ci: revert importlib-metadata to 8.7.1 to fix Semgrep install

The Dependabot bump to 10.1.0 (#6059) conflicts with the pinned opentelemetry-api 1.37.0 (importlib-metadata<8.8.0), so the Semgrep job failed with ResolutionImpossible. Ignore importlib-metadata in Dependabot since semgrep pins it indirectly. Signed-off-by: Niels Lohmann <mail@nlohmann.me>
2026-11-11 06:31:33 +00:00 · 2026-11-11 07:03:32 +01:00
2 changed files with 4 additions and 3 deletions
@@ -67,3 +67,4 @@ updates:
      - dependency-name: mcp
      - dependency-name: boltons
      - dependency-name: "opentelemetry-*"
+      - dependency-name: importlib-metadata
@@ -391,9 +391,9 @@ httpx-sse==0.4.3 \
 idna==3.20 \
    --hash=sha256:a7db850025b95ded1eae8a46181a1a6c56c92c96f0e2b005d9ff8dc0210cab44 \
    --hash=sha256:ab7ae7122974553370f0bdb919e1a960b2cd1bc1ef0276416d896db81c14582c
-importlib-metadata==10.1.0 \
-    --hash=sha256:82b04047fa09792c1a8cfeddfe08bec79e4b13c29c8469b0d3949860f61017e8 \
-    --hash=sha256:cf45ce66a929c64e994185a809c04840d0501db17e663810d993d0f4829265c7
+importlib-metadata==8.7.1 \
+    --hash=sha256:49fef1ae6440c182052f407c8d34a68f72efc36db9ca90dc0113398f2fdde8bb \
+    --hash=sha256:5a1f80bf1daa489495071efbb095d75a634cf28a8bc299581244063b53176151
 jsonschema==4.25.1 \
    --hash=sha256:3fba0169e345c7175110351d456342c364814cfcf3b964ba4587f22915230a63 \
    --hash=sha256:e4a9655ce0da0c0b67a085847e00a3a51449e1157f4f75e9fb5aa545e122eb85