chore(deps): bump lizard from 1.23.0 to 1.24.1 in /.github/impact-gate in the impact-gate-minor-patch group across 1 directory

[dependabot]

Bumps the impact-gate-minor-patch group with 1 update in the /.github/impact-gate directory: lizard.

Updates lizard from 1.23.0 to 1.24.1

Release notes

Sourced from lizard's releases.

1.24.1

New Features

• Cognitive Complexity (-Ecognitive) — per-function Cognitive Complexity following SonarSource's specification (structural, hybrid, fundamental and nesting increments; switch and logical operator sequences count once; lambdas nest; direct recursion counts), with a CogC column, a --CogC threshold and a cognitive_complexity field for -s/-T. Implemented as an extension that leaves the language readers and all existing metrics untouched (issue #432)

Bug Fixes

• Python: preserve function names and signatures for PEP 695 generic functions, including nested type parameter bounds (PR #492)
• Kotlin: correctly finish expression-bodied functions and accessors, including bodies containing when expressions (issue #493)
• Rust: count match arms toward cyclomatic complexity and handle nested match expressions (issue #494)
• PHP: end trait methods at their closing brace instead of extending them to the end of the trait (issue #498)
• TypeScript and TSX: preserve function boundaries after regex arguments and template interpolations containing quoted backticks (issue #497)
• JavaScript, TypeScript, and TSX: tokenize regex literals containing quotes, escapes, and character classes without swallowing following code (PR #505)

Documentation

• Document Cognitive Complexity usage, thresholds, and language coverage
• Update contributor guidance and adopt the Open Dough agent workflow skills

Full changelog: terryyin/lizard@1.24.0...1.24.1

1.24.0

New Features

• Halstead metrics (-Ehalstead) — per-function Halstead volume, difficulty, and effort (issue #464, PR #485)
• --no-gitignore — analyze all discovered source files even when a .gitignore would exclude them (PR #488)
• PHP — modern syntax is parsed without false functions (classes, traits, visibility, constructor property promotion, match expressions, arrow functions, union types, named arguments); null-coalescing / nullsafe operators no longer inflate nesting depth (issue #491)

Bug Fixes

• Java: do not report control structures in a static block as methods (issue #312, PR #489)
• Java: count anonymous classes in field initializers (issue #311, PR #483)
• Java: treat record as a contextual keyword in field initializers and method declarations
• Java: parse generic and qualified type names in anonymous classes
• Go: register generic functions with [...] type parameters (PR #484)
• CSV: emit columns for extensions that add multiple FUNCTION_INFO fields (PR #486)
• Python: count control flow inside f-string interpolations (issue #317, PR #481)
• Script: stop a # comment continuing past a trailing backslash (issue #317, PR #482)
• Objective-C: handle nested parentheses in block / function-pointer parameter types (issue #365, PR #480)

Published to PyPI via GitHub Actions (release.yml).

Changelog

Sourced from lizard's changelog.

1.24.1

New Features

• Cognitive Complexity (-Ecognitive) — per-function Cognitive Complexity following SonarSource's specification (structural, hybrid, fundamental and nesting increments; switch and logical operator sequences count once; lambdas nest; direct recursion counts), with a CogC column, a --CogC threshold and a cognitive_complexity field for -s/-T. Implemented as an extension that leaves the language readers and all existing metrics untouched (issue #432)

Bug Fixes

• Python: preserve function names and signatures for PEP 695 generic functions, including nested type parameter bounds (PR #492)
• Kotlin: correctly finish expression-bodied functions and accessors, including bodies containing when expressions (issue #493)
• Rust: count match arms toward cyclomatic complexity and handle nested match expressions (issue #494)
• PHP: end trait methods at their closing brace instead of extending them to the end of the trait (issue #498)
• TypeScript and TSX: preserve function boundaries after regex arguments and template interpolations containing quoted backticks (issue #497)
• JavaScript, TypeScript, and TSX: tokenize regex literals containing quotes, escapes, and character classes without swallowing following code (PR #505)

Documentation

• Document Cognitive Complexity usage, thresholds, and language coverage
• Update contributor guidance and adopt the Open Dough agent workflow skills

1.24.0

New Features

• Halstead metrics (-Ehalstead) — per-function Halstead volume, difficulty, and effort (issue #464, PR #485)
• --no-gitignore — analyze all discovered source files even when a .gitignore would exclude them (PR #488)
• PHP — modern syntax is parsed without false functions (classes, traits, visibility, constructor property promotion, match expressions, arrow functions, union types, named arguments); null-coalescing / nullsafe operators no longer inflate nesting depth (issue #491)

Bug Fixes

• Java: do not report control structures in a static block as methods (issue #312, PR #489)
• Java: count anonymous classes in field initializers (issue #311, PR #483)
• Java: treat record as a contextual keyword in field initializers and method declarations
• Java: parse generic and qualified type names in anonymous classes
• Go: register generic functions with [...] type parameters (PR #484)
• CSV: emit columns for extensions that add multiple FUNCTION_INFO fields (PR #486)
• Python: count control flow inside f-string interpolations (issue #317, PR #481)
• Script: stop a # comment continuing past a trailing backslash (issue #317, PR #482)
• Objective-C: handle nested parentheses in block / function-pointer parameter types (issue #365, PR #480)

Commits

• 0488a26 Release 1.24.1
• d90c086 Fix quotes in JavaScript-style regex literals (#505)
• eb0c04d Enhance dough-execute-plan and product backlog documentation to clarify readi...
• d42634c Refine dough-execute-plan and dough-bug-fixing documentation for clarity and ...
• dc11c27 Add Cognitive Complexity metric extension (-Ecognitive) (#432) (#496)
• 69b29cd terryyin/lizard#498 Fix PHP trait methods running t...
• 1575a44 terryyin/lizard#497 Fix TypeScript function end los...
• 939f08f Enhance dough-execute-plan documentation for improved clarity and execution p...
• ae818b5 Update AGENTS.md, README.rst, and agent-map.md for improved navigation and de...
• 876c129 Enhance dough-execute-plan documentation for clarity and execution processes
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 831a029

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6b3dde26-bb97-42d3-924b-808031f04966

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[freshtonic]

Requesting changes. This PR cannot work, and the version that it installs is not allowed.

Blockers

1. The hashes did not change. Dependabot changed the pin to lizard==1.24.0 but kept the two --hash lines for 1.23.0. pip install --require-hashes stops with THESE PACKAGES DO NOT MATCH THE HASHES (expected e9111e35…/ed75cd45…, got a688bc60…). This is why Change impact (advisory) fails.
2. impact-gate 0.4.1 does not allow lizard 1.24.0. Its PyPI metadata says lizard!=1.24.0,>=1.17. Thus correct hashes do not fix this PR either. Because the job uses --no-deps, it would install a version that ImpactGate refuses. Dependabot also changed the file header, so the header now says lizard==1.24.0 (Lizard 1.24.0 is excluded by ImpactGate's own metadata), which contradicts itself.

Recommended action: Close this PR. Then add an ignore rule to the pip entry in .github/dependabot.yml, so that Dependabot does not open this PR again:

ignore:
  - dependency-name: "lizard"
    versions: ["1.24.0"]

Suggested follow-up PR

• The comment on the pip entry in .github/dependabot.yml says "Dependabot regenerates the hashes when it bumps one." That is not true for this PR. Correct the comment, or add a check that fails when a pin changes and its hashes do not.
• Dependabot cannot find the supply-chain label on any of its PRs (see its comment on each PR). Create the label, or remove it from dependabot.yml.