chore(deps): uv: bump the all-python group across 1 directory with 6 updates#626
Open
dependabot[bot] wants to merge 1 commit into
Open
chore(deps): uv: bump the all-python group across 1 directory with 6 updates#626dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
scottschreckengaust
requested changes
Jul 21, 2026
scottschreckengaust
left a comment
scottschreckengaust
left a comment
Contributor
There was a problem hiding this comment.
Verdict: Request changes
The build (agentcore) check is red, and I reproduced the cause in the worktree: it is a real incompatibility introduced by the ty 0.0.56 → 0.0.58 bump in this PR, not a flake. A second, quieter problem: the claude-agent-sdk bump silently breaks the documented Dockerfile CLI lockstep invariant (#215). Both must be resolved before merge. The other four bumps (boto3, bedrock-agentcore, uvicorn, ruff) are clean.
Vision alignment
Routine dependency hygiene under the repo's own .github/dependabot.yml uv / all-python group — no tenet impact, no blast-radius change, control plane untouched. Governance is satisfied: the Dependabot config is the standing authorization, so the ADR-003 approved-issue gate does not apply, and dependabot/uv/agent/all-python-... is the standard bot branch format (de-facto-waived nit). The change belongs — but a green build is table stakes, and keeping the CLI lockstep intact is exactly the kind of "bounded, improvable control plane" hygiene the vision calls for.
Blocking issues
B1 — ty 0.0.58 bump breaks the typecheck; the required suppressions/fixes are not in this PR (agent/uv.lock:189-211, source unchanged).
Root cause, verified by running both pins against the same worktree source:
uvx ty@0.0.56 check→ All checks passed (exit 0) — this is main's pin.uv run ty check(this PR's0.0.58) → Found 9 diagnostics (exit 1) — identical to the CI log for run 29633654727.
So the bump alone flips the build red. ty 0.0.58 changed two behaviors:
- It now treats frozen-Pydantic (
ConfigDict(frozen=True)) fields as read-only properties and statically errors on assignment. Every failing site is inside a deliberatewith pytest.raises(ValidationError):block that mutates a frozen model to assert the runtime rejects it — a correct, intentional test pattern (agent/tests/test_attachments.py:46;agent/tests/test_models.py:30,63,140,170,416,447). The test code is correct at runtime; only the new checker rejects it. - It tightened dict-literal inference:
content_trust={...}literals are inferred asdict[str, str], no longer assignable toMapping[str, Literal["trusted","untrusted-external","memory"]] | None(agent/tests/test_models.py:237,244).
Fix (pick one, in this PR so it lands atomically with the bump):
- Add targeted
# ty: ignore[invalid-assignment]to the seven frozen-mutation lines and# ty: ignore[invalid-argument-type](or annotate the literal, e.g.content_trust: dict[str, ContentTrust] = {...}/cast(...)) to the twocontent_trustsites; or - Hold
tyat0.0.56(exclude it from this group bump) until the test suppressions are prepared separately.
Merging as-is lands a red build onmain.
B2 — claude-agent-sdk 0.2.116 breaks the #215 CLI lockstep; Dockerfile npm pin and comment not updated (agent/pyproject.toml:19, agent/Dockerfile:49,56).
The pin comment states the SDK is "kept in lockstep with the npm CLI pin in the Dockerfile, #215." Per the upstream v0.2.116 release notes, claude-agent-sdk 0.2.116 bundles Claude CLI 2.1.207, but:
agent/Dockerfile:56still installs@anthropic-ai/claude-code@2.1.191.agent/Dockerfile:49comment still says "Pinned 2.1.191 to match the CLI bundled by claude-agent-sdk 0.2.110."agent/pyproject.toml:19comment still reads.../releases/tag/v0.2.110 (bundles claude CLI 2.1.191...)while pinning0.2.116— stale and now wrong on both the version and the CLI number.
This is precisely the divergence the invariant exists to prevent: the SDK's bundled subprocess CLI (2.1.207) and the globally-installed npm CLI (2.1.191) would drift apart. Fix: bump the Dockerfile npm pin to@anthropic-ai/claude-code@2.1.207and update both comments — or, if the mismatch is deliberate, document why in the comment. Note Dependabot cannot cross-update the Dockerfile npm pin from auvgroup, so this must be done by hand on the branch.
Non-blocking suggestions / nits
- N1 —
tyis unpinned inpyproject.toml(agent/pyproject.toml:88, bare"ty",) yet pinned inuv.lock. That is why Dependabot moved it as part of the group even though there is no explicit==spec to bump. Consider pinningty==<version>like the other dev tools so pre-release type-checker churn cannot silently re-break the build on the next lock refresh. - N2 — Branch name
dependabot/uv/agent/all-python-562714a858does not match(feat|fix|chore|docs)/<issue>-desc; standard for Dependabot, de-facto waived.
Documentation
No docs/guides/design changes required for a dep bump, and the Starlight mirror is untouched (no docs/ edits) — mirror-sync N/A. However, B2 is partly a documentation-accuracy defect: the pyproject.toml:19 and Dockerfile:49 comments are now factually stale (v0.2.110 / CLI 2.1.191) and must be corrected alongside the code fix.
Tests & CI
- No test logic changed; the two edited files are
agent/pyproject.tomlandagent/uv.lockonly. - CI:
build (agentcore)FAILURE (the//agent:typecheckstep — B1).Secrets, deps, and workflow scanSUCCESS,Validate PR titleSUCCESS,Dead-code detectionSUCCESS (advisory), CodeQL NEUTRAL,auto-approveSKIPPED.mergeStateStatus: BLOCKEDon the red check. - Bootstrap synth-coverage: not applicable — no CDK construct/stack/handler or CFN resource-type change.
- Supply-chain integrity (checked directly on the lock diff): all 50 added
url/sdistentries carrysha256:hashes; no hash-stripped or unpinned lines; no newname =package sections (no stealth transitive additions — versions/hashes updated in place). No OSV/malware advisory names uvicorn 0.51.0, boto3 1.43.46, or bedrock-agentcore 1.18.0 as affected. bedrock-agentcore 1.18.0 release notes show no breaking changes.
Review agents run
- /security-review (supply-chain scope) — Ran. Its auto-collected git context resolved to the repo root (empty diff), so I performed the supply-chain assessment directly against the lock diff in the worktree: hash-pin integrity, no unexpected/transitive package additions, and OSV/malware cross-check of the six versions (esp. the poisoned-"fix" pattern from the astro 7.1.0 / MAL-2026-10726 incident). No supply-chain findings.
- code-reviewer — Effectively performed by hand for a two-file manifest diff: the load-bearing issues are B1 (version delta vs. CI) and B2 (cross-file lockstep with the Dockerfile), both covered above.
- silent-failure-hunter — Omitted: no error-handling/fallback code in the diff (manifests only).
- type-design-analyzer — Omitted: no new/changed types (the
tydiagnostics are checker-behavior changes against existing types, addressed in B1). - comment-analyzer — In scope and applied: found the stale
claude-agent-sdkcomment (folded into B2/N1). - pr-test-analyzer — Omitted: no test code added/changed; the failing tests are unchanged and correct at runtime (the checker regressed, not the tests).
Human heuristics
- Proportionality — Pass. A grouped patch/minor dep bump; scope matches the problem.
- Coherence — Concern. The
claude-agent-sdkSDK pin and the Dockerfile npm CLI pin encode the same concept (which Claude CLI version runs) and must move together per #215; this PR moves one and not the other (agent/pyproject.toml:19vsagent/Dockerfile:56). - Clarity — Concern. The
pyproject.toml:19comment now misstates both the SDK release tag (v0.2.110) and the bundled CLI (2.1.191) after the bump to 0.2.116 / CLI 2.1.207. - Appropriateness — Concern. Verified against real upstream behavior, not mocks: I reproduced the typecheck delta with
uvx ty@0.0.56vs0.0.58and confirmed the bundled-CLI number from the upstream release notes. As shipped, the change is not mergeable (red build) and not maintainable-as-is (silent lockstep drift).
…updates Bumps the all-python group with 6 updates in the /agent directory: | Package | From | To | | --- | --- | --- | | [boto3](https://github.com/boto/boto3) | `1.43.40` | `1.43.48` | | [bedrock-agentcore](https://github.com/aws/bedrock-agentcore-sdk-python) | `1.17.0` | `1.18.0` | | [claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-python) | `0.2.110` | `0.2.119` | | [uvicorn](https://github.com/Kludex/uvicorn) | `0.50.0` | `0.51.0` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.20` | `0.15.21` | | [ty](https://github.com/astral-sh/ty) | `0.0.56` | `0.0.59` | Updates `boto3` from 1.43.40 to 1.43.48 - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.43.40...1.43.48) Updates `bedrock-agentcore` from 1.17.0 to 1.18.0 - [Release notes](https://github.com/aws/bedrock-agentcore-sdk-python/releases) - [Changelog](https://github.com/aws/bedrock-agentcore-sdk-python/blob/main/CHANGELOG.md) - [Commits](aws/bedrock-agentcore-sdk-python@v1.17.0...v1.18.0) Updates `claude-agent-sdk` from 0.2.110 to 0.2.119 - [Release notes](https://github.com/anthropics/claude-agent-sdk-python/releases) - [Changelog](https://github.com/anthropics/claude-agent-sdk-python/blob/main/CHANGELOG.md) - [Commits](anthropics/claude-agent-sdk-python@v0.2.110...v0.2.119) Updates `uvicorn` from 0.50.0 to 0.51.0 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.50.0...0.51.0) Updates `ruff` from 0.15.20 to 0.15.21 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.20...0.15.21) Updates `ty` from 0.0.56 to 0.0.59 - [Release notes](https://github.com/astral-sh/ty/releases) - [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md) - [Commits](astral-sh/ty@0.0.56...0.0.59) --- updated-dependencies: - dependency-name: bedrock-agentcore dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-python - dependency-name: boto3 dependency-version: 1.43.46 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-python - dependency-name: claude-agent-sdk dependency-version: 0.2.116 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-python - dependency-name: ruff dependency-version: 0.15.21 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-python - dependency-name: ty dependency-version: 0.0.58 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-python - dependency-name: uvicorn dependency-version: 0.51.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-python ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/uv/agent/all-python-562714a858
branch
from
July 22, 2026 19:00
c25c7f0 to
b1b21df
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the all-python group with 6 updates in the /agent directory:
1.43.401.43.481.17.01.18.00.2.1100.2.1190.50.00.51.00.15.200.15.210.0.560.0.59Updates
boto3from 1.43.40 to 1.43.48Commits
aa40f37Merge branch 'release-1.43.48'13cce5dBumping version to 1.43.4824523abAdd changelog entries from botocore11b9978Merge branch 'release-1.43.47'd1530e3Merge branch 'release-1.43.47' into develop2a7cd54Bumping version to 1.43.4716f140dAdd changelog entries from botocorec7888d6Merge branch 'release-1.43.46'7db70eaMerge branch 'release-1.43.46' into develop1479621Bumping version to 1.43.46Updates
bedrock-agentcorefrom 1.17.0 to 1.18.0Release notes
Sourced from bedrock-agentcore's releases.
Changelog
Sourced from bedrock-agentcore's changelog.
Commits
8df87bbchore: bump version to 1.18.0 (#574)f855616fix: floor monotonic timestamps to milliseconds before comparison (#573)a271ab4fix: order AgentCore Memory events at millisecond resolution (#572)168f4beci: add API reference docs generation workflow (#569)46a0beafix(payments): address langgraph middleware review follow-ups (#570)0a8a486feat(payments): Add LangGraph integration for payment handling (#546)Updates
claude-agent-sdkfrom 0.2.110 to 0.2.119Release notes
Sourced from claude-agent-sdk's releases.
... (truncated)
Changelog
Sourced from claude-agent-sdk's changelog.
... (truncated)
Commits
57f67cddocs: update changelog for v0.2.119d434722chore: release v0.2.119a8da0cachore: bump bundled CLI version to 2.1.210b7e0d0fdocs: update changelog for v0.2.11882fcdb7chore: release v0.2.1185b7e676chore: bump bundled CLI version to 2.1.209059d344docs: update changelog for v0.2.1173aed422chore: release v0.2.11767b6ec3chore: bump bundled CLI version to 2.1.208cc76ac9Escape untrusted issue fields in the Slack notification workflow (#1116)Updates
uvicornfrom 0.50.0 to 0.51.0Release notes
Sourced from uvicorn's releases.
Changelog
Sourced from uvicorn's changelog.
Commits
e4d0b05Version 0.51.0 (#3028)944e43dRemove colorama from the standard extra (#3027)2e78770Restart workers with overlap on SIGHUP for near-zero-downtime reloads (#3025)a1b570cVersion 0.50.2 (#3022)83c7da7Require websockets>=13.0 for the default sansio implementation (#3021)b4d0116Version 0.50.1 (#3020)2a9151dSplit comma-separatedSec-WebSocket-Protocolvalues in the websockets-sansi...1bf3ab4Cover the excluded-directory branch inFileFilterwith a direct test (#3014)837b5f9Deflake multiprocess, reload, and signal supervisor tests (#2975)Updates
rufffrom 0.15.20 to 0.15.21Release notes
Sourced from ruff's releases.
... (truncated)
Changelog
Sourced from ruff's changelog.
... (truncated)
Commits
3e1f636Bump 0.15.21 (#26676)4059807[ty] Infer metaclass-declared attributes on class instances (#26512)013e5d0[ty] Use a dedicated project name type (#26665)7ad39ad[ty] Avoid allocating decorated parameter names (#26666)c36f662Improve performance of rendering edits in preview mode (#26565)ad26408[ty] Gate membership narrowing on__contains__semantics (#25964)4594ca7[ty] Add variant discriminators forCodeGeneratorKind(#26659)1af03da[ty] Pydantic: Fix float conversion in unions (#26655)a004a36[ty] Handle callable classes in solver (#26090)d8ef3b0[ty] Parse all supported Google docstring sections. (#26653)Updates
tyfrom 0.0.56 to 0.0.59Release notes
Sourced from ty's releases.
... (truncated)
Changelog
Sourced from ty's changelog.
... (truncated)
Commits
71bdf31Bump version to 0.0.59 (#3979)17d3f6dBump version to 0.0.58 (#3955)03cfaafBump version to 0.0.57 (#3927)1b3b573Update actions/attest-build-provenance action to v4.1.1 (#3928)0e9cbe1Update actions/cache action to v6.1.0 (#3930)83f4009Update actions/setup-python action to v6.3.0 (#3931)ad99bb9Update prek dependencies (#3929)aeeeed5Update astral-sh/setup-uv action to v8.3.1 (#3932)d171a78Document PYTHONPATH support in module discovery (#3889)c6920a2Fix trailing whitespace (#3911)