Repository navigation
chore(deps): bump the python-minor-and-patch group with 21 updates - #8
dependabot[bot] wants to merge 1 commit into
Conversation
--- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: azure-identity dependency-version: 1.26.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: boto3 dependency-version: 1.43.114 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: gitpython dependency-version: 3.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: starlette dependency-version: 1.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: pyjwt dependency-version: 2.15.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: python-gitlab dependency-version: 8.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: starlette-context dependency-version: 0.5.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: uvicorn dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: a2a-sdk[http-server] dependency-version: 1.2.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: pydantic dependency-version: 2.14.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: pydantic-settings dependency-version: 2.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: prometheus-client dependency-version: 0.26.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: langchain dependency-version: 1.4.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: langchain-core dependency-version: 1.6.12 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: langchain-openai dependency-version: 1.7.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: pandas dependency-version: 3.0.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: lancedb dependency-version: 0.40.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: qdrant-client dependency-version: 1.19.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: pre-commit dependency-version: 4.7.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: ruff dependency-version: 0.17.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| "python-gitlab==8.6.0", | ||
| "retry==0.9.2", | ||
| "starlette-context==0.3.6", | ||
| "starlette-context==0.5.1", |
There was a problem hiding this comment.
🔥 The Roast: Two minor versions of a 0.x library — semver's way of saying 'everything you loved is now a historical footnote.' This is not some peripheral utility: starlette_context owns the request-scoped settings isolation that config_loader.get_settings() reads and that ~20 modules mutate. And the plot twist: pr_agent/servers/github_polling.py:134 already documents 0.5.1's 'bare yield skips the ContextVar reset' bug, so this code was written against 0.5.x semantics while the pin insisted on 0.3.6. This PR finally makes the pin match the code — by flipping the runtime behavior of the context under every webhook, every CLI run and every polling iteration. That reset is the one thing standing between two requests and a cross-request settings leak, and it is being changed in a Dependabot PR with a shrug.
🩹 The Fix: Before merge, run the isolation suites that actually exercise it: PYTHONPATH=. uv run pytest tests/unittest/test_mosaico_isolation.py tests/unittest/test_per_directory_settings.py tests/unittest/test_apply_repo_settings.py tests/unittest/test_extra_config_url.py -q, and confirm starlette_context.errors.ContextDoesNotExistError and starlette_context.middleware.RawContextMiddleware still exist in 0.5.1 (both are imported by first-party code). If the reset semantics moved, re-check the manual __enter__/__exit__ drivers in pr_agent/cli.py and pr_agent/servers/github_polling.py.
📏 Severity: warning
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| # Prometheus scrape endpoint for [otel] command telemetry (native /metrics on | ||
| # the webhook apps). Multiprocess-capable; see pr_agent/telemetry/prometheus.py. | ||
| "prometheus-client==0.21.1", | ||
| "prometheus-client==0.26.0", |
There was a problem hiding this comment.
🔥 The Roast: 0.21 → 0.26 in one PR: five minors of a library that ships 0.x for a reason. And your scrape endpoint reaches into the medicine cabinet — pr_agent/telemetry/prometheus.py:92 reads prometheus_values.ValueClass._multiprocess, a private attribute of a private module, to decide whether /metrics serves the whole cluster or one sad little worker. If 0.26 renamed that attribute you do not get an exception; you get a scrape that looks perfectly healthy while quietly reporting one worker's numbers forever. The other landmine is the on-disk multiprocess state format: a rolling deploy leaves 0.21.1 and 0.26.0 workers writing into the same PROMETHEUS_MULTIPROC_DIR, and if that file format moved, the collector merges two dialects into confetti.
🩹 The Fix: Confirm prometheus_client.values.ValueClass._multiprocess still exists in 0.26.0 (and prefer a supported signal if one is available). tests/unittest/test_telemetry_prometheus.py already spawns two worker processes and asserts multiproc aggregation, so PYTHONPATH=. uv run pytest tests/unittest/test_telemetry_prometheus.py -q is your smoke test; add a case that scrapes a directory written by the previous version if rolling deploys are a thing you do.
📏 Severity: warning
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| "azure-identity==1.25.0", | ||
| "boto3==1.43.78", | ||
| "azure-identity==1.26.0", | ||
| "boto3==1.43.114", |
There was a problem hiding this comment.
🔥 The Roast: The boto3 pin moves, and botocore rides along from 1.43.83 to 1.43.114 — 31 patch releases, each one free to rearrange the furniture. Meanwhile pr_agent/algo/ai_handlers/litellm_ai_handler.py does not use boto3 like a normal person: it reaches into session._session (line 993), then rewrites ContainerProvider._environ (line 999), reads AssumeRoleWithWebIdentityProvider._disable_env_vars and ._CONFIG_TO_ENV_VAR (lines 1000-1003), and monkeypatches provider._get_env_config (line 1009). That is four private attributes and one private method, surgically edited, in a library nobody promised to keep stable. The comment on line 996 even admits it — 'already disable environment selection in botocore 1.43.x' — so you already know you are version-coupled; you are just not reading the fine print of 31 more patch releases.
🩹 The Fix: Re-verify those five names against botocore 1.43.114, and fail loudly when they are missing instead of silently falling through to ambient credentials. The unit tests mock boto3/botocore wholesale, so nothing in CI would catch a rename — add one test that runs _bind_aws_workload_token_sources against a real boto3.Session, or pin botocore explicitly next to boto3 so the pair cannot drift apart again.
📏 Severity: warning
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| "uvicorn>=0.31.1,<1", | ||
| "tenacity==8.2.3", | ||
| "a2a-sdk[http-server]==1.0.3", | ||
| "a2a-sdk[http-server]==1.2.2", |
There was a problem hiding this comment.
🔥 The Roast: The MOSAICO executor imports resolve_user_scope from a2a.server.tasks.inmemory_task_store (pr_agent/mosaico/executor.py:30) — an internal implementation module of a pre-2.0 SDK — and get_message_text from a2a.helpers.proto_helpers (line 26). Internals in 1.x move when someone renames a folder, not when they file a deprecation notice. Since these are module-level imports, the failure mode is not graceful degradation; it is the entire A2A server failing to import, and mosaico/server.py is a separate app from the webhook, so your smoke test may never notice. Meanwhile the executor tests monkeypatch TaskUpdater with a spy, so they never touch the real signature — the only test that does is test_mosaico_a2a_roundtrip.py.
🩹 The Fix: Run PYTHONPATH=. uv run pytest tests/unittest/test_mosaico_a2a_roundtrip.py tests/unittest/test_mosaico_executor.py -q against 1.2.2 and confirm a2a.server.tasks.inmemory_task_store.resolve_user_scope, a2a.helpers.proto_helpers.get_message_text and TaskUpdater(event_queue, task_id, context_id) still exist. If the internals moved, switch to the public a2a.server.tasks export or vendor the scope resolution locally.
📏 Severity: warning
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| "lancedb==0.38.0", | ||
| "qdrant-client==1.15.1", | ||
| "lancedb==0.40.0", | ||
| "qdrant-client==1.19.1", |
There was a problem hiding this comment.
🔥 The Roast: Your qdrant client still calls client.search(...) (pr_agent/tools/pr_similar_issue.py:497) and client.upload_points(...) (line 887) — the two aliases qdrant-client deprecated in favour of query_points() and upsert(). Bumping 1.15 → 1.19 walks straight through the window where those aliases get deleted, and when they go, the similar-issue tool does not warn you; it just raises AttributeError in the middle of an ingest. The sting in the tail: nothing in CI would notice, because the qdrant tests use fake clients (tests/unittest/test_similar_issue_qdrant_ingest.py and friends never import the real qdrant_client), and this dependency group is not even installed by default.
🩹 The Fix: Migrate the two call sites to query_points(...) and upsert(...) before or with this bump, and add one test that imports the real qdrant_client so the next rename cannot hide from you.
📏 Severity: warning
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| "httpx==0.28.1", | ||
| "pre-commit>=4,<5", | ||
| "ruff==0.16.8", | ||
| "ruff==0.17.1", |
There was a problem hiding this comment.
🔥 The Roast: The linter bump is the quiet one, and quiet ones are the dangerous ones. .pre-commit-config.yaml:40 runs uv run --frozen ruff check, i.e. the locked ruff — so this line does not merely update a dev tool, it changes what CI enforces for the entire repository. Ruff minors add rules to the selected families (E/F/B/I), and this repo's lint.ignore is an explicit ledger of pre-existing violations, so one new rule can redden the whole codebase inside a PR whose title says '21 dependency updates'. The irony: your AGENTS.md treats that ignore list as a debt ledger to burn down, and this PR grows it by proxy.
🩹 The Fix: Run uv run ruff check on 0.17.1 locally, fix what is new, and either drop or justify any added lint.ignore entries — do not let a Dependabot PR quietly become the thing that expands the debt list.
📏 Severity: suggestion
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| # litellm/integrations/otel/model/config.py. Keep the exact pin to lock the resolved transitive version. | ||
| # Version matches litellm's own constraint (>=2.14.1,<3.0); the existing observability guard covers the callback import. | ||
| "pydantic-settings==2.14.2", | ||
| "pydantic-settings==2.16.0", |
There was a problem hiding this comment.
🔥 The Roast: The comment right above this line (72-74) is a tiny essay about why this pin exists: litellm imports pydantic-settings unconditionally, so the pin 'locks the resolved transitive version', and 'Version matches litellm's own constraint (>=2.14.1,<3.0)'. Dependabot dutifully bumped 2.14.2 → 2.16.0 and left the essay untouched. But 2.16.0 is no longer 'the resolved transitive version' of litellm 1.102.1 — it is now a deliberate pin that merely satisfies litellm's range, so the sentence that justified it now describes a different relationship than the one that exists. And the guard it leans on (the 'existing observability guard') only asserts that pydantic_settings imports — tests/unittest/test_mosaico_observability_deps.py:59 — it never checks a single field or config behaviour.
🩹 The Fix: Update the comment to state the new rationale (and whether 2.16.0 was picked deliberately over what litellm would resolve on its own), and confirm litellm 1.102.1's declared range still admits it. If the intent is to track litellm's resolution, pin that version instead of letting Dependabot pick a different one.
📏 Severity: nitpick
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Code Review Roast 🔥Verdict: 7 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)
🏆 Best part: The lockfile surgery is immaculate — 21 packages, a coherent resolution, and the repo's own pin-razor comments ( 💀 Worst part: 📊 Overall: Like changing the locks on a building while the tenants are still inside — nothing is obviously on fire, but the pins that hold the walls together all moved at once, and three of them (botocore internals, prometheus private attribute, a2a internal module) are load-bearing in ways nobody wrote a test for. Files Reviewed (2 files)
Fix these issues in Kilo Cloud Reviewed by free · Input: 193.5K · Output: 29.4K · Cached: 1.7M |
Bumps the python-minor-and-patch group with 21 updates:
3.14.33.14.51.25.01.26.01.43.781.43.1143.1.623.2.11.6.01.8.02.13.02.15.18.3.08.6.00.3.60.5.10.52.40.54.01.0.31.2.22.13.32.14.12.14.22.16.00.21.10.26.01.3.111.4.61.4.81.6.121.3.31.7.23.0.33.0.60.38.00.40.01.15.11.19.14.6.04.7.00.16.80.17.1Updates
aiohttpfrom 3.14.3 to 3.14.5Updates
azure-identityfrom 1.25.0 to 1.26.0Release notes
Sourced from azure-identity's releases.
Commits
30d8bb9[identity] prepare azure-identity 1.26.0 release (#49290)c7148b7[identity] Enable user-assigned managed identity for AzureArcCredential (#48967)c5b1f4f[Identity] Fix identity cache issue (#49001)9d085c1[AutoPR azure-mgmt-compute-bulkaction]-generated-from-SDK Generation - Python...efc412d[TA] fix release error (#49261)3d9b8b3Prepare Responses 2.3.0b2 release (#49281)8e49d15[AutoPR azure-mgmt-resiliencemanagement]-generated-from-SDK Generation - Pyth...ef68c78Preserve canonical agent reference in response snapshots (#49256)3754db9Configurations: 'specification/applink/AppLink.Management/tspconfig.yaml', a...0929352[Mgmt] Make review drafts and incomplete outcomes reliable (#49275)Updates
boto3from 1.43.78 to 1.43.114Commits
432fa17Merge branch 'release-1.43.114'bf4aed7Bumping version to 1.43.114fa3e3f2Add changelog entries from botocore69ed308Merge branch 'release-1.43.113'3abaa49Merge branch 'release-1.43.113' into develop741f8d9Bumping version to 1.43.113ad1c6b5Add changelog entries from botocore9ca5e36Merge branch 'release-1.43.112'f5581baMerge branch 'release-1.43.112' into develop6f065c3Bumping version to 1.43.112Updates
gitpythonfrom 3.1.62 to 3.2.1Release notes
Sourced from gitpython's releases.
... (truncated)
Changelog
Sourced from gitpython's changelog.
Commits
c179357prepare changelog prior to release97eadb8fix(submodule): validate destinations before mutation6a7180aprepare for next release, v3.20b64501refactor(db): deprecate the pure-PythonGitDBbackend9349ff5fix(repo): preserve literal separate Git directory paths8290c98fix: bound actor and date parsing9ad28ccfix: complete safety checks in Git command wrappersce2093bbump minor version to indicate drop of python 3.7 supportdafafffMerge pull request #2247 from gitpython-developers/pos-arg-sanitization790bb31fix(remote): reject option-shaped pull operandsUpdates
starlettefrom 1.6.0 to 1.8.0Release notes
Sourced from starlette's releases.
... (truncated)
Changelog
Sourced from starlette's changelog.
... (truncated)
Commits
7b2948fVersion 1.8.0 (#3660)5b544ceSend response start immediately when GZipMiddleware cannot compress (#3631)96d5023EmitMax-Age=0on session cookie whenmax_age=0(#3651)0a15da3Include allowed methods in StaticFiles 405 responses (#3640)ff5b4dfCloseRequest.stream()generators withaclosing(#3628)7cb2f09Mark sessions as accessed when popping existing keys (#3186)c67ca4eAdd HTTP 103 Early Hints support (#3435)04741d0Update broken external documentation links (#3621)470f986Correct the documented WebSocket and Request constructor signatures (#3580)b2e8750Bracket IPv6 hostnames inURL.replace()(#3617)Updates
pyjwtfrom 2.13.0 to 2.15.1Release notes
Sourced from pyjwt's releases.
Changelog
Sourced from pyjwt's changelog.
... (truncated)
Commits
7d5ef55chore: prepare 2.15.1 release7bf3252Accept canonical Base64URL padding in JWT segments (#1216)1d41a64chore: prepare 2.15.0 release9bc0665fix: make recursive payload tests deterministic5fde08afix: normalize recursive JWT payload errors171062dutils: mention bytes in force_bytes type error (#1173)c9d4d53docs/conf: drop duplicate 'and' from read() docstring (#1174)2763752Add support for Python 3.15 (#1202)4adcd02Catch http.client.HTTPException in PyJWKClient.fetch_data (#1201)9e501d9fix: correct docstring typo in _validate_jti (#1179)Updates
python-gitlabfrom 8.3.0 to 8.6.0Release notes
Sourced from python-gitlab's releases.
... (truncated)
Changelog
Sourced from python-gitlab's changelog.
... (truncated)
Commits
51eb17echore: release v8.6.0ce92c8fchore(deps): update all non-major dependenciesa3e3713chore(deps): update gitlab/gitlab-ee docker tag to v19.3.2-ee.0 (#3448)a47b5e0chore(deps): update all non-major dependenciesc58ca36chore(deps): update pre-commit hook pycqa/isort to v950b7c1echore(deps): update dependency isort to v9dc9afedchore(deps): update all non-major dependenciesc56d5fdchore(deps): update gitlab/gitlab-ee docker tag to v19.3.1-ee.0 (#3443)3032667chore(deps): update dependency types-setuptools to v84f4a643fchore(deps): update pre-commit hook maxbrunet/pre-commit-renovate to v44Updates
starlette-contextfrom 0.3.6 to 0.5.1Release notes
Sourced from starlette-context's releases.
Commits
9ac3634Bump version to 0.5.1, update changelog and authors0ee5c58improve codecov after tomwojcik/starlette-context#192...ad81772Added test for consistent enum behavior410805dMake pre-3.11 behavior with post-3.110c5470fimprove docs and tests post https://github.com/tomwojcik/starlette-context/pu...bc0a78fAdd background task context tests and update documentation2ed7b74Bump astral-sh/setup-uv from 5 to 7e0e57ffOnly upload codecov for latest Python/Starlette matrix entrycde2259Limit sdist contents to package source and essential filesaf8d901Fix documentation examples and modernize project toolingUpdates
uvicornfrom 0.52.4 to 0.54.0Release notes
Sourced from uvicorn's releases.
Changelog
Sourced from uvicorn's changelog.
Commits
3eb9a9aVersion 0.54.0 (#3161)cd7ef6dRemove races from supervisor tests (#3134)a56c7ccSupport HTTP/2 response trailers (#3146)9bd4404chore(deps): bump anyio from 4.13.0 to 4.14.2 (#3145)21f39efAdd HTTP/2 Early Hints support (#3137)421708fVersion 0.53.0 (#3136)f1a1bffUnset the keep-alive timer when upgrading to WebSocket (#3107)63971edDocument HTTP/2 support (#3130)Summary by cubic
Bumps 21 Python dependencies in the python-minor-and-patch group across runtime,
similar-issue, and dev dependencies, updating both exact pins and locked transitive versions inpyproject.tomlanduv.lock.Review notes
gitpython3.2.x drops Python 3.7, deprecates theGitDBbackend, and bundles security fixes.starlette1.8.0 requires Python 3.11+ and adds HTTP 103 Early Hints support.starlette-context0.5.x drops Python 3.9 support.pyjwt2.15.x applies security fixes and changesJWKSetCacheto store parsedPyJWKSetobjects instead of raw JWKS payloads.Written for commit 06d99c7. Summary will update on new commits.