chore(deps): batch outstanding Dependabot updates - #3
Merged
Conversation
- astral-sh/setup-uv v5.4.2/v6 -> v8.1.0 - pypa/gh-action-pypi-publish v1.12.4 -> v1.14.0 - googleapis/release-please-action v4 -> v5
Combines these upstream Dependabot PRs into one re-locked batch: - google-agentic-commerce#112 pydantic 2.11.7 -> 2.13.4 (prod group) - google-agentic-commerce#113 dev group: mypy 1.18.2->1.20.2, pytest-mock 3.14.1->3.15.1, ruff 0.13.1->0.15.13, trio 0.30.0->0.33.0 - google-agentic-commerce#115 pytest-cov 6.2.1 -> 7.1.0 - google-agentic-commerce#122 aiohttp 3.13.4 -> 3.14.0 - google-agentic-commerce#108 idna 3.10 -> 3.15 - google-agentic-commerce#106 protobuf 6.32.0 -> 6.33.5 - google-agentic-commerce#100 pyasn1 0.6.1 -> 0.6.3 - google-agentic-commerce#103 pygments 2.19.2 -> 2.20.0 - google-agentic-commerce#105 requests 2.32.4 -> 2.33.0 - google-agentic-commerce#104 werkzeug 3.1.3 -> 3.1.6 - google-agentic-commerce#96 urllib3 2.5.0 -> 2.7.0 - google-agentic-commerce#101 flask 3.1.1 -> 3.1.3 Re-locked with uv; pytest (3 passed) and ruff check/format pass. Excludes majors x402 2.8.0 (google-agentic-commerce#117), a2a-sdk 1.0.2 (google-agentic-commerce#114), starlette 1.0.1 (google-agentic-commerce#123).
Combines upstream Dependabot PRs: - google-agentic-commerce#116 adk-demo-safe group: google-adk 1.14.1->1.33.0, click 8.2.1->8.3.3, uvicorn 0.35.0->0.46.0, web3 7.10.0->7.16.0, cdp-sdk 1.32.0->1.46.0, ruff 0.13.1->0.15.12, plus transitive cascade - google-agentic-commerce#118 pytest-cov: obviated (google-adk 1.33 no longer pulls pytest-cov) Re-locked with uv (181 packages); uv sync --group lint and ruff check/format pass.
…ic-commerce#123) The one upstream major that re-locks and passes cleanly on top of the safe batch. uv resolves starlette 1.0.1 without bumping a2a-sdk 0.3.1, i.e. a2a-sdk 0.3.1 already declares compatibility with starlette 1.0; package import, the test suite (3 passed), and ruff check/format all pass. Transitively pulls fastapi 0.116.1 -> 0.136.3 plus annotated-doc, fastar and pydantic-extra-types.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Combines the outstanding upstream Dependabot PRs into a single re-locked batch on the fork.
Lock files were regenerated with
uvrather than by merging the Dependabot branches: 9 of those upstream branches were cut from an oldermain, so their diffs would have reverted the Dependabot-config (google-agentic-commerce#109) and release-please (google-agentic-commerce#86) migrations. Re-locking reproduces each bump cleanly and also fixes a pre-existing stale lock entry (x402-a2awas pinned at1.0.0while the package is0.1.0).✅ Included — safe batch (minor / patch / transitive / dev + CI)
python/x402_a2a—ba0efa6python/examples/adk-demo—84d076cGitHub Actions —
b021c8f✅ Included — major that re-locks and passes cleanly
x402_a2a) —18a62ea. uv resolves it without bumping a2a-sdk 0.3.1, i.e. a2a-sdk 0.3.1 already declares starlette 1.0 support; import + tests + lint pass. Pulls fastapi 0.116→0.136 transitively. Kept as its own commit so it's trivial to drop if undesired.⛔ Deferred — majors that need source migration (not in this PR)
No module named 'x402.types'. x402 reorganized its module layout; ~7 source files import fromx402. It also drops many transitive deps (starlette/werkzeug/web3/uvicorn…), so several of the transitive bumps above disappear once this lands. Needs a dedicated migration PR.cannot import name 'TextPart' from 'a2a.types'. ~5 source/test files affected.Verification
python/x402_a2a:uv lock --checkclean ·pytest→ 3 passed ·ruff check+ruff format --checkpass.python/examples/adk-demo:uv lock --checkclean ·uv sync --group lintinstalls (181 pkgs) ·ruff check+ruff format --checkpass.