chore(deps): update FastAPI and Redis with synchronized backend locks - #706
chore(deps): update FastAPI and Redis with synchronized backend locks#706dependabot[bot] wants to merge 15 commits into
Conversation
dependabot
Bot
added
dependencies
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughChangesFastAPI 의존성 업데이트
Estimated code review effort: 1 (Trivial) | ~2분 Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/pyproject.toml`:
- Line 14: Regenerate both backend/requirements.lock and
backend/requirements-dev.lock from the FastAPI declaration in pyproject.toml so
they resolve FastAPI to at least 0.141.1 and contain matching package hashes;
then run the required security scans.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 7ace3dcf-ce10-484b-89d3-02241b444e9e
📒 Files selected for processing (1)
backend/pyproject.toml
| requires-python = ">=3.10,<3.15" | ||
| dependencies = [ | ||
| "fastapi>=0.137.1", | ||
| "fastapi>=0.141.1", |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- changed files ---'
git status --short
printf '%s\n' '--- pyproject.toml ---'
cat -n backend/pyproject.toml | sed -n '1,45p'
printf '%s\n' '--- FastAPI entries in lock files ---'
rg -n -C 3 '^fastapi([<=>!~]|$)|fastapi==' backend/requirements.lock backend/requirements-dev.lock || true
printf '%s\n' '--- lock file headers and relevant sections ---'
sed -n '1,35p' backend/requirements.lock
sed -n '450,485p' backend/requirements.lock
printf '%s\n' '--- diff summary and diff for relevant files ---'
git diff --stat
git diff -- backend/pyproject.toml backend/requirements.lock backend/requirements-dev.lockRepository: ContextualWisdomLab/pg-erd-cloud
Length of output: 7738
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- changed files ---'
git status --short
printf '%s\n' '--- pyproject.toml ---'
cat -n backend/pyproject.toml | sed -n '1,45p'
printf '%s\n' '--- FastAPI entries in lock files ---'
rg -n -C 3 '^fastapi([<=>!~]|$)|fastapi==' backend/requirements.lock backend/requirements-dev.lock || true
printf '%s\n' '--- lock file headers and relevant sections ---'
sed -n '1,35p' backend/requirements.lock
sed -n '450,485p' backend/requirements.lock
printf '%s\n' '--- diff summary and relevant diff ---'
git diff --stat
git diff -- backend/pyproject.toml backend/requirements.lock backend/requirements-dev.lockRepository: ContextualWisdomLab/pg-erd-cloud
Length of output: 7728
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- references to the lock files and install commands ---'
rg -n -C 3 'requirements(-dev)?\.lock|uv pip (sync|install|compile)|pip(-compile)? .*requirements' .github backend Makefile* justfile* 2>/dev/null || true
printf '%s\n' '--- all FastAPI declarations and pins ---'
rg -n -C 2 'fastapi|FastAPI' --glob '!backend/requirements*.lock' .
printf '%s\n' '--- pyproject remainder and lock generation metadata ---'
cat -n backend/pyproject.toml | sed -n '35,130p'
rg -n -C 2 '^# .*uv pip compile|^fastapi==' backend/requirements.lock backend/requirements-dev.lockRepository: ContextualWisdomLab/pg-erd-cloud
Length of output: 28715
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- references to lock files and install commands ---'
rg -n -C 3 'requirements(-dev)?\.lock|uv pip (sync|install|compile)|pip(-compile)? .*requirements' .github backend Makefile* justfile* 2>/dev/null || true
printf '%s\n' '--- all FastAPI declarations and pins ---'
rg -n -C 2 'fastapi|FastAPI' --glob '!backend/requirements*.lock' .
printf '%s\n' '--- pyproject remainder and lock metadata ---'
cat -n backend/pyproject.toml | sed -n '35,130p'
rg -n -C 2 '^# .*uv pip compile|^fastapi==' backend/requirements.lock backend/requirements-dev.lockRepository: ContextualWisdomLab/pg-erd-cloud
Length of output: 28700
두 해시 잠금 파일을 FastAPI 선언과 동기화하세요.
backend/requirements.lock와 backend/requirements-dev.lock는 fastapi==0.137.1을 고정합니다. 이는 backend/pyproject.toml의 최소 버전 0.141.1보다 낮습니다. Docker와 CI는 이 잠금 파일을 사용하므로 FastAPI 0.137.1을 설치합니다.
두 잠금 파일을 재생성하여 fastapi>=0.141.1을 만족하는 버전과 해시를 반영하세요. 갱신 후 필수 보안 스캔을 실행하세요.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@backend/pyproject.toml` at line 14, Regenerate both backend/requirements.lock
and backend/requirements-dev.lock from the FastAPI declaration in pyproject.toml
so they resolve FastAPI to at least 0.141.1 and contain matching package hashes;
then run the required security scans.
Source: Coding guidelines
|
@dependabot rebase |
|
@jules Please make this dependency update operationally complete before merge:
|
Updates the requirements on [fastapi](https://github.com/fastapi/fastapi) to permit the latest version. - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.137.1...0.141.1) --- updated-dependencies: - dependency-name: fastapi dependency-version: 0.141.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
8a8c55b to
b2f638a
Compare
seonghobae
changed the title
|
@jules Complete the consolidated FastAPI and Redis dependency upgrade on the current branch. Regenerate both hash-locked backend environments from |
|
Superseded by #725. The Dependabot-owned branch could not persist regenerated hash-locked environments because its workflow token is intentionally read-only. #725 reproduces the same atomic FastAPI/Redis upgrade on a maintainer-owned branch, has regenerated both lockfiles to FastAPI 0.141.1 and Redis 8.1.0, validated hash-only installation, mypy, and the complete backend test suite, and removes the one-shot repair machinery. Closing this duplicate without resolving its still-valid lockfile thread on the stale branch. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
What
Consolidates the overlapping backend dependency upgrades into one atomic, reviewable change:
>=0.137.1→>=0.141.1>=5.0.0→>=8.1.0Why
The original FastAPI and Redis Dependabot PRs both modify
backend/pyproject.tomland the same two lockfiles. Merging them independently would create avoidable conflicts and could temporarily leave declarations and installed lockfile versions inconsistent. This PR is the canonical combined upgrade; PR #705 is superseded.Required validation
The one-shot current-head repair workflow must:
backend/requirements.lockandbackend/requirements-dev.lockwith hashes;>=0.141.1and Redis>=8.1.0;--require-hashes;The PR remains draft until those checks and the unresolved lockfile review finding are satisfied.