Repository navigation
chore(deps-py)(deps): bump fastapi from 0.142.0 to 0.142.2 in the python-production group - #633
Conversation
Bumps the python-production group with 1 update: [fastapi](https://github.com/fastapi/fastapi). Updates `fastapi` from 0.142.0 to 0.142.2 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.142.0...0.142.2) --- updated-dependencies: - dependency-name: fastapi dependency-version: 0.142.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-production ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
🔴 NSE Evidence Report — #633Status: FAIL · Branch: 🔗 Revision
Overall🔴 FAIL Required CI checks contain failures. Primary affected files:
🧪 Test Matrix
🔴 Affected Files
|
| Workflow | Job | Status | Details |
|---|---|---|---|
CI |
Heavy CI (${{ matrix.suite }}) |
⏭️ SKIPPED | logs |
CI |
Aggregate CI Results |
⏭️ SKIPPED | logs |
CI |
Extended Validation (Tier 2) |
⏭️ SKIPPED | logs |
CI |
Full Runtime Overall Verdict |
✅ SUCCESS | logs |
GitHub Advanced Security |
Trivy |
✅ SUCCESS | logs |
GitHub Advanced Security |
osv-scanner |
✅ SUCCESS | logs |
CI |
DB Fabric Certification (SQLite ↔ PostgreSQL) |
✅ SUCCESS | logs |
GitHub Advanced Security |
CodeQL |
✅ SUCCESS | logs |
Docs |
Deploy GitHub Pages |
⏭️ SKIPPED | logs |
Socket Security |
Socket Security: Pull Request Alerts |
✅ SUCCESS | logs |
Socket Security |
Socket Security: Project Report |
✅ SUCCESS | logs |
Code scanning AI findings on PR #633 |
github-advanced-security |
❌ FAILURE | logs |
OSV Dependency Scan |
OSV Scanner / osv-scan |
✅ SUCCESS | logs |
Tests (OS Matrix) |
Py Tests (windows-latest) |
✅ SUCCESS | logs |
Tests (OS Matrix) |
Py Tests (macos-latest) |
✅ SUCCESS | logs |
Dependency Lock & Migration Safety |
Migration safety (fail-loud + version postconditions) |
✅ SUCCESS | logs |
Dependency Lock & Migration Safety |
Dependency drift (lock vs pyproject) |
✅ SUCCESS | logs |
CI |
Full NSE Runtime (postgres) |
✅ SUCCESS | logs |
CI |
MetaTrader 5 Wine Runtime |
✅ SUCCESS | logs |
Dependency Lock Self-Heal |
Regenerate lockfiles when drifted |
✅ SUCCESS | logs |
CI |
Full NSE Runtime (sqlite) |
✅ SUCCESS | logs |
CI |
CI Integrity and Change Classification |
✅ SUCCESS | logs |
Security |
Trivy Vulnerability Scan |
✅ SUCCESS | logs |
Docs |
Validate documentation |
✅ SUCCESS | logs |
CI |
Code Quality & Tests |
✅ SUCCESS | logs |
Security |
CodeQL Analysis |
✅ SUCCESS | logs |
JS Tests |
Frontend JS Unit Tests |
✅ SUCCESS | logs |
Lockfile Diff |
Dependency Manifest Diff |
✅ SUCCESS | logs |
🟢 Final Verdict — Merge? Yes
Every merge precondition observed is satisfied:
- 1 check(s) not green:
github-advanced-security— the base branch's required list could not be read, so GitHub's own mergeability answer is used instead. - Not observed: which checks the base branch requires, required-review count — could not be read.
- GitHub reports this PR is mergeable, which already accounts for the unreadable rules above.
NSE Evidence Report — generated by nse pr report. Statuses are deterministic: 🟢 PASS · 🟡 IN PROGRESS · 🟠 BLOCKED · 🔴 FAIL · ⚪ UNKNOWN. unknown = the evidence did not determine it. This comment is updated in place; it never duplicates.
…#638) Root cause: Dependabot bumps ranges in pyproject.toml but cannot run uv pip compile, so it opens PRs whose committed requirements.lock is stale. The required "Dependency drift (lock vs pyproject)" gate then fails on every dependency PR and blocks the merge queue (#633-#637). Two-part fix: 1. Regenerate requirements.lock + requirements.txt from the current pyproject.toml (uv 0.12.10, --python-version 3.11) so main is consistent again. Every PR that does not itself touch pyproject.toml (all npm/frontend and github-actions PRs) goes green because the gate compares the committed lock against a fresh compile. 2. Add .github/workflows/dependency-autoregen.yml: on any pyproject.toml change reaching main it regenerates and commits the artifacts in place (main can never stay drifted); on PRs that move pyproject.toml it pushes the regenerated artifacts onto the PR branch and re-requests the check suites. Idempotent - converges after one commit. Co-authored-by: Opselon <opselon@users.noreply.github.com>
Dependabot bumps pyproject.toml ranges but cannot run uv pip compile, so the compiled artifacts must ship in the same PR (see .github/dependabot.yml lockfile-safe contract). Regenerated with uv 0.12.10 --python-version 3.11.
Bumps the python-production group with 1 update: fastapi.
Updates
fastapifrom 0.142.0 to 0.142.2Release notes
Sourced from fastapi's releases.
Commits
78c4324🔖 Release version 0.142.2 (#16419)2579ed0📝 Update release notes1d4953d🐛 Allow startup when automatic OpenTelemetry configuration fails (#16418)3e33a03🔖 Release version 0.142.1 (#16415)12ea7f5📝 Update release notesac88f56🐛 Fix repeated endpoint wrapping in included routers (#16414)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions