build(deps): bump the production-minor-patch group across 1 directory with 6 updates - #63
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
… with 6 updates Bumps the production-minor-patch group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [typer](https://github.com/fastapi/typer) | `0.26.8` | `0.27.1` | | [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.2` | `1.2.3` | | [twilio](https://github.com/twilio/twilio-python) | `9.10.9` | `9.11.0` | | [gunicorn](https://github.com/benoitc/gunicorn) | `26.0.0` | `26.1.0` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.21` | `0.16.4` | | [mypy](https://github.com/python/mypy) | `2.3.0` | `2.3.1` | Updates `typer` from 0.26.8 to 0.27.1 - [Release notes](https://github.com/fastapi/typer/releases) - [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md) - [Commits](fastapi/typer@0.26.8...0.27.1) Updates `python-dotenv` from 1.2.2 to 1.2.3 - [Release notes](https://github.com/theskumar/python-dotenv/releases) - [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md) - [Commits](theskumar/python-dotenv@v1.2.2...v1.2.3) Updates `twilio` from 9.10.9 to 9.11.0 - [Release notes](https://github.com/twilio/twilio-python/releases) - [Changelog](https://github.com/twilio/twilio-python/blob/main/CHANGES.md) - [Commits](twilio/twilio-python@9.10.9...9.11.0) Updates `gunicorn` from 26.0.0 to 26.1.0 - [Release notes](https://github.com/benoitc/gunicorn/releases) - [Commits](benoitc/gunicorn@26.0.0...26.1.0) Updates `ruff` from 0.15.21 to 0.16.4 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.21...0.16.4) Updates `mypy` from 2.3.0 to 2.3.1 - [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md) - [Commits](python/mypy@v2.3.0...v2.3.1) --- updated-dependencies: - dependency-name: typer dependency-version: 0.27.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: python-dotenv dependency-version: 1.2.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: twilio dependency-version: 9.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: gunicorn dependency-version: 26.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: ruff dependency-version: 0.16.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: mypy dependency-version: 2.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
haasonsaas
added a commit
that referenced
this pull request
Sep 2, 2026
Two independent defects keep every Dependabot pull request in this
repository red. Both are fixed here.
1. The lock-sync gate can never pass for Dependabot.
.github/workflows/ci.yml requires requirements.lock to change whenever
requirements.txt changes, and requirements-dev.lock whenever
requirements-dev.txt changes. Dependabot's pip ecosystem edits only the
.txt manifests. It cannot regenerate these locks: dependabot-core treats
a file as a pip-compile output only when the name ends in .txt
(python/lib/dependabot/python/pip_compile_file_matcher.rb, which checks
`name.end_with?(".txt")` and looks for a sibling .in manifest). Files
named requirements.lock and requirements-dev.lock are never fetched as
lockfiles at all. #59 and #63 both fail on this.
.github/workflows/dependabot-lockfiles.yml now recompiles both locks on
Dependabot branches using the exact uv command recorded in their headers,
runs `uv pip install`, `black --check .`, `ruff check .` and `pytest -q`
against the recompiled result, and pushes the refreshed locks back to the
pull request branch. No --upgrade is passed, so uv reads the existing
output file as preferences and only the pins the manifest change forces
will move. The job is gated on
`github.event.pull_request.user.login == 'dependabot[bot]'` and on the
head branch living in this repository, and it is the only place that
holds `contents: write`.
The ci.yml lock-sync step now skips Dependabot pull requests, because the
new workflow satisfies that invariant for them by construction and runs a
strictly larger check. It is unchanged for every human pull request.
2. `ruff check .` silently redefines itself on a ruff upgrade.
There was no ruff configuration in the repository, so `ruff check .` ran
whatever ruff's built-in default selection happened to be. That default
changed in ruff 0.16. On the current tree:
ruff 0.15.21: All checks passed!
ruff 0.16.4: Found 124 errors.
(48 UP006, 36 BLE001, 17 I001, 10 UP045, 7 UP035, ...)
So #63, which bumps ruff 0.15.21 -> 0.16.4, would still fail after the
lockfile problem is fixed. ruff.toml now pins
`select = ["E4", "E7", "E9", "F"]`, which is the rule set this repository
has actually been enforcing. This makes the existing contract explicit
instead of letting a tool upgrade rewrite it. Adopting the additional
rules stays available as a deliberate, separate change.
Verified locally:
- `actionlint .github/workflows/dependabot-lockfiles.yml
.github/workflows/ci.yml` is clean.
- Recompiling both locks on the current main is a no-op apart from the uv
version string in the header comment; every pin is preserved.
- Simulating #63 on top of main (its requirements.txt and
requirements-dev.txt applied, then both locks recompiled) moves exactly
six pins in each lock -- gunicorn, mypy, python-dotenv, ruff, twilio,
typer -- and nothing else. In a Python 3.11 venv from the recompiled
requirements-dev.lock: `black --check .` passes (24 files),
`pytest -q` passes (30 passed), and `ruff check .` passes with the new
ruff.toml under both 0.15.21 and 0.16.4.
Claude-Session: https://claude.ai/code/session_01XpuXXVrWCZk3Tq5NRXejNP
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Contributor
|
@dependabot rebase Context: #64 just merged. |
Contributor
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/pip/production-minor-patch-1c70078766
branch
September 2, 2026 01:44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the production-minor-patch group with 6 updates in the / directory:
0.26.80.27.11.2.21.2.39.10.99.11.026.0.026.1.00.15.210.16.42.3.02.3.1Updates
typerfrom 0.26.8 to 0.27.1Release notes
Sourced from typer's releases.
Changelog
Sourced from typer's changelog.
Commits
fe2aa0e🔖 Release version 0.27.1 (#1919)680dc99📝 Update release notesac3efd5✨ Makeepilogformatting consistent with other parts of the help string (#1...32d80ef📝 Update release notes10cb3c9⬆️ Upgrade latest-changes to 0.7.1 (#1909)ac329a0📝 Update release notesc37ae2f📝 Add Library Skills documentation (#1906)0974a7e📝 Update release notes951178c🐛 Prevent scroll-to-top on restart/fast buttons in the documentation (#1904)9051baa📝 Update release notesUpdates
python-dotenvfrom 1.2.2 to 1.2.3Release notes
Sourced from python-dotenv's releases.
Changelog
Sourced from python-dotenv's changelog.
Commits
49515afBump version: 1.2.2 → 1.2.38ac846fchore: add release runbook (RELEASING.md) and make release targetbb31c94docs: add 1.2.3 release notes (#606, #638, #680)f7b18d9fix: round-trip backslashes through set_key (#680)751f8c1ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...f1937b6chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...45b9372chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)72896e9docs: fix broken mkdocs link in CONTRIBUTING.md (#636)72754a1ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...078325eci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...Updates
twiliofrom 9.10.9 to 9.11.0Release notes
Sourced from twilio's releases.
... (truncated)
Changelog
Sourced from twilio's changelog.
... (truncated)
Commits
306691eFix tag validation regex in deploy.yml (#954)a7c1450Update Python version matrix in deploy.yml (#953)eba3466[Librarian] Regenerated @ f443c9dfa233e41d0e61c9ed6ca2b162467a08b5 89762bc866...fbdfe4eUpdate deployment trigger to all tags (#950)3a5e24dComment out docs generation verification step (#952)89689b2handle-blank-response-202 (#949)3b82ae1Remove assistant apis cluster test (#948)184b583fix: updates to release process (#941)becbfc5removed oauth beta maturity from readme (#943)ecf51acAdd test and release gate workflow (#940)Updates
gunicornfrom 26.0.0 to 26.1.0Release notes
Sourced from gunicorn's releases.
... (truncated)
Commits
71b59a7Merge pull request #3698 from benoitc/fix/docker-health-check-readerror48287detest: catch every transport error in the docker health check3110e8cMerge pull request #3696 from benoitc/docs/roadmapcc56c41Merge pull request #3693 from benoitc/release/26.1.05cf1f16docs: surface the roadmap on the site home page7e35f72docs: add FastCGI to the roadmap and point items at Ideas18ddc58docs: drop the framework and reverse-proxy non-goals from the roadmap1ecae56docs: add a roadmap and make the chat easy to findca412e3docs: sync the Latest changelog page with 26.1.0640936fdocs: note the dependency security work in 26.1.0Updates
rufffrom 0.15.21 to 0.16.4Release notes
Sourced from ruff's releases.
... (truncated)
Changelog
Sourced from ruff's changelog.
... (truncated)
Commits
11c76bfBump 0.16.4 (#27937)d53c8c5Isolate playground builds from deployment credentials (#27839)cab001eDisable uv preview for releases and pre-commit hooks (#27939)f8d575f[ty] Clarify writing guidance for human readers (#27912)ca45faeSet--previewand--default-indexfor theuv-lockhook (#27935)4827bf7ExportUV_DEFAULT_INDEXinrelease.sh(#27934)d1087a4[ty] Handle assignment expressions in string annotations (#27921)680cce4[ty] Optimize inherited recursive protocol comparisons (#27922)974d3cbUpgrade ecosystem-analyzer and mypy_primer to the latest upstream pins (#27932)b169b40Install cargo tools locked (#27929)Updates
mypyfrom 2.3.0 to 2.3.1Changelog
Sourced from mypy's changelog.
... (truncated)
Commits
d642c44Bump version to 2.3.1a392429[mypyc] Fix crash on double yielding Iterators (#21826)4843e77[mypyc] Fixdefault_factoryfor inherited dataclass (#21785)14f5df9[mypyc] Clear coroutine env on coroutine completion (#21734)6dfa06dFix crash when unpacking return value from overload (#21830)a385746Bump version to 2.3.1+devDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions