From 0b743d1ef9b5acb1cd94c888e9f77a7f5a1cd94b Mon Sep 17 00:00:00 2001 From: Eldon Marks Date: Fri, 7 Aug 2026 10:39:23 -0400 Subject: [PATCH] Cap uvicorn below 1.0 The spec was floor-only (>=0.23.0). jvspatial is the package that actually drives uvicorn -- api/server_run.py calls uvicorn.run with a config dict -- so a major release is free to rename or drop the kwargs passed there. The open range also let a resolver move an existing environment from uvicorn 0.44 to 0.52 between two installs of the same commit, with nothing in the diff to explain it. A cap keeps resolution inside a tested range without pinning consumers to an exact version, which a library should not do. Deliberately a range rather than ==: an exact pin in a published library propagates conflicts to every downstream that depends on anything else wanting uvicorn. Reproducibility for a deployment belongs in that deployment's lock/constraints file, not in this dependency list. --- CHANGELOG.md | 11 +++++++++++ pyproject.toml | 7 ++++++- 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b442ce5..2dc35d6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Changed + +- **`uvicorn` is capped below 1.0** (`pyproject.toml`). It was floor-only + (`>=0.23.0`), and jvspatial is the package that actually drives it — + `api/server_run.py` calls `uvicorn.run` with a config dict, so a major + release is free to rename or drop the kwargs passed there. In practice the + open spec let a resolver move an existing environment from 0.44 to 0.52 + between two installs of the same commit, silently. The cap keeps resolution + inside a range that has been tested without pinning consumers to an exact + version. + ## [0.0.17] - 2026-08-05 ### Fixed diff --git a/pyproject.toml b/pyproject.toml index 3afec50..44715a5 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -35,7 +35,12 @@ dependencies = [ # lifespan), not the Router(on_startup/on_shutdown) API that 1.0 removed, and # route introspection is version-agnostic via _route_utils.iter_api_routes. "starlette>=0.46.0", - "uvicorn>=0.23.0", + # Capped below 1.0: uvicorn is the ASGI server jvspatial actually drives + # (api/server_run.py calls uvicorn.run directly with a config dict), so a + # major release is free to rename or drop the kwargs we pass. The floor-only + # spec let a resolver walk 0.44 -> 0.52 unnoticed between two installs of + # the same commit; a cap keeps that inside a range we have tested. + "uvicorn>=0.23.0,<1.0.0", "python-multipart>=0.0.6", "motor>=3.0.0", "pymongo>=4.0.0",