chore(deps): uv: bump the all-python group across 1 directory with 7 updates - #693
chore(deps): uv: bump the all-python group across 1 directory with 7 updates#693dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
scottschreckengaust
left a comment
scottschreckengaust
left a comment
There was a problem hiding this comment.
Verdict: Request changes
The ty bump inside this group breaks the build. //agent:typecheck (the build (agentcore) check) hard-fails at exit code 1, and the cause is this PR's own content, not a pre-existing main-branch condition. This is the same failure family that closed #626 — with a newer, worse ty (0.0.63 vs. 0.0.59 there).
Governance (ADR-003)
Dependabot group bump under the standing all-python group policy — the group-bump policy is the authorization, so no hand-filed backing issue is required. Labels dependencies + python:uv are correct. The dependabot/uv/... branch name is the expected convention for these PRs (de-facto waived). Governance is satisfied; this is purely a technical block.
Vision alignment
Keeping the agent runtime on current, patched deps supports a reliable, bounded control plane. No tenet is traded. The only concern is CI health (see blocker).
Blocking issues
1. ty 0.0.56 → 0.0.63 fails //agent:typecheck (build red) — agent/uv.lock (ty dev-dep) + agent/pyproject.toml
CI build (agentcore) is RED. I reproduced it locally in the PR worktree with uv run ty check → 7 error[invalid-assignment] diagnostics, exit 1. Every diagnostic is a false-positive-shaped regression in the tool against intentional negative-tests:
tests/test_attachments.py:46—att.filename = "other.txt"tests/test_models.py:30—c.author = "bob"tests/test_models.py:63—issue.title = "Feature"tests/test_models.py:140—mc.repo_knowledge = ["new"]tests/test_models.py:170—hc.user_prompt = "changed"tests/test_models.py:416—setup.repo_dir = "/other"tests/test_models.py:447—u.input_tokens = 200
Each assignment lives inside a with pytest.raises(ValidationError): block against a model_config = ConfigDict(frozen=True, ...) Pydantic model (src/models.py:20,47,62,87,117,294,305). The test code is correct, idiomatic Pydantic-v2 immutability assertion; ty 0.0.63 newly treats the frozen-model field write as a static invalid-assignment error and hard-fails the typecheck. This is precisely the regression that got #626 closed.
This PR cannot merge while it makes the build red. Options (any one unblocks):
- Drop the
tybump from this group PR (rebase the lockfile to keepty==0.0.56), landing the runtime/tooling bumps that are green; or - In the SAME PR, add a targeted
tysuppression for the frozen-model negative-tests (e.g.# ty: ignore[invalid-assignment]on the 7 assignment lines, or a per-file/per-rule config exclusion fortests/), so//agent:typecheckpasses on 0.0.63; or - Hold
tyback and let a dedicated PR adopt 0.0.63 with the suppressions, per the #626 precedent.
I verified the boto3 / claude-agent-sdk / fastapi / uvicorn / aws-opentelemetry-distro / ruff bumps are not themselves implicated in the failure — the sole red signal is ty.
Non-blocking suggestions / nits
N1. Stale claude-agent-sdk comment (comment rot) — agent/pyproject.toml:19
The pin moved to 0.2.128 but the trailing comment still reads:
#https://github.com/anthropics/claude-agent-sdk-python/releases/tag/v0.2.110 (bundles claude CLI 2.1.191; kept in lockstep with the npm CLI pin in the Dockerfile, #215)
The release URL and the parenthetical (v0.2.110, bundles claude CLI 2.1.191) are now provably wrong for a 0.2.128 pin. More importantly, the comment asserts a lockstep invariant with agent/Dockerfile:72, which still pins @anthropic-ai/claude-code@2.1.191. Since ~0.2.116 the SDK has bundled a newer CLI (the #626 memo noted 0.2.116 → CLI 2.1.207), so bumping the SDK to 0.2.128 without touching the Dockerfile npm pin drifts the SDK-bundled CLI away from the on-PATH CLI — the exact hazard the comment warns against ("the SDK and the on-PATH CLI must agree on the control protocol"). Dependabot cannot see this cross-file coupling. At minimum, refresh the comment to v0.2.128 and re-evaluate whether agent/Dockerfile:58/72 and the SDK must move together per #215/#215-lockstep. This is a nit only because it does not itself fail CI — but it is a latent correctness trap for the agent runtime and should be resolved before this lands (ideally folded into the fix for the blocker).
N2. Coincidental transitive drop is expected — agent/uv.lock
opentelemetry-instrumentation-elasticsearch is removed as a transitive of the aws-opentelemetry-distro 0.18.0 → 0.19.0 bump (upstream dropped it from its dependency set). No repo code imports it; benign. Noting for the record so a reviewer does not mistake it for an accidental deletion.
Documentation
No docs changes required or expected for a lockfile bump; no Starlight mirror impact. If the fix touches the claude-agent-sdk / Dockerfile lockstep (N1), the inline comment is the only "doc" and must be corrected in place.
Tests & CI
build (agentcore): FAIL — root cause is this PR'stybump (reproduced locally). Blocking.Secrets, deps, and workflow scan: pass.Dead-code detection (advisory): pass (advisory).Validate PR title: pass. CodeQL / auto-approve: skipping (expected).- No new tests needed for a dep bump; the existing immutability negative-tests are exactly what the tool now trips on. Bootstrap synth-coverage: not applicable (no CDK construct/stack/handler change).
Review agents run
This environment does not expose a subagent-dispatch tool, so I performed each in-scope agent's analysis directly (and reproduced CI locally rather than relying on the red check alone):
- code-reviewer — ran (dependency-hygiene / cross-file coupling; found N1, N2).
- comment-analyzer — ran (found N1 comment rot at pyproject.toml:19).
- pr-test-analyzer — ran (analyzed the 7 ty diagnostics against the frozen-model negative-tests; blocker #1).
- silent-failure-hunter — omitted: no error-handling / catch / fallback code in the diff.
- type-design-analyzer — omitted: no new or modified types (lockfile/version strings only).
- /security-review — omitted: no IAM, Cedar, network, secrets, or input-gateway change.
Human heuristics
- Proportionality — Pass. Scope is a routine group bump; no over-engineering.
- Coherence — Concern (N1): the
claude-agent-sdkversion and its Dockerfile CLI lockstep no longer name the same version — same concept, drifted terms acrosspyproject.toml:19andDockerfile:58/72. - Clarity — Concern (N1): the pyproject comment now misstates the pinned version and the lockstep invariant.
- Appropriateness — Concern (blocker #1): the change is not currently maintainable-as-merged because it self-fails the team's typecheck gate; needs the ty regression handled per the #626 precedent before it can land.
…updates Bumps the all-python group with 7 updates in the /agent directory: | Package | From | To | | --- | --- | --- | | [boto3](https://github.com/boto/boto3) | `1.43.40` | `1.43.56` | | [claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-python) | `0.2.110` | `0.2.128` | | [fastapi](https://github.com/fastapi/fastapi) | `0.139.0` | `0.140.7` | | [uvicorn](https://github.com/Kludex/uvicorn) | `0.50.0` | `0.51.0` | | [aws-opentelemetry-distro](https://github.com/aws-observability/aws-otel-python-instrumentation) | `0.18.0` | `0.19.0` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.20` | `0.16.0` | | [ty](https://github.com/astral-sh/ty) | `0.0.56` | `0.0.64` | Updates `boto3` from 1.43.40 to 1.43.56 - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.43.40...1.43.56) Updates `claude-agent-sdk` from 0.2.110 to 0.2.128 - [Release notes](https://github.com/anthropics/claude-agent-sdk-python/releases) - [Changelog](https://github.com/anthropics/claude-agent-sdk-python/blob/main/CHANGELOG.md) - [Commits](anthropics/claude-agent-sdk-python@v0.2.110...v0.2.128) Updates `fastapi` from 0.139.0 to 0.140.7 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.139.0...0.140.7) Updates `uvicorn` from 0.50.0 to 0.51.0 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.50.0...0.51.0) Updates `aws-opentelemetry-distro` from 0.18.0 to 0.19.0 - [Release notes](https://github.com/aws-observability/aws-otel-python-instrumentation/releases) - [Changelog](https://github.com/aws-observability/aws-otel-python-instrumentation/blob/main/CHANGELOG.md) - [Commits](aws-observability/aws-otel-python-instrumentation@v0.18.0...v0.19.0) Updates `ruff` from 0.15.20 to 0.16.0 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.20...0.16.0) Updates `ty` from 0.0.56 to 0.0.64 - [Release notes](https://github.com/astral-sh/ty/releases) - [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md) - [Commits](astral-sh/ty@0.0.56...0.0.64) --- updated-dependencies: - dependency-name: aws-opentelemetry-distro dependency-version: 0.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-python - dependency-name: boto3 dependency-version: 1.43.56 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-python - dependency-name: claude-agent-sdk dependency-version: 0.2.128 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-python - dependency-name: fastapi dependency-version: 0.140.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-python - dependency-name: ruff dependency-version: 0.16.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-python - dependency-name: ty dependency-version: 0.0.63 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-python - dependency-name: uvicorn dependency-version: 0.51.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-python ... Signed-off-by: dependabot[bot] <support@github.com>
0697163 to
db4f469
Compare
1 participant
Bumps the all-python group with 7 updates in the /agent directory:
1.43.401.43.560.2.1100.2.1280.139.00.140.70.50.00.51.00.18.00.19.00.15.200.16.00.0.560.0.64Updates
boto3from 1.43.40 to 1.43.56Commits
72a153dMerge branch 'release-1.43.56'b1b9ff3Bumping version to 1.43.56c7d2f6eAdd changelog entries from botocore2a09bb6Merge branch 'release-1.43.55'cad396bMerge branch 'release-1.43.55' into developffe76baBumping version to 1.43.5574d20c9Add changelog entries from botocorec073381Merge branch 'release-1.43.54'5e554e5Merge branch 'release-1.43.54' into develop2ad1683Bumping version to 1.43.54Updates
claude-agent-sdkfrom 0.2.110 to 0.2.128Release notes
Sourced from claude-agent-sdk's releases.
... (truncated)
Changelog
Sourced from claude-agent-sdk's changelog.
... (truncated)
Commits
f8b9ec9docs: update changelog for v0.2.128ec77673chore: release v0.2.128cadaa63chore: bump bundled CLI version to 2.1.2203145cc6docs: update changelog for v0.2.12726b1a5cchore: release v0.2.127f277fd8chore: bump bundled CLI version to 2.1.219e6e07f1fix(query): don't close stdin on a result frame while tasks are in flight (#1...74fe445docs: update changelog for v0.2.126013cb15chore: release v0.2.126ee68d65chore: bump bundled CLI version to 2.1.218Updates
fastapifrom 0.139.0 to 0.140.7Release notes
Sourced from fastapi's releases.
... (truncated)
Commits
98b12fe🔖 Release version 0.140.7 (#16078)e772894📝 Update release notes24c2a9f⬆️ Upgrade latest-changes to 0.7.1 (#16077)add1d26📝 Update release notes7bcb78d⚡️ Avoid flattening dependencies for OpenAPI (#16076)87095aa📝 Update release notes3d3c691👷 Add OpenAPI dependency benchmarks (#16075)bcd4e89🔖 Release version 0.140.6 (#16074)27c922c📝 Update release notescc96fd3⚡️ Avoid flattening dependencies for request parameters, mainly for OpenAPI (...Updates
uvicornfrom 0.50.0 to 0.51.0Release notes
Sourced from uvicorn's releases.
Changelog
Sourced from uvicorn's changelog.
Commits
e4d0b05Version 0.51.0 (#3028)944e43dRemove colorama from the standard extra (#3027)2e78770Restart workers with overlap on SIGHUP for near-zero-downtime reloads (#3025)a1b570cVersion 0.50.2 (#3022)83c7da7Require websockets>=13.0 for the default sansio implementation (#3021)b4d0116Version 0.50.1 (#3020)2a9151dSplit comma-separatedSec-WebSocket-Protocolvalues in the websockets-sansi...1bf3ab4Cover the excluded-directory branch inFileFilterwith a direct test (#3014)837b5f9Deflake multiprocess, reload, and signal supervisor tests (#2975)Updates
aws-opentelemetry-distrofrom 0.18.0 to 0.19.0Release notes
Sourced from aws-opentelemetry-distro's releases.
... (truncated)
Changelog
Sourced from aws-opentelemetry-distro's changelog.
Commits
821465aPre-release: Update version to 0.19.0 (#834)ed8782fBackport #797 to release/v0.19.x: add Python 3.14 Lambda runtime (#835)4dcbf60test(e2e): wire Python Lambda Lite SDK test into Application Signals E2E (#833)315bdddfix(mcp): extract server-side trace context from HTTP headers when _meta is a...76f8f2dNightly dependency update: OpenTelemetry 1.44.0/0.65b0 (#799)ffa8c72fix(mcp-instrumentation): inject W3C trace context into outbound HTTP headers...d7e49b5Revert "feat(genai): extract gen_ai.tool.call.arguments/result as LLO content...f9bb4f5feat(genai): capture user input and agent output on llama_index invoke_agent ...2b43f03Add best-effort public ECR image signing to release workflow (#828)9356e72Key incident-snapshot dedup hash on operation + throw-site origin (#825)Updates
rufffrom 0.15.20 to 0.16.0Release notes
Sourced from ruff's releases.
... (truncated)
Changelog
Sourced from ruff's changelog.
... (truncated)
Commits
a2635fdBump 0.16.0 (#27136)3433449[ty] Reuse full call diagnostics for implicit setter calls (#27115)2240070Reflectruff: ignoreand--add-ignorestabilization in documentation (#27...17ef711Stabilize--add-ignore(#27125)ef912bbAdd newly stabilized rules to defaults (#27055)b30f040Stabilize new default rules (#27035)bcd70c5Exclude Markdown files fromformat-devruns (#27052)87e51e2Fixformat --checkspans for syntax errors (#27045)afe2723[flake8-gettext] Stabilize qualified-name and built-in binding resolution (...a9702d8[flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)Updates
tyfrom 0.0.56 to 0.0.64Release notes
Sourced from ty's releases.
... (truncated)
Changelog
Sourced from ty's changelog.
... (truncated)
Commits
5e64a13Bump version to 0.0.64 (#4097)46f4915Bump version to 0.0.63 (#4071)df75992Bump version to 0.0.62 (#4057)48dd1fdUpdate prek dependencies (#4059)f53a95eUpdate astral-sh/setup-uv action to v9 (#4060)17d1791Update dependency prek to v0.4.9 (#4058)eb7e7baUpdate documentation on mypy/pyright--strictparity, and achieving maximum...56b2c24Update changelog for 0.0.61 (#4028)4c865c8Bump version to 0.0.61 (#4027)ae554ecBump version to 0.0.60 (#4008)