Refresh locks for Dependabot updates - #58
Conversation
… with 4 updates Bumps the production-minor-patch group with 4 updates in the / directory: [typer](https://github.com/fastapi/typer), [pytest](https://github.com/pytest-dev/pytest), [ruff](https://github.com/astral-sh/ruff) and [mypy](https://github.com/python/mypy). Updates `typer` from 0.26.7 to 0.26.8 - [Release notes](https://github.com/fastapi/typer/releases) - [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md) - [Commits](fastapi/typer@0.26.7...0.26.8) Updates `pytest` from 9.1.0 to 9.1.1 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.1.0...9.1.1) Updates `ruff` from 0.15.17 to 0.15.21 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.17...0.15.21) Updates `mypy` from 2.1.0 to 2.3.0 - [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md) - [Commits](python/mypy@v2.1.0...v2.3.0) --- updated-dependencies: - dependency-name: typer dependency-version: 0.26.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: pytest dependency-version: 9.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: ruff dependency-version: 0.15.21 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: mypy dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [types-requests](https://github.com/python/typeshed) from 2.33.0.20260518 to 2.33.0.20260712. - [Commits](https://github.com/python/typeshed/commits) --- updated-dependencies: - dependency-name: types-requests dependency-version: 2.33.0.20260712 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| tenacity==9.1.4 | ||
| tiktoken==0.12.0 | ||
| tokenizers==0.23.1 | ||
| tomli==2.4.1 |
There was a problem hiding this comment.
📝 Info: tomli added to Python 3.11 lock despite stdlib tomllib
tomli==2.4.1 is newly added to both requirements.lock:86 and requirements-dev.lock:108. Since the locks are pinned for Python 3.11 (which ships tomllib in the stdlib), tomli is presumably pulled in as a transitive dependency of one of the bumped tools (e.g. black/mypy/ruff toolchain). This is not a bug, but worth a quick sanity check that it reflects a real transitive requirement produced by the uv regeneration rather than a stray manual edit.
Was this helpful? React with 👍 or 👎 to provide feedback.
| annotated-types==0.7.0 | ||
| anyio==4.13.0 | ||
| ast-serialize==0.3.0 | ||
| ast-serialize==0.6.0 |
There was a problem hiding this comment.
📝 Info: Major dependency bumps (ast-serialize, librt) could affect runtime behavior
ast-serialize jumps 0.3.0 -> 0.6.0 and librt 0.11.0 -> 0.13.0 in both locks. These are relatively large version jumps that could carry breaking API changes. No source code changed in this PR to accommodate them, so correctness relies entirely on the stated test plan (16 pytest tests, bazelisk test). If any application code directly imports these packages, the reviewer should confirm the tests actually exercise those paths.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Summary
requirements.lockandrequirements-dev.lockwith uv 0.4.30 for Python 3.11 on Linux x86_64.Test plan
bazelisk test //:pytestpip-audit 2.9.0; findings are in transitive packages unchanged frommain.