deps(pip): bump the pip-major group across 1 directory with 4 updates#556
deps(pip): bump the pip-major group across 1 directory with 4 updates#556dependabot[bot] wants to merge 1 commit into
Conversation
Greptile SummaryDependabot bump of four major-version pip dependencies:
Confidence Score: 4/5Mostly safe to merge, but the starlette 0.50→1.2.1 bump in docker-requirements.txt conflicts with the pinned fastapi==0.128.0, which was designed for the starlette 0.x API. The starlette jump crosses a major-version boundary that introduced breaking changes to SessionMiddleware, HTTPEndpoint, and StaticFiles — APIs that FastAPI 0.128.0 relies on. The hash-locked requirements file will install both packages without a resolver error, so the breakage would only surface at runtime. The remaining three package bumps (rich, textual, zipp) are straightforward and carry no compatibility risk for this project. docker-requirements.txt — the starlette/fastapi version pairing needs attention before this is deployed. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[pyproject.toml\nhol-guard] -->|direct dep| B[rich 14.2.0 to 15.0.0]
A -->|direct dep| C[cisco-ai-skill-scanner 2.0.9]
C -->|transitive| D[textual 7.5.0 to 8.2.7]
C -->|transitive| E[zipp 3.23.1 to 4.1.0]
F[docker-requirements.txt] -->|pinned| G[fastapi 0.128.0]
F -->|pinned| H[starlette 0.50.0 to 1.2.1]
G -->|expects starlette 0.x| I{Conflict}
H -->|provides starlette 1.x| I
style I fill:#f99,stroke:#c00
style G fill:#fdd,stroke:#c00
style H fill:#fdd,stroke:#c00
Reviews (3): Last reviewed commit: "deps(pip): bump the pip-major group acro..." | Re-trigger Greptile |
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/pip/pip-major-0963034b02
branch
from
c1570dc to
dab0b37
Compare
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (2 files)
Other Observations (not in diff)None. The existing Greptile summary correctly notes the Reviewed by laguna-m.1-20260312:free · 505,166 tokens |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| starlette==1.2.1 \ | ||
| --hash=sha256:4de0082d08c8f6764a85a54cf1120d6939507a19905c7768acad2a9f875d2b89 \ | ||
| --hash=sha256:9b9b5ebb992e67d6093741e63c2f59e4f6fff986f81163c087867bd7b924b3f6 | ||
| # via |
There was a problem hiding this comment.
docker-requirements.txt pins fastapi==0.128.0 (line ~491) alongside starlette==1.2.1, but FastAPI's own release notes show that the 0.128.x patch series explicitly caps its starlette dependency at starlette>=0.40.0,<1.0.0 (documented under the 0.128.3 release). Starlette 1.0 included breaking changes to SessionMiddleware, HTTPEndpoint dispatch, and StaticFiles.lookup_path that FastAPI 0.128 was not designed to handle. Because docker-requirements.txt uses --hash pinning, pip will force-install both packages without raising a resolver conflict, meaning the incompatibility surfaces only at runtime — likely as an ImportError or AttributeError when FastAPI attempts to use starlette internals that changed in 1.0. Consider also bumping fastapi to a version that explicitly supports starlette ≥1.0, or holding starlette back to the 0.x series until fastapi is upgraded.
Bumps the pip-major group with 4 updates in the / directory: [rich](https://github.com/Textualize/rich), [starlette](https://github.com/Kludex/starlette), [textual](https://github.com/Textualize/textual) and [zipp](https://github.com/jaraco/zipp). Updates `rich` from 14.2.0 to 15.0.0 - [Release notes](https://github.com/Textualize/rich/releases) - [Changelog](https://github.com/Textualize/rich/blob/master/CHANGELOG.md) - [Commits](Textualize/rich@v14.2.0...v15.0.0) Updates `starlette` from 0.50.0 to 1.2.1 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.2.1) Updates `textual` from 7.5.0 to 8.2.7 - [Release notes](https://github.com/Textualize/textual/releases) - [Changelog](https://github.com/Textualize/textual/blob/main/CHANGELOG.md) - [Commits](Textualize/textual@v7.5.0...v8.2.7) Updates `zipp` from 3.23.1 to 4.1.0 - [Release notes](https://github.com/jaraco/zipp/releases) - [Changelog](https://github.com/jaraco/zipp/blob/main/NEWS.rst) - [Commits](jaraco/zipp@v3.23.1...v4.1.0) --- updated-dependencies: - dependency-name: rich dependency-version: 15.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: pip-major - dependency-name: starlette dependency-version: 1.2.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: pip-major - dependency-name: textual dependency-version: 8.2.7 dependency-type: direct:production update-type: version-update:semver-major dependency-group: pip-major - dependency-name: zipp dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: pip-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/pip/pip-major-0963034b02
branch
from
dab0b37 to
aa33c92
Compare
Bumps the pip-major group with 4 updates in the / directory: rich, starlette, textual and zipp.
Updates
richfrom 14.2.0 to 15.0.0Release notes
Sourced from rich's releases.
... (truncated)
Changelog
Sourced from rich's changelog.
... (truncated)
Commits
6ac483ccorrection458a910Merge pull request #4080 from Textualize/bump150082e06e0changelogd6556bcbump to 15.0.0ffe2edcMerge pull request #4079 from Textualize/inline-table-codecf3b5a1changelog77f0edbremove comments7ef2d05fix inline code in table cells19c67b9Merge pull request #4077 from Textualize/isattry494b795changelogUpdates
starlettefrom 0.50.0 to 1.2.1Release notes
Sourced from starlette's releases.
... (truncated)
Changelog
Sourced from starlette's changelog.
... (truncated)
Commits
ef773feVersion 1.2.1 (#3306)3fc68a7Add sponsors section to docs sidebar (#3305)b053f7bchore(deps): bump the python-packages group across 1 directory with 6 updates...1478775Add assert error for requires() when request param is not Request type (#3298)6576547Describe disconnected-after-response behavior in test docstring (#3243)9cb1553Use same module (httpx|httpx2) for type checking as for runtime (#3304)4060987Version 1.2.0 (#3300)1e289caMigrate docs deploy from Cloudflare Pages to Workers Static Assets (#3282)100f05aAddhttpx2as a dev dependency (#3295)508023bSupport httpx2 in the test client (#3291)Updates
textualfrom 7.5.0 to 8.2.7Release notes
Sourced from textual's releases.
... (truncated)
Changelog
Sourced from textual's changelog.
... (truncated)
Commits
182277fMerge pull request #6546 from Textualize/ansi-opacity49cbec4bumpb24ef07snapshot24e34e4changelog0c8bbc7text opacity change3b04f31Merge pull request #6543 from Textualize/textarea-actions913f5d2test fixes1027c41ctrl+f replaced with ctrl+delete01fb6fdctrl+backspace binding5431709wordsUpdates
zippfrom 3.23.1 to 4.1.0Changelog
Sourced from zipp's changelog.
Commits
29a7a55Finalizebf9bf8cMerge pull request #154 from ShipItAndPray/fix-129-iterdir-notadirectorya43226aAdd news fragment.5b41b49Merge branch 'main' into fix-129-iterdir-notadirectoryf2f3e79👹 Feed the hobgoblins (delint).d14b720Merge https://github.com/jaraco/skeletonb8f1030More aggressively direct Agents not to add generated artifacts.fb8483bUse Python 3.14 as the latest stable.91aed9ajaraco/skeleton#198225b2afAdd agent guidance pointing to skeleton documentation.