deps: Update uvicorn requirement from ~=0.34.0 to >=0.34,<0.49 - #32
deps: Update uvicorn requirement from ~=0.34.0 to >=0.34,<0.49#32dependabot[bot] wants to merge 1 commit into
Conversation
Updates the requirements on [uvicorn](https://github.com/Kludex/uvicorn) to permit the latest version. - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.34.0...0.48.0) --- updated-dependencies: - dependency-name: uvicorn dependency-version: 0.48.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
Obsolete: |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Ten dependabot PRs had been open for months, and all ten were obsolete — every pin they proposed had already been applied by hand, usually wider (e.g. #32 asked for `uvicorn<0.49`; pyproject was already `<0.52`). The five pip PRs sat at exactly `open-pull-requests-limit: 5`. At the limit dependabot stops evaluating the ecosystem, so it never rebased or closed the superseded ones (#11 lingered from March despite #32 covering it) and could not propose anything new — security updates included — until the backlog was cleared by hand. Group instead of raising the limit: a catch-all `runtime-dependencies` declared last for pip (groups match in declaration order, so `dev-dependencies` and `ml-dependencies` still claim theirs first), and one group for github-actions. Turns ten single-dependency PRs into two or three grouped ones a week. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 participant
Updates the requirements on uvicorn to permit the latest version.
Release notes
Sourced from uvicorn's releases.
Changelog
Sourced from uvicorn's changelog.
... (truncated)
Commits
73e84e5Version 0.48.0 (#2951)45ea116Ignore duplicate forwarding headers inProxyHeadersMiddleware(#2944)dd4394cchore(deps): bump idna from 3.11 to 3.15 (#2941)abe0781Defaultssl_cipherstoNoneand use OpenSSL defaults (#2940)479a2c0Version 0.47.0 (#2937)89347fdAdd 7-day cooldown for dependency resolution via uv exclude-newer (#2936)767315bDrop unused contents/actions permissions from zizmor workflow (#2935)f25ee43chore(deps): bump urllib3 from 2.6.3 to 2.7.0 (#2933)8782666Fix typo indocs/deployment/index.md. (#2932)ad5ff87Treatfd=0as a valid file descriptor with reload/workers (#2927)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)