fix: lock pypdf to patched release

[seonghobae]

Summary

• update uv.lock from pypdf 6.9.2 to the patched 6.10.0 release that fixes GHSA-3crg-w4f6-42mx / CVE-2026-40260
• add regression coverage that fails if the checked-in lock file drops below the patched pypdf floor

Verification

• uv run pytest
• uv run pytest --cov=src/newsdom_api --cov-branch --cov-report=term-missing --cov-fail-under=100

Summary by CodeRabbit

릴리스 노트

• Tests
  • 락파일 기반 패키지 버전 검증 로직을 추가했습니다.

---

참고: 이번 변경은 내부 테스트 개선 사항이며, 최종 사용자에게 직접적인 영향은 없습니다.

[coderabbitai]

📝 Walkthrough

Walkthrough

tests/test_project_metadata.py에 패키지 버전 파싱 헬퍼 함수를 추가하고, uv.lock에서 pypdf 버전이 6.10.0 이상으로 고정되어 있는지 검증하는 테스트를 신규 추가했습니다.

Changes

Cohort / File(s)	Summary
Test Helper & Verification tests/test_project_metadata.py	_locked_package_version() 헬퍼 함수를 추가하여 uv.lock에서 특정 패키지의 의미론적 버전을 읽고 파싱합니다. 새로운 테스트 test_uv_lock_pins_pypdf_at_patched_release를 추가하여 pypdf가 최소 6.10.0 버전으로 고정되어 있는지 검증합니다.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰✨ 버전을 읽어주는 작은 친구,
Lock 파일 속 패키지를 찾아내고,
테스트의 보호막으로 정확함을 지키네!
pypdf는 안전하게, 6.10.0으로 🔒

🚥 Pre-merge checks | ✅ 1 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check	❓ Inconclusive	설명은 변경 내용과 검증 단계를 포함하지만, 저장소의 필수 템플릿에서 요구하는 'Git Flow target' 섹션이 누락되어 있습니다.	설명에 'Git Flow target' 섹션을 추가하여 이 fix/* 브랜치가 develop을 대상으로 한다는 것을 명시하세요.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Title check	✅ Passed	제목은 주요 변경 사항인 pypdf를 패치된 릴리스로 고정하는 것을 명확하게 요약하고 있습니다.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pypdf-6-10-lock

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

🧹 Nitpick comments (1)

tests/test_project_metadata.py (1)

5-12: 상대 경로 의존성 제거 권장 - 작업 디렉토리에 강한 의존성 제거

현재 코드의 정규식 자체는 uv.lock 형식과 일치하며 정상 작동하지만, Path("uv.lock")은 스크립트 실행 디렉토리에 의존합니다. 테스트를 저장소 루트 외 다른 위치에서 실행하거나 작업 디렉토리가 변경되면 실패할 수 있습니다. 절대 경로로 변경하고 TOML 파싱을 사용하면 더 견고해집니다.

제안 diff

 from pathlib import Path
-import re
+import tomllib
 
 
 def _locked_package_version(name: str) -> tuple[int, ...]:
-    text = Path("uv.lock").read_text(encoding="utf-8")
-    match = re.search(
-        rf'\[\[package\]\]\nname = "{re.escape(name)}"\nversion = "([^"]+)"',
-        text,
-    )
-    assert match is not None, f"package {name!r} missing from uv.lock"
-    return tuple(int(part) for part in match.group(1).split("."))
+    repo_root = Path(__file__).resolve().parents[1]
+    lock_data = tomllib.loads((repo_root / "uv.lock").read_text(encoding="utf-8"))
+    for pkg in lock_data.get("package", []):
+        if pkg.get("name") == name:
+            version = pkg.get("version")
+            assert isinstance(version, str), f"invalid version for package {name!r}"
+            return tuple(int(part) for part in version.split("."))
+    raise AssertionError(f"package {name!r} missing from uv.lock")

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/test_project_metadata.py` around lines 5 - 12, The helper
_locked_package_version currently reads uv.lock via Path("uv.lock") which
depends on the current working directory; change it to locate the repository
root (or use the test file's directory) and open the uv.lock with an absolute
path, and replace the regex parsing with a TOML parser to robustly extract
package version (look up the package entry for name in the parsed data and
return the version tuple). Update references inside _locked_package_version to
use the absolute path and toml.load instead of Path("uv.lock").read_text and
regex.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@tests/test_project_metadata.py`:
- Around line 5-12: The helper _locked_package_version currently reads uv.lock
via Path("uv.lock") which depends on the current working directory; change it to
locate the repository root (or use the test file's directory) and open the
uv.lock with an absolute path, and replace the regex parsing with a TOML parser
to robustly extract package version (look up the package entry for name in the
parsed data and return the version tuple). Update references inside
_locked_package_version to use the absolute path and toml.load instead of
Path("uv.lock").read_text and regex.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a81727a0-68d4-4e54-a04a-b485e2bb8fbb

📥 Commits

Reviewing files that changed from the base of the PR and between ae12473 and 06ba722.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• tests/test_project_metadata.py