Summary
The fuzz (address, 30s) ClusterFuzzLite check fails on every PR against current main. It fails at build time — no fuzz target ever runs, so the job provides no fuzzing coverage at all right now.
+ pip3 install --no-cache-dir .
ERROR: Package 'aemo-mdff-reader' requires a different Python: 3.11.13 not in '>=3.12'
root - ERROR - Building fuzzers failed.
Cause
feat!: drop Python 3.11 support (#70) raised requires-python to >=3.12 (pyproject.toml:22), but the ClusterFuzzLite builder runs the oss-fuzz-base/base-builder-python image, which ships Python 3.11.13. .clusterfuzzlite/build.sh does pip3 install . against that interpreter, which now refuses the package.
This is consistent with the history: fuzz runs were green on every dependabot base-builder bump before #70 landed, and have failed since.
Why it matters
- It is not a required status check, so it doesn't block merges — which makes it easy to normalise as "the fuzz one always fails" and miss a genuine crash later.
- Fuzzing coverage is currently zero despite the job appearing to run.
Possible fixes
- Pin the fuzz job to a
base-builder-python variant with Python >= 3.12 (may need an upstream image that ships it).
- Install with an interpreter override / build the fuzz env from a 3.12 base rather than the stock image.
- If the stock image is stuck on 3.11 for now, relax
requires-python only for the fuzz build (undesirable — it would diverge from the shipped package).
Option 1 is the clean one if a suitable image tag exists; the SHA pin + dependabot convention in .clusterfuzzlite/ would carry over unchanged.
Summary
The
fuzz (address, 30s)ClusterFuzzLite check fails on every PR against currentmain. It fails at build time — no fuzz target ever runs, so the job provides no fuzzing coverage at all right now.Cause
feat!: drop Python 3.11 support(#70) raisedrequires-pythonto>=3.12(pyproject.toml:22), but the ClusterFuzzLite builder runs theoss-fuzz-base/base-builder-pythonimage, which ships Python 3.11.13..clusterfuzzlite/build.shdoespip3 install .against that interpreter, which now refuses the package.This is consistent with the history: fuzz runs were green on every dependabot base-builder bump before #70 landed, and have failed since.
Why it matters
Possible fixes
base-builder-pythonvariant with Python >= 3.12 (may need an upstream image that ships it).requires-pythononly for the fuzz build (undesirable — it would diverge from the shipped package).Option 1 is the clean one if a suitable image tag exists; the SHA pin + dependabot convention in
.clusterfuzzlite/would carry over unchanged.