TEST-INFRA: [dependency-security] Pinned 'behave' dependency #4430

Open
opened 2026-04-08 12:32:57 +00:00 by HAL9000 · 0 comments
Owner

Metadata

  • Branch: chore/unpin-behave-dependency
  • Commit Message: chore: relax pinned behave dependency to allow non-breaking updates
  • Milestone: (backlog — see note below)
  • Parent Epic: #2810

Summary

The behave dependency is pinned to an exact version (behave==1.3.3) in pyproject.toml. While this ensures reproducible test execution, it prevents the project from receiving important updates — including security patches and bug fixes — without a manual intervention.

The fix is to relax the version specifier to a minimum-version constraint (e.g., behave>=1.3.3) so that compatible updates are automatically eligible, while still guaranteeing the minimum required version is present.

Subtasks

  • Audit current behave==1.3.3 pin in pyproject.toml and confirm no breaking changes exist in newer releases
  • Update the version specifier to behave>=1.3.3 (or a bounded range such as behave>=1.3.3,<2.0) in pyproject.toml
  • Run nox -e unit_tests to confirm all Behave-based unit tests still pass after the change
  • Run nox -e coverage_report to confirm coverage remains >= 97%
  • Run full nox suite to confirm no regressions across all quality gates
  • Update uv.lock / lockfile if applicable

Definition of Done

  • pyproject.toml no longer pins behave to an exact version
  • The relaxed specifier allows pip/uv to resolve newer compatible releases
  • All nox sessions pass (lint, typecheck, unit_tests, integration_tests, coverage_report)
  • Coverage >= 97%
  • PR merged and linked issue closed

Backlog note: This issue was discovered during autonomous operation
on milestone v3.5.0. It does not block milestone completion and has been
placed in the backlog for human review and future milestone assignment.


Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: new-issue-creator

## Metadata - **Branch**: `chore/unpin-behave-dependency` - **Commit Message**: `chore: relax pinned behave dependency to allow non-breaking updates` - **Milestone**: *(backlog — see note below)* - **Parent Epic**: #2810 ## Summary The `behave` dependency is pinned to an exact version (`behave==1.3.3`) in `pyproject.toml`. While this ensures reproducible test execution, it prevents the project from receiving important updates — including security patches and bug fixes — without a manual intervention. The fix is to relax the version specifier to a minimum-version constraint (e.g., `behave>=1.3.3`) so that compatible updates are automatically eligible, while still guaranteeing the minimum required version is present. ## Subtasks - [ ] Audit current `behave==1.3.3` pin in `pyproject.toml` and confirm no breaking changes exist in newer releases - [ ] Update the version specifier to `behave>=1.3.3` (or a bounded range such as `behave>=1.3.3,<2.0`) in `pyproject.toml` - [ ] Run `nox -e unit_tests` to confirm all Behave-based unit tests still pass after the change - [ ] Run `nox -e coverage_report` to confirm coverage remains >= 97% - [ ] Run full `nox` suite to confirm no regressions across all quality gates - [ ] Update `uv.lock` / lockfile if applicable ## Definition of Done - [ ] `pyproject.toml` no longer pins `behave` to an exact version - [ ] The relaxed specifier allows `pip`/`uv` to resolve newer compatible releases - [ ] All `nox` sessions pass (lint, typecheck, unit_tests, integration_tests, coverage_report) - [ ] Coverage >= 97% - [ ] PR merged and linked issue closed > **Backlog note:** This issue was discovered during autonomous operation > on milestone v3.5.0. It does not block milestone completion and has been > placed in the backlog for human review and future milestone assignment. --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: new-issue-creator
HAL9000 self-assigned this 2026-04-08 12:38:50 +00:00
HAL9000 added this to the v3.5.0 milestone 2026-04-08 17:42:28 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference
cleveragents/cleveragents-core#4430
No description provided.