Repository navigation
chore(deps): update the locked dependencies - #3
Merged
Merged
Conversation
`uv lock --upgrade` across the board — 18 packages, no pyproject floors moved, so this only changes what a fresh `uv sync` resolves. The one that matters is cryptography 49.0.0 -> 50.0.0, which closes the high severity advisory Dependabot has been reporting on main. The rest is routine: fastapi 0.140.0 -> 0.141.1, starlette 1.3.1 -> 1.5.0, uvicorn 0.51.0 -> 0.52.1, websockets 16.1.1 -> 17.0.1, databricks-sdk 0.122.0 -> 0.125.0. Bumps the ruff-pre-commit rev alongside ruff in the lock. CI's lint job runs pre-commit, not `uv run ruff`, so leaving the two on different versions means the gate and local runs can disagree about the same file. Note the Docker suite does not cover this: both Dockerfiles install with `pip install -e .` / `uv pip install -e .`, which resolve from PyPI rather than the lock. The lock governs local development, so this was verified by booting the server on it — health, a Unity Catalog create, and an MCP initialize all fine. pydantic-settings 2.15.0 emits a new IncompleteFieldDefinitionWarning for FastMCP's `lifespan` field, whose annotation forward-references FastMCP itself. It comes from the mcp package, not from our Settings, and nothing reads that field from the environment.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
uv lock --upgradeacross the board — 18 packages. Nopyproject.tomlfloors moved, so this only changes what a freshuv syncresolves.The one that matters:
cryptography 49.0.0 → 50.0.0, which closes the high-severity advisory Dependabot has been reporting onmain.The rest is routine:
Plus annotated-doc, cffi, filelock, google-auth, packaging, platformdirs, python-discovery, virtualenv, wrapt.
Also bumps the
ruff-pre-commitrev in step with ruff in the lock. CI's lint job runs pre-commit, notuv run ruff, so leaving the two on different versions means the gate and local runs can disagree about the same file.Verification
Worth being explicit about what does and does not cover this: the Docker suite does not test the lock. Both Dockerfiles install with
pip install -e ./uv pip install -e ., which resolve from PyPI rather thanuv.lock. The lock governs local development.uvx pre-commit run --all-files— the exact CI lint gate, passes on ruff 0.16.2.uv run ruff check/ruff format --check— clean, no new findings./_minilake/health, a Unity Catalog catalog create, and an MCPinitializeover Streamable HTTP (200). That covers the starlette/uvicorn/fastapi and sse-starlette upgrades, including the MCP sub-app mount.One thing to know
pydantic-settings 2.15.0emits a newIncompleteFieldDefinitionWarningat import:It comes from
mcp's FastMCPSettings(mcp/server/fastmcp/server.py:124), whoselifespanannotation forward-referencesFastMCPitself — not from ourSettings. Nothing reads that field from the environment, and MCP works. Cosmetic, upstream's to fix.