chore(deps): consolidate the safe Dependabot backlog + unbreak lint CI - #124
Open
lingzhong wants to merge 6 commits into
Open
chore(deps): consolidate the safe Dependabot backlog + unbreak lint CI#124lingzhong wants to merge 6 commits into
lingzhong wants to merge 6 commits into
Conversation
- astral-sh/setup-uv v5.4.2/v6 -> v8.1.0 - pypa/gh-action-pypi-publish v1.12.4 -> v1.14.0 - googleapis/release-please-action v4 -> v5
Combines these upstream Dependabot PRs into one re-locked batch: - google-agentic-commerce#112 pydantic 2.11.7 -> 2.13.4 (prod group) - google-agentic-commerce#113 dev group: mypy 1.18.2->1.20.2, pytest-mock 3.14.1->3.15.1, ruff 0.13.1->0.15.13, trio 0.30.0->0.33.0 - google-agentic-commerce#115 pytest-cov 6.2.1 -> 7.1.0 - google-agentic-commerce#122 aiohttp 3.13.4 -> 3.14.0 - google-agentic-commerce#108 idna 3.10 -> 3.15 - google-agentic-commerce#106 protobuf 6.32.0 -> 6.33.5 - google-agentic-commerce#100 pyasn1 0.6.1 -> 0.6.3 - google-agentic-commerce#103 pygments 2.19.2 -> 2.20.0 - google-agentic-commerce#105 requests 2.32.4 -> 2.33.0 - google-agentic-commerce#104 werkzeug 3.1.3 -> 3.1.6 - google-agentic-commerce#96 urllib3 2.5.0 -> 2.7.0 - google-agentic-commerce#101 flask 3.1.1 -> 3.1.3 Re-locked with uv; pytest (3 passed) and ruff check/format pass. Excludes majors x402 2.8.0 (google-agentic-commerce#117), a2a-sdk 1.0.2 (google-agentic-commerce#114), starlette 1.0.1 (google-agentic-commerce#123).
Combines upstream Dependabot PRs: - google-agentic-commerce#116 adk-demo-safe group: google-adk 1.14.1->1.33.0, click 8.2.1->8.3.3, uvicorn 0.35.0->0.46.0, web3 7.10.0->7.16.0, cdp-sdk 1.32.0->1.46.0, ruff 0.13.1->0.15.12, plus transitive cascade - google-agentic-commerce#118 pytest-cov: obviated (google-adk 1.33 no longer pulls pytest-cov) Re-locked with uv (181 packages); uv sync --group lint and ruff check/format pass.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request updates various dependencies and development tools across the workspace, including google-adk, click, uvicorn, web3, pydantic, pytest-cov, pytest-mock, trio, mypy, and ruff. The feedback suggests aligning the ruff version constraint to >=0.15.13 in both pyproject.toml files to ensure consistent linting and formatting rules across the project.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
The lint jobs invoke `uvx ruff` with no version constraint, so each run downloads whatever ruff is newest at that moment. Ruff 0.16 shipped between 2026-07-06 and 2026-07-24 and tightened several rules, so the lint job began failing on unchanged code: `main` at 125db55 reports 99 errors in python/x402_a2a and 20 in python/examples/adk-demo. This is visible on Dependabot's own PRs -- google-agentic-commerce#147 (2026-07-06) passed lint, while google-agentic-commerce#154 (2026-07-24) and google-agentic-commerce#160 (2026-08-04) both fail it. Pinning to 0.15.18 restores green CI without touching any source, and makes lint results reproducible over time. The ruff dev-dependency floor in both pyproject.toml files matches, so local and CI agree.
Four of the bumps this PR consolidated were superseded while it sat open. Re-locked to the versions Dependabot now proposes, and picked up one new safe PR (google-agentic-commerce#131). python/x402_a2a: aiohttp 3.14.0 -> 3.14.3 (google-agentic-commerce#160, supersedes google-agentic-commerce#122) pyasn1 0.6.3 -> 0.6.4 (google-agentic-commerce#154, supersedes google-agentic-commerce#100) python-multipart 0.0.27 -> 0.0.31 (google-agentic-commerce#131, new) pytest 9.0.3 -> 9.1.0 (google-agentic-commerce#135, supersedes google-agentic-commerce#113) pytest-asyncio 1.3.0 -> 1.4.0 (google-agentic-commerce#135) ruff 0.15.13 -> 0.15.18 (google-agentic-commerce#135) python/examples/adk-demo: click 8.3.3 -> 8.4.1 (google-agentic-commerce#147, supersedes google-agentic-commerce#116) uvicorn 0.46.0 -> 0.49.0 (google-agentic-commerce#147) cdp-sdk 1.46.0 -> 1.47.1 (google-agentic-commerce#147) ruff 0.15.12 -> 0.15.18 (google-agentic-commerce#147) pytest-mock, trio and web3 were already at or above the new targets. The ruff floor is now 0.15.18 in both pyproject.toml files, resolving the inconsistency flagged in review (adk-demo had >=0.15.12 against x402_a2a's >=0.15.13) and matching the version pinned in CI. Majors remain excluded: starlette (google-agentic-commerce#133), x402 (google-agentic-commerce#117), a2a-sdk (google-agentic-commerce#114).
lingzhong
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
A single re-locked PR that consolidates the safe (non-major) Dependabot backlog, plus a one-line CI fix that unbreaks the lint job repo-wide.
Merging this lets Dependabot auto-close the safe PRs it supersedes, taking the dependency backlog from 20 → 4 (the remaining 4 are majors, intentionally left for your review).
Lock files were regenerated with
uv(floor bumps +uv lock) pinned to the versions Dependabot proposes, rather than merging the individual branches — several of the older Dependabot branches were cut before the grouping config (#109) and the release-please migration (#86) landed, so merging them directly would revert those.1.
ci: pin ruff to 0.15.18 in lint workflowsThe lint job is currently failing on every open PR in this repo, including Dependabot's own, on unchanged code.
Both lint workflows invoke
uvx ruffwith no version constraint, so each run installs whatever ruff is newest at that moment. Ruff 0.16 shipped between 2026-07-06 and 2026-07-24 and tightened several rules. Checking outmainat 125db55 and running today's ruff reproduces it with no changes applied:Visible on your own Dependabot PRs — #147 (2026-07-06) passed lint; #154 (2026-07-24) and #160 (2026-08-04) both fail it.
Pinning to 0.15.18 restores green CI without touching a single source file, and makes lint reproducible over time. The
ruffdev-dependency floor in bothpyproject.tomlfiles is now 0.15.18 to match, so local and CI agree.Maintenance caveat: this pin lives in a
run:step, which Dependabot'sgithub-actionsecosystem does not track (it only followsuses:references), so it will not be bumped automatically. Raising it is a one-line edit in both lint workflows.If you'd rather adopt ruff 0.16 and fix the 99 findings, that's a reasonable alternative — but it's a source-changing PR, separate from this one.
2.
chore(deps): ...— the consolidated safe bumpspython/x402_a2a— #112 (pydantic), #135 (dev group: pytest, pytest-asyncio, pytest-mock, trio, ruff), #115 (pytest-cov), #160 (aiohttp), #131 (python-multipart), #154 (pyasn1), #108 (idna), #106 (protobuf), #105 (requests), #104 (werkzeug), #103 (pygments), #101 (flask), #96 (urllib3)python/examples/adk-demo— #147 (adk-demo-safe group: google-adk, click, uvicorn, web3, cdp-sdk, ruff + cascade), #118 (pytest-cov — satisfied indirectly: thepytest-covspecifier recorded in this workspace's lock is inherited fromx402_a2a's dev group via the editable path dependency, and this PR raises it from>=6.2.1to>=7.1.0. pytest-cov is not itself a resolved package in the adk-demo lock.)GitHub Actions — #111 (setup-uv v8.1.0, gh-action-pypi-publish v1.14.0, release-please-action v5)
This PR was opened on 2026-06-05 and refreshed on 2026-08-10; #122, #100, #113 and #116 were superseded by #160, #154, #135 and #147 in the interim and are now tracked at the newer versions.
Intentionally excluded (majors → your existing human-review policy)
x402.typesremoved); needs source changes (~7 files).TextPartremoved froma2a.types); needs source changes.Verification
python/x402_a2a:uv lock --checkclean ·pytest→ 3 passed · ruff 0.15.18 check + format cleanpython/examples/adk-demo:uv lock --checkclean · ruff 0.15.18 check + format cleanpyproject.tomlfloors, and workflow files only.main(125db55); no conflicts.Happy to split the CI pin into its own PR, or to close this entirely if you'd rather merge the individual Dependabot PRs — just say the word.