Repository navigation
chore(deps): Python routine group with regenerated locks (replaces #174) - #177
Merged
Merged
Conversation
Applies the eight direct bumps from Dependabot's python-routine PR (fastapi 0.143.0, sqlalchemy 2.1.4, asyncpg 0.32.0, pydantic 2.14.1, shapely 2.2.0, websockets 17.2, meshcore 2.3.15, litellm 1.105.0) and regenerates the three lockfiles, which Dependabot does not do: CI installs the locks, so that PR's green tests ran the old versions and its audit job failed on the mismatch. The locks are regenerated without --upgrade so only what the bumps require moves (12/8/20 lines); a full upgrade also pulled pycryptodome 3.23 to 4.0 via meshcore. filelock goes 4.0.7 to 3.32.7 in transcription because litellm 1.105.0 declares filelock<4. Checked against the new locks: lock consistency, pip-audit clean on all three, backend 337 and poller 723 tests passing, transcription installs and imports. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CaxFjAumSiSR6SX3XrVh3K
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces #174. Same eight direct bumps (fastapi 0.143.0, sqlalchemy 2.1.4, asyncpg 0.32.0, pydantic 2.14.1, shapely 2.2.0, websockets 17.2, meshcore 2.3.15, litellm 1.105.0), plus the lockfile regeneration Dependabot does not do.
Why #174 could not pass: CI installs
requirements.lock, notrequirements.txt. Dependabot only edits the.txt, so its test jobs ran the old versions and the audit job failed on the manifest/lock mismatch.What changed in the locks: regenerated with pip-tools 7.5.2 without
--upgrade, so only what the bumps require moved: 12 / 8 / 20 lines (backend / poller / transcription). A full--upgradealso movedpycryptodome3.23.0 to 4.0.0 via meshcore (a major crypto-library bump nothing here exercises), so it is deliberately not included. One transitive change worth knowing:filelock4.0.7 to 3.32.7 in transcription, because litellm 1.105.0 now declaresfilelock<4.0(1.103.1 had no limit).Checked against these locks: lock consistency check,
pip-audit(no known vulnerabilities in any of the three), backend 337 tests, poller 723 tests, and transcription installs and imports (litellm, asyncpg, redis, faster-whisper; it has no unit tests).Not exercised by any test: MeshCore against live traffic (meshcore 2.3.15) and a real litellm call. Worth a glance at the MeshCore chat and the briefing after deploying.
🤖 Generated with Claude Code