Skip to content

deps: update uvicorn[standard] requirement from <1,>=0.51.0 to >=0.52.1,<1 in /core-storage-api - #694

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/core-storage-api/uvicorn-standard--gte-0.52.0-and-lt-1
Open

deps: update uvicorn[standard] requirement from <1,>=0.51.0 to >=0.52.1,<1 in /core-storage-api#694
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/core-storage-api/uvicorn-standard--gte-0.52.0-and-lt-1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on uvicorn[standard] to permit the latest version.

Release notes

Sourced from uvicorn[standard]'s releases.

Version 0.52.1

Fixed

  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

Full Changelog: Kludex/uvicorn@0.52.0...0.52.1

Changelog

Sourced from uvicorn[standard]'s changelog.

0.52.1 (August 1, 2026)

Fixed

  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

0.51.0 (July 8, 2026)

Added

  • Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

  • Remove colorama from the standard extra (#3027)

0.50.2 (July 6, 2026)

Fixed

  • Require websockets>=13.0, which the default websockets-sansio implementation needs (#3021)

0.50.1 (July 6, 2026)

Fixed

  • Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansio implementation (#3019)

0.50.0 (July 4, 2026)

If you use WebSockets, note that --ws auto now picks the websockets-sansio implementation. You shouldn't need it, but you can pin --ws websockets to get the deprecated legacy one back.

Changed

... (truncated)

Commits
  • ee8e45c Version 0.52.1 (#3056)
  • b57926d Remove duplicate content headers from WebSocket denial responses on websocket...
  • 49de1b9 chore(deps): bump pymdown-extensions from 10.21.3 to 11.0 (#3042)
  • 2f3fa3a Complete server-initiated closes in SansIO WebSocket protocols (#3053)
  • 8c59d55 chore(deps): bump the github-actions group with 5 updates (#3054)
  • e148451 Handle connection loss during WebSocket write backpressure (#3050)
  • e16a69b Add missing write flow control to websockets-sansio (#3048)
  • ef1dd44 Fold the zttp-only tests back into the HTTP test suite (#3046)
  • 8f1b884 Version 0.52.0 (#3044)
  • f6833db Add experimental zttp HTTP/1.1 protocol (#2979)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added area/core-api REST API, MCP server, route handlers, providers, pipelines. area/core-operations Cron/scheduled background jobs — lifecycle, retention, fan-out. area/core-storage-api PostgreSQL CRUD microservice, ORM, migrations. area/core-worker Background worker — embeddings, enrichment, contradiction detection. dependencies Dependency updates (auto-applied by Dependabot). kind/chore Tooling, CI, dependencies, or other maintenance with no user-visible behavior change. labels Aug 3, 2026
@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Claude Code Review — skipped: PR author 'dependabot[bot]' is not a public member of the 'caura-ai' org

@dependabot
dependabot Bot force-pushed the dependabot/uv/core-storage-api/uvicorn-standard--gte-0.52.0-and-lt-1 branch from b21dda3 to 49b697e Compare August 4, 2026 08:48
@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Claude Code Review — skipped: PR author 'dependabot[bot]' is not a public member of the 'caura-ai' org

@Eldad-Caura Eldad-Caura mentioned this pull request Aug 10, 2026
Merged
Eldad-Caura added a commit that referenced this pull request Aug 10, 2026
@Eldad-Caura
chore(deps): stop Dependabot widening uv requirements it doesn't need…
1053a2b 
… to (#740)

Sets `versioning-strategy: increase-if-necessary` on the **uv entry
only**, so a requirement in `pyproject.toml` is touched only when the
new version actually falls outside it.

## Eight open PRs were doing nothing else

The default (`increase`) raises the floor on every release even when the
range already permits the new version:

```
uvicorn[standard]  >=0.51.0,<1  →  >=0.52.0,<1     for a version >=0.51.0,<1 already allowed
```

…once per service directory (#692, #693, #694, #695), plus #645, #646,
#650, #691. **The `uv.lock` in all four directories was already being
updated correctly** — the manifest edit on top was pure churn.

Grouping can't absorb them: `update-types` classifies the semver bump of
a *resolved version*, and a floor-raise on an already-satisfied range
has no such classification. That's precisely why `uv-minor-patch`
collapses the lock updates into one PR (#703, *"across 4 directories"*)
while these arrive one at a time.

## Why this setting is right here and wrong elsewhere

This is the same option I **rejected** for `caura-ops` two days ago, and
the distinction is the whole point:

| | this repo's `uv` entry | `caura-ops` |
|---|---|---|
| requirement shape | **capped** — 22 of 30 in `core-api` have an upper
bound | open-ended `>=X`, no cap |
| is "outside the range" reachable? | **yes** — uvicorn 1.0 vs `<1`
still files a PR | never |
| effect of this setting | de-duplicates churn | would have **silenced
Python updates entirely** |
| correct fix | this | commit a lock + switch ecosystem (done
2026-08-09) |

## Deliberately scoped

The **`pip` entry in this same file is untouched.** It has mixed
open-ended and capped requirements and no committed root lock, so it
needs the `caura-ops` treatment and would be actively harmed by this
setting. The file comment says exactly that, placed where someone would
be tempted to copy the line.

Verified the value is valid against the schema and that it landed on the
`uv` entry alone — `pip`, both `npm` entries, `github-actions` and
`docker` all remain on the default.

## Honest limit, and a cheap test

**I could not confirm `increase-if-necessary`'s precise semantics from
the docs** — that section of the options reference truncated on three
separate fetches. This rests on the option name plus the observed
capped-vs-open behaviour across these eight PRs.

It's falsifiable next Monday: the scheduled run should produce
**lock-only PRs with no `update X requirement from >=A to >=B` titles**.
If widenings still appear, my reading is wrong and this is a one-line
revert. I'd rather ship it with the test stated than assert it works.

## What to expect

The eight open widening PRs become obsolete. Dependabot may supersede
them on the next run; if not, they can be closed. The remaining five
`caura-memclaw` widenings (#633–#637) come from the `pip` entry and need
the separate lockfile change.

@claude

Signed-off-by: eldad-caura <eldad@caura.ai>
@dependabot dependabot Bot changed the title deps: update uvicorn[standard] requirement from <1,>=0.51.0 to >=0.52.0,<1 in /core-storage-api deps: update uvicorn[standard] requirement from <1,>=0.51.0 to >=0.52.1,<1 in /core-storage-api Aug 13, 2026
@dependabot
dependabot Bot force-pushed the dependabot/uv/core-storage-api/uvicorn-standard--gte-0.52.0-and-lt-1 branch from 49b697e to 9bd9f7f Compare August 13, 2026 18:35
@github-actions

github-actions Bot commented Aug 13, 2026

Copy link
Copy Markdown
Contributor

Claude Code Review — skipped: PR author 'dependabot[bot]' is not a public member of the 'caura-ai' org

@dependabot
deps: update uvicorn[standard] requirement in /core-storage-api
81d64e3 
Updates the requirements on [uvicorn[standard]](https://github.com/Kludex/uvicorn) to permit the latest version.
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.51.0...0.52.1)

---
updated-dependencies:
- dependency-name: uvicorn[standard]
  dependency-version: 0.52.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/core-storage-api/uvicorn-standard--gte-0.52.0-and-lt-1 branch from 9bd9f7f to 81d64e3 Compare August 13, 2026 19:44
@github-actions

github-actions Bot commented Aug 13, 2026

Copy link
Copy Markdown
Contributor

Claude Code Review — skipped: PR author 'dependabot[bot]' is not a public member of the 'caura-ai' org

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/core-api REST API, MCP server, route handlers, providers, pipelines. area/core-operations Cron/scheduled background jobs — lifecycle, retention, fan-out. area/core-storage-api PostgreSQL CRUD microservice, ORM, migrations. area/core-worker Background worker — embeddings, enrichment, contradiction detection. dependencies Dependency updates (auto-applied by Dependabot). kind/chore Tooling, CI, dependencies, or other maintenance with no user-visible behavior change.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants