tag guidance in the skill docs was wrong

Image tags on ghcr.io/codelibs/fessctl are fessctl release versions (0.1.0,
0.2.0, 0.3.0, plus snapshot). The docs described them as tracking the Fess
version, which is selected at runtime by FESS_VERSION and has nothing to do with the
tag. The install skill's runner detection therefore built an image reference that can
never resolve:

ghcr.io/codelibs/fessctl:${FESS_VERSION:-latest}   # -> ...:15.8.0, which does not exist

There is also no latest tag on this image, so the fallback was equally broken and the
troubleshooting page recommended it too. Fixed in references/installation.md (runner
detection now pins 0.3.0; the "Choosing the Docker tag" section states what tags mean)
and references/troubleshooting.md (a missing tag fails with manifest unknown, not
denied, so both error strings are now covered).

Verification

  • uv run pytest tests/unit — 123 passed with the upgraded lockfile
  • docker pull ghcr.io/codelibs/fessctlmanifest unknown (confirms no latest tag)
  • docker run ... ghcr.io/codelibs/fessctl:0.3.0 — reports package version 0.3.0,
    default FESS_VERSION 15.8.0

Follow-ups noticed while cutting the 0.3.0 release.

- pyproject.toml: drop the typer[all] extra. typer 0.16.0 publishes no
  "all" extra, so uv warns on every install; relocking changes no
  resolved package, confirming the extra was already a no-op.
- uv.lock: refresh the transitive dependencies Dependabot flagged --
  urllib3 2.5.0 -> 2.7.0, idna 3.11 -> 3.19, requests 2.32.5 -> 2.34.2,
  pytest 9.0.1 -> 9.1.1, python-dotenv 1.2.1 -> 1.2.3 and
  pygments 2.19.2 -> 2.21.0. The pinned direct dependencies are untouched.
- skills docs: tags on ghcr.io/codelibs/fessctl are fessctl release
  versions, not Fess versions, and no "latest" tag is published. The
  detection chain built the tag out of FESS_VERSION, which names a tag
  that has never existed, and the troubleshooting page recommended the
  same thing.
@marevol
marevol merged commit da6342f into main Aug 24, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant