[WIP] Update Pants lockfiles to match dependency changes

[Copilot]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

Original prompt

Context

PR #3818 (dependabot/pip/actions/gcp/setup/dependencies-441176d5a0) bumps dependencies in 3 requirements.txt files:

• actions/gcp/setup/requirements.txt - updates google-auth-httplib2, gsutil, multidict, propcache, yarl
• ci/requirements.txt - updates multidict, propcache, yarl (same packages as above, plus more)
• py/deps/requirements.txt - updates aiodocker (0.25.0→0.26.0), protobuf (6.33.5→7.34.0), pytz (2025.2→2026.1.post1), types-protobuf, types-pytz, yarl (1.22.0→1.23.0), setuptools (82.0.0→82.0.1)

Problem

The repository uses Pants for build tooling, and has Pants lockfiles that need to be regenerated to match the updated dependencies. The key lockfile that needs regeneration is:

• py/deps/deps.lock — This lockfile was generated by pants generate-lockfiles --resolve=deps and contains pinned versions for all Python dependencies. It currently references the OLD versions (e.g. aiodocker==0.25.0, protobuf==6.33.5, pytz==2025.2, yarl==1.22.0) that the dependabot PR is updating.

What needs to be done

1. Regenerate the Pants lockfiles by running: pants generate-lockfiles --resolve=deps
   • This regenerates py/deps/deps.lock to match the updated py/deps/requirements.txt
2. Check if any other Pants lockfiles reference the bumped packages and need regeneration as well (e.g. .flake8.lock, py/deps/flake8/flake8.lock, py/deps/mypy/mypy.lock, py/deps/pytest/pytest.lock, etc.)
3. Commit the regenerated lockfile(s) to the branch dependabot/pip/actions/gcp/setup/dependencies-441176d5a0

The Pants lockfiles are JSON-format files with metadata headers. They are located at paths like:

• py/deps/deps.lock (main deps lockfile — this is the critical one)
• py/deps/flake8/flake8.lock
• py/deps/mypy/mypy.lock
• py/deps/pytest/pytest.lock
• py/deps/docformatter/docformatter.lock
• .flake8.lock

To regenerate, install pants (via ./get-pants.sh) and run:

pants generate-lockfiles

Or to regenerate just the deps resolve:

pants generate-lockfiles --resolve=deps

The pants configuration should be in pants.toml at the repository root.

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: this pr needs pants lock regen please do it

Assistant:

I'll look at the PR details and understand the repository structure to create the right solution for regenerating Pants lock files.

Assistant: Now I understand the setup. The envoyproxy/toolshed repository uses Pants as a build system, and the Pants lock files need to be regenerated after the dependency bumps in this PR. The lock files are in py/deps/ and the root directory (.flake8.lock, etc.), and they are regenerated with pants generate-lockfiles.

Let me look at the specific lock file that needs updating and how the deps resolve works:

Assistant: I can see the issue now. The Dependabot PR updates requirements.txt files in 3 directories, but the Pants lock file (py/deps/deps.lock) is not updated by Dependabot. The lock file still references the old versions (e.g., aiodocker==0.25.0, protobuf==6.33.5, pytz==2025.2, yarl==1.22.0, etc.) while the py/deps/requirements.txt has been bumped to newer versions.

The Pants lock needs to be regenerated to match the updated requirements.txt files. This requires running pants generate-lockfiles --resolve=deps in the repo's development environment, which I cannot do directly — it needs to be run in a local checkout or CI environment with Pants installed.

Here's what needs to happen:

The py/deps/deps.lock file is out of sync with py/deps/requirements.txt.

The Dependabot PR bumps these packages in py/deps/requirements.txt:

• aiodocker: 0.25.0 → 0.26.0
• protobuf: 6.33.5 → 7.34.0
• pytz: 2025.2 → 2026.1.post1
• types-protobuf: 6.32.1.20251210 → 6.32.1.20260221
• types-pytz: 2025.2.0.20251108 → 2026.1.1.20260304
• setuptools: 82.0.0 → 82.0.1
• yarl: 1.22.0 → 1.23.0
• multidict: 6.1.0/6.7.1 → 6.7.1 (already current in lock)
• propcache: 0.2.0/0.4.1 → 0.4.1 (already current in lock)

But the Pants lockfile at py/deps/deps.lock still has the old version pins in its metadata header (lines 19, 70, 82, 87, 106, 108, 121), and the actual locked artifact entries also reflect old versions.

To regenerate the lock, you need to:

1. Check out the PR branch locally:

   git fetch origin dependabot/pip/actions/gcp/setup/dependencies-441176d5a0
   git checkout dependabot/pip/actions/gcp/setup/dependencies-441176d5a0

2. Run the Pants lock regeneration:

   pants generate-lockfiles --resolve=deps

3. Commit and push the updated py/deps/deps.lock:

   git add py/deps/deps.lock
   git commit -m "Regenerate Pants lock file for deps resolve"
   git push

Note: I can't run pants generate-lockfiles for you since it requires the Pants build tool to resolve dependencies against PyPI. This must...

This pull request was created from Copilot chat.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.