fix(deps): bump pip-api to 0.0.35 so pip-audit runs on Python 3.15

Closed
DO
21h ago
+3-3

Summary

The required check dependency-audit / pip-audit fails on main and on every PR, including #230.

The reusable workflow (combsmith/.github dependency-audit-reusable.yml@dependency-audit/v2-stable) sets up python-version: "3.x", which now resolves to 3.15. Python 3.15 no longer ships the stdlib sre_constants module, and pip-api==0.0.34 vendors an old pyparsing that imports it:

File ".../pip_api/_vendor/pyparsing.py", line 108, in <module>
    import sre_constants
ModuleNotFoundError: No module named 'sre_constants'

pip-api 0.0.35 drops the vendored pyparsing (I checked the wheel: no sre_constants reference). Its only dependency is still pip. pip-audit==2.9.0 requires pip-api>=0.0.28, so nothing else changes. Hashes are PyPI's sha256 digests for the 0.0.35 sdist and wheel.

Not verified locally on 3.15 (no 3.15 interpreter here). This PR's own pip-audit run is the check.

Follow-up for combsmith/.github, not changed here: pinning python-version in the reusable workflow would stop the next interpreter release from breaking every consumer the same way.

šŸ¤– Generated with Claude Code

Problem

See the linked issue.

Risk

Low ā€” 1 file(s) changed; no CI- or runtime-critical paths touched.

Test plan

No test files were added or updated. Verification: bash scripts/dev-lead-lint.sh (shellcheck --severity=warning) ran pre-commit; the existing CI (bats + lint) guards the change.

Rollback

Revert this PR. No non-revertible side effects (no tags, migrations, or external state).

Monitoring

This PR's CI checks (Lint + bats) are the success/regression signal.