chore: update dependencies 2026-06-22

.gitlab-ci.yml

@@ -86,32 +86,32 @@ pytest:
     when: always
     expire_in: 7 days
 
-# dependency-update:
+dependency-update:
-#   stage: security
+  stage: security
-#   # fresh install — don't reuse cached venv since we're updating packages
+  # fresh install — don't reuse cached venv since we're updating packages
-#   cache: []
+  cache: []
-#   script:
+  script:
-#     - apt-get update -qq && apt-get install -y -qq libcap-dev git curl
+    - apt-get update -qq && apt-get install -y -qq libcap-dev git curl
-#     - pip install poetry==$POETRY_VERSION
+    - pip install poetry==$POETRY_VERSION
-#     - poetry install --without pi --no-interaction
+    - poetry install --without pi --no-interaction
-#     - chmod +x scripts/dependency_update.sh scripts/create_mr.sh
+    - chmod +x scripts/dependency_update.sh scripts/create_mr.sh
-#     # run update — exits 0 if no changes, 1 if changes found
+    # run update — exits 0 if no changes, 1 if changes found
-#     - |
+    - |
-#       set +e
+      set +e
-#       bash scripts/dependency_update.sh
+      bash scripts/dependency_update.sh
-#       UPDATE_EXIT=$?
+      UPDATE_EXIT=$?
-#       set -e
+      set -e
-#       if [ $UPDATE_EXIT -eq 1 ]; then
+      if [ $UPDATE_EXIT -eq 1 ]; then
-#         echo "Changes found — creating merge request"
+        echo "Changes found — creating merge request"
-#         bash scripts/create_mr.sh
+        bash scripts/create_mr.sh
-#       else
+      else
-#         echo "No changes — skipping merge request"
+        echo "No changes — skipping merge request"
-#       fi
+      fi
-#   rules:
+  rules:
-#     # run on push to main
+    # run on push to main
-#     - if: '$CI_COMMIT_BRANCH == "main"'
+    - if: '$CI_COMMIT_BRANCH == "main"'
-#     # run on schedule
+    # run on schedule
-#     - if: '$CI_PIPELINE_SOURCE == "schedule"'
+    - if: '$CI_PIPELINE_SOURCE == "schedule"'
-#     # never run on dependency-update branches to avoid loops
+    # never run on dependency-update branches to avoid loops
-#     - if: "$CI_COMMIT_BRANCH =~ /^dependency-updates-/"
+    - if: "$CI_COMMIT_BRANCH =~ /^dependency-updates-/"
-#       when: never
+      when: never