Skip to content

Refresh uv.lock and adopt click 8.4 in the show-code gate#130

Merged
alexkroman merged 2 commits into
mainfrom
deps/refresh-lock
Jun 12, 2026
Merged

Refresh uv.lock and adopt click 8.4 in the show-code gate#130
alexkroman merged 2 commits into
mainfrom
deps/refresh-lock

Conversation

@alexkroman

Copy link
Copy Markdown
Collaborator

What

Refreshes uv.lock to the newest releases safe-chain's minimum-package-age gate currently permits, and fixes the one code site a dependency bump broke.

Upgraded

package change
click 8.1.8 → 8.4.1
diff-cover 10.2.1 → 10.3.0
httpx2 (+ httpcore2) 2.2.0 → 2.4.0
hypothesis 6.155.1 → 6.155.2
pyright 1.1.409 → 1.1.410
python-multipart 0.0.29 → 0.0.32
uvicorn 0.48.0 → 0.49.0
truststore added (transitive via httpx2 2.4)

Held back (still under safe-chain's min-age gate, not bypassed)

assemblyai 0.64.16, openai 2.41.1, yt-dlp 2026.6.9, syrupy 5.3.2, ruff 0.15.17 — left at current locked versions; adoptable once they age past the gate. Each upgrade above was verified to both lock and uv sync (yt-dlp resolved at lock time but its wheel download was still age-blocked, so it was excluded).

Code change

click 8.2 removed CliRunner(mix_stderr=...), breaking scripts/generated_code_compile_gate.py. Switched that script from real click's CliRunner to typer.testing.CliRunner, invoking the Typer app directly. This also drops the typer.main.get_command() round-trip and a now-latent Command-type mismatch between external click and typer's vendored click.

Verification

./scripts/check.shAll checks passed. (2058 tests, 99.5% coverage; CodeQL self-skips locally as documented). Script also passes pyright standalone.

🤖 Generated with Claude Code

alexkroman-assembly and others added 2 commits June 12, 2026 14:12
Upgrade the dependency lock to the newest releases safe-chain's
minimum-package-age gate permits: click 8.1.8->8.4.1, diff-cover
10.2.1->10.3.0, httpx2 2.2.0->2.4.0 (pulls in truststore), hypothesis
6.155.1->6.155.2, pyright 1.1.409->1.1.410, python-multipart
0.0.29->0.0.32, uvicorn 0.48.0->0.49.0. assemblyai, openai, yt-dlp,
syrupy, and ruff stay pinned because their latest releases are still
under the age gate.

click 8.2 removed CliRunner(mix_stderr=...), which broke
scripts/generated_code_compile_gate.py. Switch that script from real
click's CliRunner to typer.testing.CliRunner, invoking the Typer app
directly. This drops the typer.main.get_command() round-trip and the
now-distinct Command type mismatch between external click and typer's
vendored click.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@alexkroman alexkroman enabled auto-merge June 12, 2026 21:13
@alexkroman alexkroman added this pull request to the merge queue Jun 12, 2026
Merged via the queue into main with commit 57205e8 Jun 12, 2026
16 checks passed
@alexkroman alexkroman deleted the deps/refresh-lock branch June 12, 2026 21:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants