Skip to content

chore(deps): update python dependencies - #158

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/python-dependencies
Open

chore(deps): update python dependencies#158
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/python-dependencies

Conversation

@renovate

@renovate renovate Bot commented Jun 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
dynaconf 3.2.13 → 3.3.3 age confidence
fastapi (changelog) 0.136.1 → 0.140.7 age confidence
mypy (changelog) 2.1.0 → 2.3.0 age confidence
pre-commit 4.6.0 → 4.6.1 age confidence
prometheus-client 0.25.0 → 0.26.0 age confidence
pytest (changelog) 9.0.3 → 9.1.1 age confidence
pytest-asyncio (changelog) 1.3.0 → 1.4.0 age confidence
regex 2026.7.10 → 2026.7.19 age confidence
ruff (source, changelog) 0.15.13 → 0.16.0 age confidence
uvicorn (changelog) 0.47.0 → 0.51.0 age confidence

Release Notes

dynaconf/dynaconf (dynaconf)

v3.3.3

Compare Source

Bug Fixes
Docs
Chore

v3.3.2

Compare Source

Bug Fixes
Chore

v3.3.1

Compare Source

Bug Fixes
  • Remove call to deprecated functions on public APIs (#​1404). By Pedro Brochado.
  • Improve converage of DataList and DataDict (#​1403). By Pedro Brochado.
  • support Python 3.14 Union type repr and dict iteration changes. By Pedro Brochado.
  • preserve nested dict key order when object_merge merges old into new. By Vincent Gao.
  • prevent RecursionError on dotted set with bracket in first segment. By Sarath Francis.
Chore
  • Remove support for EOL python 3.9 (#​1396). By Pedro Brochado.
  • Add support for python 3.14. By Pedro Brochado.
  • bump version to 3.3.1-dev0. By pedro-psb.

v3.3.0

Compare Source

Bug Fixes
  • Fix index merge padding scalar lists with empty lists instead of None (#​1380). By Sarath Francis.
  • raise FileNotFoundError from load_file on missing path when silent=False. By Sai Asish Y.
  • support Redis URL scheme for TLS connections (#​1343). By Varun Chawla.
  • support async contexts. By Bruno Rocha.
  • codacy suggestions. By Bruno Rocha.
  • more improvements on edge cases of converters. By Bruno Rocha.
  • Extra improvements on converters. By Bruno Rocha.
  • Replace regex on read_file converter. By Bruno Rocha.
  • replace regex with simple if on get converter. By Bruno Rocha.
  • 1307 run fix_absolute_urls eagerly for Django. By Bruno Rocha.
  • make DataDict.dir compatible with Box. By Pedro Brochado.
  • get method to return Any type. (#​1315). By Bruno Cesar Rocha.
  • remove unnecessary recursive evaluation call on Settings.get. By Pedro Brochado.
  • -k must exit code 1 when key do not exist (#​1293). By Bruno Rocha.
  • use sys.argv instead of click.get_os_args (#​1292). By Bruno Rocha.
  • make raw variables private (#​1287). By Fabricio Aguiar.
  • Better way for CLI to find the Django Settings. By Bruno Rocha.
  • handle empty hooks and boolean environments.. By Bruno Rocha.
  • Hotfix hook collector to avoid eager evaluation. (#​1255) (#​1256). By Bruno Rocha.
  • Ensure an error is raised when loading files with syntax errors (#​1243). By Pedro Brochado.
  • using merge with comma separated values will infer type [port of #​1240]. By Bruno Rocha.
  • Handle @insert with -1. By Bruno Rocha.
  • Redis loader must handle an empty prefix. By Bruno Rocha.
  • Ensure CLI can load settings from a base DJANGO_SETTINGS_MODULE. By Bruno Rocha.
  • When --json is used in CLI list, does not print django app detected. By Bruno Rocha.
  • when using load_file method, inspect will save module:linenumber from the caller.. By Bruno Rocha.
  • Implement repr for combined validators (#​1200). By Bruno Rocha.
  • lazy validator's default value would evalute early (#​1197). By Pedro Brochado.
  • Fixed an error that would raise when using get_history() with lazy values (#​1184). By Pedro Brochado.
  • del attr wouldnt work with lowercase (#​1168). By Pedro Brochado.
  • Improve performance of Access Hooks (#​1164). By Bruno Rocha.
  • Ignore if file doesn't exist (#​1159). By Bruno Rocha.
  • Enable merge on settings.populate_obj (#​1118). By Bruno Rocha.
  • Add Django 5 transformation of STATIC_URL (#​1117). By Bruno Rocha.
  • Allow disabling transformation of dict to Dynabox (#​1115). By Bruno Rocha.
  • Support Nested Subtypes and Enclosed types (#​1109). By Bruno Rocha.
  • #​1088 fresh vars definition case insensitive (#​1091). By Bruno Rocha.
  • Allow multiple validators with cast for the same field (#​1080). By Bruno Rocha.
  • Stop converting default when is_type_of is set to str (#​1066). By Bruno Rocha.
Features
  • add Settings-level caching mechanism. By Pedro Brochado.
  • Add @read_file converter (#​1291). By Bruno Rocha.
  • envless load file (#​1295). By Bruno Rocha.
  • Run CLI as module with python -m dynaconf (#​1290). By Bruno Rocha.
  • Migrate project to pyproject.toml for modern Python packaging (#​1269). By Pedro Brochado.
  • Add CLI command inspect -m debug (#​1251) (#​1254). By Bruno Rocha.
  • Add support for decorated hooks on settings files (#​1246) (#​1249). By Bruno Rocha.
  • populate_obj now takes convert_to_dict (#​1238). By Bruno Rocha.
  • Allow multiple current_envs at the same time. By Bruno Rocha.
  • Allow loading envvars from multiple prefixes in order. By Bruno Rocha.
  • populate_obj now allow filtering out internal attributes.. By Bruno Rocha.
  • Add @insert token to trigger list.insert. By Bruno Rocha.
  • Implement items_validators and more complete type checking. By Bruno Rocha.
  • Add Typed Settings support (tech preview) (#​1107). By Bruno Rocha.
  • dynaconf list with --json will print valid JSON to stdout (#​1106). By Bruno Rocha.
  • Add VAULT_TOKEN_RENEW_FOR_DYNACONF config/code (#​1094). By Bruno Bonfils.
Docs
  • Fix broken links and wrong merge behavior. By Pedro Brochado.
  • Some basic doco typos/updates. (#​1316). By Jason Lingohr.
  • clarification on redis hash title when using custom envvar prefixes (#​1266). By FM-17.
  • Docs for @insert, Multiple envvar_prefixes and composed current envs. By Bruno Rocha.
  • Fix missing quote in doc (#​1100). By kgolawski.
  • Add section about new release-process and improve overall docs structure (#​1096). By Pedro Brochado.
Chore
  • disable backport creation for 3.3.0 release only. By Pedro Brochado.
  • go back to using uv sync + uv run. By Pedro Brochado.
  • update to use uv tool install. By Pedro Brochado.
  • add missing venv creation to uv install. By Pedro Brochado.
  • remove unnecessary uv install from workflows. By Pedro Brochado.
  • don't generate uv.lock for release/publish workflows. By Pedro Brochado.
  • add new release 'framework' to the CI. By Pedro Brochado.
  • fix linting errors. By Pedro Brochado.
  • add pylint(errors) ruff rule and fixed in code. By vyuroshchin.
  • refactor CI workflows into reusable components (#​1359). By Pedro Brochado.
  • refactor release workflow into reusable components. By Pedro Brochado.
  • update precommit versions and fix warnings (#​1351). By Vladimir.
  • Preparations for 3.3.0 release (#​1344). By Pedro Brochado.
  • update bench script and scenarios. By Pedro Brochado.
  • round up the bench_tool and scenarios implementation. By Pedro Brochado.
  • implement proper setup for timeit. By Pedro Brochado.
  • Update python versions usage on metadata and CI (#​1281). By Pedro Brochado.
  • Install dynaconf from distribution wheels used by 'make dist'. By Pedro Brochado.
  • Improve package build robustness. By Pedro Brochado (aider).
  • ensure JSON can be inserted using @insert. By Bruno Rocha.
  • Add workflow to publish docs to netlify (#​1079). By Pedro Brochado.
fastapi/fastapi (fastapi)

v0.140.7

Compare Source

Refactors
Internal

v0.140.6

Compare Source

Refactors
  • ⚡️ Avoid flattening dependencies for request parameters, mainly for OpenAPI. PR #​16073 by @​tiangolo.

v0.140.5

Compare Source

Refactors

v0.140.4

Compare Source

v0.140.3

Compare Source

Refactors

v0.140.2

Compare Source

Refactors
Internal

v0.140.1

Compare Source

Refactors
  • ♻️ Update the lru_cache limit for dependencies to account for large apps. PR #​16062 by @​tiangolo.

v0.140.0

Compare Source

Refactors
Docs
Internal

v0.139.2

Compare Source

Fixes
  • 🐛 Refactor router route building to make it thread-safe, mainly relevant for tests running in parallel threads (uncommon). PR #​16013 by @​tiangolo.

v0.139.1

Compare Source

Fixes
Docs
  • 📝 Fix topic repository list not being displayed and skip_users not being applied. PR #​15995 by @​YuriiMotov.
Translations
Internal

v0.139.0

Compare Source

Features
  • ✨ Support dependencies in app.frontend(), e.g. for automatic cookie authentication for the frontend. PR #​15908 by @​tiangolo.
Translations
Internal

v0.138.2

Compare Source

Refactors
  • ♻️ Make app.frontend() return 404 for methods other than GET or HEAD with no static file matches. PR #​15863 by @​tiangolo.
Internal

v0.138.1

Compare Source

Refactors
Internal

v0.138.0

Compare Source

Features
  • ✨ Add support for app.frontend("/", directory="dist") and router.frontend("/", directory="dist"). PR #​15800 by @​tiangolo.
Docs
Translations
Internal

v0.137.2

Compare Source

Features
  • ✨ Add iter_route_contexts() for advanced use cases that used to use router.routes (e.g. Jupyverse). PR #​15785 by @​tiangolo.
Translations
Internal

v0.137.1

Compare Source

Fixes

v0.137.0

Compare Source

Breaking Changes

Unblocks ✨ SO MANY THINGS ✨

Before this, router.include_router(other_router) would take each path operation from other_router and "clone" it, or recreate it from scratch.

This would mean that in the end there was only one top level router, part of the app.

The way it is structured here is that there are a few additional classes to handle intermediate metadata for router and route inclusion. That way the information of "router X includes Y and Y includes Z" is stored somewhere, without affecting (recreating / clonning) the final route.

Non Objectives

Dependencies for 404: previously I intended to support dependencies that would be executed even for 404, but that would conflict with the fact that a router could not find a match, but the next router did find a match. Executing dependencies in the router that did not find a match would not make sense, they could consume the request, body, etc. This original idea was discarded.

Specific Breaking Changes

Now router.routes is no longer a plain list of APIRoute objects, it can contain these intermediate objects that can contain additional routers, forming a tree.

Any logic that depended on iterating on the router.routes directly would be affected, that logic cannot expect to be able to extract data from a plain list of routes, as it's no longer a plain list but a tree.

Additionally, any logic that iterated on router.routes to modify them would now also see these new objects, and would not see all the routes in the app.

router.routes should be considered an internal implementation detail, only passed around to the FastAPI functions that need it.

Features
  • Adding routes (path operations) after a router is included now works, they are reflected as they are not copied.
  • Including subrouter in mainrouter can be done before adding routes (path operations) to subrouter, because now the the entire object is stored instead of copying the routes.
  • As routes are not copied, in some cases that might save some memory.
Alpha Features

This is not documented yet, so it's not officially supported yet and could change in the future.

But, as APIRoute and APIRouter instances are now preserved, they could be customized.

APIRouter has two new methods, .matches() and .handle(), counterpart to the existing ones in APIRoute. With this a router could customize how it matches and handles requests. For example, it could match only requests that include some specific header, for example for handling versions in headers.

Still, for now, consider this very experimental and potentially changing and breaking in the future.

Future Features Enabled
  • Custom APIRoute subclasses (undocumented, but alraedy works as desccribed above)
  • Custom APIRouter subclasses (undocumented, but already works as described above)
  • Dependencies per router
  • Exception handlers per router
  • Middleware per router
  • Other features planned
Docs
Translations
Internal

v0.136.3

Compare Source

Refactors
  • ♻️ Do not accept underscore headers when using convert_underscores=True (the default). PR #​15589 by @​tiangolo.
python/mypy (mypy)

v2.3.0

[Compare Source](https://redir

✂ Note

PR body was truncated to here.

@renovate renovate Bot added the dependencies label Jun 1, 2026
@renovate
renovate Bot requested a review from dannysauer as a code owner June 1, 2026 01:01
@renovate
renovate Bot enabled auto-merge (squash) June 1, 2026 01:01
@renovate renovate Bot added the dependencies label Jun 1, 2026
@codecov

codecov Bot commented Jun 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (820c34f) to head (b4ba298).

Additional details and impacted files 
@@            Coverage Diff            @@
##              main      #158   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            9         9           
  Lines         1133      1133           
  Branches       134       134           
=========================================
  Hits          1133      1133
Flag Coverage Δ
unittests 100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@github-actions

github-actions Bot commented Jun 1, 2026

Copy link
Copy Markdown
Contributor

🐳 Docker image built and pushed: ghcr.io/dannysauer/stampbot:pr-372d15a

@renovate
renovate Bot force-pushed the renovate/python-dependencies branch from 0b458ad to 6822388 Compare June 8, 2026 05:29
@github-actions

github-actions Bot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

🐳 Docker image built and pushed: ghcr.io/dannysauer/stampbot:pr-0ed440e

@renovate
renovate Bot force-pushed the renovate/python-dependencies branch from 664636a to 9ac621e Compare June 8, 2026 05:31
@github-actions

github-actions Bot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

🐳 Docker image built and pushed: ghcr.io/dannysauer/stampbot:pr-322e0d6

@renovate
renovate Bot force-pushed the renovate/python-dependencies branch from b4ba298 to 2a0707b Compare June 26, 2026 03:49
@renovate

renovate Bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: poetry.lock
Updating dependencies
Resolving dependencies...

Creating virtualenv stampbot-k5xu-svk-py3.14 in /home/ubuntu/.cache/pypoetry/virtualenvs

The current project's supported Python range (>=3.15) is not compatible with some of the required packages Python requirement:
  - dynaconf requires Python <3.15,>=3.10, so it will not be installable for Python >=3.15

Because stampbot depends on dynaconf (3.3.3) which requires Python <3.15,>=3.10, version solving failed.

  * Check your dependencies Python requirement: The Python requirement can be specified via the `python` or `markers` properties

    For dynaconf, a possible solution would be to set the `python` property to "<empty>"

    https://python-poetry.org/docs/dependency-specification/#python-restricted-dependencies,
    https://python-poetry.org/docs/dependency-specification/#using-environment-markers

@renovate
renovate Bot force-pushed the renovate/python-dependencies branch 15 times, most recently from 5e89582 to b415d2f Compare June 28, 2026 15:39
@renovate renovate Bot added the autoapprove Stampbot automatic approval label Jun 28, 2026
@renovate
renovate Bot force-pushed the renovate/python-dependencies branch 2 times, most recently from f722867 to 65e7ccb Compare June 29, 2026 17:01
@renovate
renovate Bot force-pushed the renovate/python-dependencies branch 13 times, most recently from bb8d30f to ec421f7 Compare July 15, 2026 17:53
@dannysauer

dannysauer commented Jul 15, 2026

Copy link
Copy Markdown
Owner

Handoff for the next agent: do not merge the current branch as-is. Renovate's artifact failure records the immediate Dynaconf conflict, but the complete recovery is:

  1. Start from current main and set Stampbot's supported Python range to >=3.11,<3.15. Dynaconf 3.3.2 does not support Python 3.15, so advertising an open-ended >=3.11 range makes Poetry solve for an unsupported interpreter.
  2. Reapply the seven intended dependency updates from this PR, splitting or dropping one only if the resolver or tests provide a documented reason.
  3. Regenerate poetry.lock, then export/sync requirements.txt; review both artifacts for unrelated drift.
  4. Keep and run the Python 3.11, 3.12, 3.13, and 3.14 test matrix. Do not add or claim Python 3.15 support until every runtime dependency supports it.
  5. Run lint, type checking, the full test suite, container build/scan, and Helm CI from the rebuilt branch.
  6. Prefer one signed replacement commit based on current main, then fast-forward after CI and review. Do not merge a branch with a failed lock/export status.

If current dependency releases make the seven-package batch impossible, record the smallest coherent subset and let Renovate recreate the remaining updates rather than hand-editing an inconsistent lock.

@renovate
renovate Bot force-pushed the renovate/python-dependencies branch 8 times, most recently from 7be8cbf to 484e055 Compare July 23, 2026 03:10
@renovate
renovate Bot force-pushed the renovate/python-dependencies branch 7 times, most recently from 054db4f to 2cb9390 Compare July 27, 2026 13:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dannysauer dannysauer Awaiting requested review from dannysauer dannysauer is a code owner

Assignees

No one assigned

Labels

autoapprove Stampbot automatic approval dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dannysauer