deps(py): bump the uv-prod-minor-patch group across 1 directory with 5 updates#89
deps(py): bump the uv-prod-minor-patch group across 1 directory with 5 updates#89dependabot[bot] wants to merge 1 commit into
Conversation
…5 updates Bumps the uv-prod-minor-patch group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [click](https://github.com/pallets/click) | `8.3.2` | `8.3.3` | | [pydantic](https://github.com/pydantic/pydantic) | `2.12.5` | `2.13.3` | | [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.13.1` | `2.14.0` | | [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.57.0` | `2.58.0` | | [uvicorn](https://github.com/Kludex/uvicorn) | `0.43.0` | `0.46.0` | Updates `click` from 8.3.2 to 8.3.3 - [Release notes](https://github.com/pallets/click/releases) - [Changelog](https://github.com/pallets/click/blob/main/CHANGES.rst) - [Commits](pallets/click@8.3.2...8.3.3) Updates `pydantic` from 2.12.5 to 2.13.3 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v2.12.5...v2.13.3) Updates `pydantic-settings` from 2.13.1 to 2.14.0 - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](pydantic/pydantic-settings@v2.13.1...v2.14.0) Updates `sentry-sdk` from 2.57.0 to 2.58.0 - [Release notes](https://github.com/getsentry/sentry-python/releases) - [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md) - [Commits](getsentry/sentry-python@2.57.0...2.58.0) Updates `uvicorn` from 0.43.0 to 0.46.0 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.43.0...0.46.0) --- updated-dependencies: - dependency-name: click dependency-version: 8.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: uv-prod-minor-patch - dependency-name: pydantic dependency-version: 2.13.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv-prod-minor-patch - dependency-name: pydantic-settings dependency-version: 2.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv-prod-minor-patch - dependency-name: sentry-sdk dependency-version: 2.58.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv-prod-minor-patch - dependency-name: uvicorn dependency-version: 0.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv-prod-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
PR author is in the excluded authors list. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Codacy's Analysis Summary0 new issue (≤ 0 issue)
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
This PR updates five primary production dependencies (Click, Pydantic, Pydantic-settings, Sentry-sdk, and Uvicorn). While the direct version bumps are compliant with the requirements, a security vulnerability (CVE-2026-28684) has been identified in the pinned version of python-dotenv within the uv.lock file. As this package is a dependency of pydantic-settings (which is being updated), this security risk should be addressed before merging. Additionally, the lack of automated test verification for these critical infrastructure components is a significant concern.
About this PR
- The PR updates critical infrastructure dependencies (Pydantic, Uvicorn, Sentry) but does not include any accompanying test executions or verification evidence to ensure compatibility with existing application code.
1 comment outside of the diff
uv.lock
line 417🔴 HIGH RISK
The pinned version ofpython-dotenv(1.2.1) is vulnerable to CVE-2026-28684. This vulnerability allows for arbitrary file overwriting via symbolic links. Although this dependency was not explicitly updated in the current group bump, it is a dependency of pydantic-settings and should be updated to version 1.2.2 to mitigate security risks.Try running the following command to address this:
uv update python-dotenv
Test suggestions
- Regression testing of CLI commands to verify Click 8.3.3 behavior (particularly the removal of shell=True in subprocess calls)
- Validation of model data and ValidationInfo integrity in Pydantic 2.13.3
- Verify Sentry SDK 2.58.0 error capture and new redaction logic for AI image URLs
- Verify Uvicorn 0.46.0 server lifecycle and WebSocket message handling (especially wsproto implementation changes)
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Regression testing of CLI commands to verify Click 8.3.3 behavior (particularly the removal of shell=True in subprocess calls)
2. Validation of model data and ValidationInfo integrity in Pydantic 2.13.3
3. Verify Sentry SDK 2.58.0 error capture and new redaction logic for AI image URLs
4. Verify Uvicorn 0.46.0 server lifecycle and WebSocket message handling (especially wsproto implementation changes)
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
Bumps the uv-prod-minor-patch group with 5 updates in the / directory:
8.3.28.3.32.12.52.13.32.13.12.14.02.57.02.58.00.43.00.46.0Updates
clickfrom 8.3.2 to 8.3.3Release notes
Sourced from click's releases.
Changelog
Sourced from click's changelog.
Commits
c06d2d0Release 8.3.3f1f191eApply format guidelines to commits since latest 8.3.2 release (#3343)bb59ba0Apply format guidelines to commits since latest 8.3.2 release4a35225Reduce blast-radius ofUNSETindefault_map(#3240)c07bb93Merge branch 'stable' into unset-in-default-mapc7e1ba8ReorderParameterSource(#3248)76552ffShow default string in prompt (#3328)ac5cec5Reorder ParameterSource from most to least explicit8c452e0Merge branch 'stable' into show-default-string-in-prompt8c95c73Reconcile default value passing and default activation (#3239)Updates
pydanticfrom 2.12.5 to 2.13.3Release notes
Sourced from pydantic's releases.
... (truncated)
Changelog
Sourced from pydantic's changelog.
... (truncated)
Commits
9e9a111Fix backported test1ec8c6aPrepare release v2.13.3fb4f204HandleAttributeErrorsubclasses withfrom_attributesca3ddd1Prepare release v2.13.2000e823FixValidationInfo.field_namemissing withmodel_validate_json()d45d8bePrepare release 2.13.154aca60FixValidationInfo.datamissing withmodel_validate_json()46bf4faFix Pydantic release workflow (#13067)1b359edPrepare release v2.13.0 (#13065)b1bf194Fix model equality when using runtimeextraconfiguration (#13062)Updates
pydantic-settingsfrom 2.13.1 to 2.14.0Release notes
Sourced from pydantic-settings's releases.
Commits
8916beePrepare release 2.14.0 (#848)39e551cFix CLI descriptions lost underpython -OOby falling back to `json_schema_...9ed7f48Bump the python-packages group with 4 updates (#847)617c690Fixcli_ignore_unknown_args=Truenot working on subcommands (#844)577c05fAdd note about Mypy plugin forBaseSettings.__init__()(#842)2355bc5Fix CliPositionalArg[list[CustomType]] crash for custom types (#839)16bd6fdIntroduce zizmor (#838)df8b239Bump boto3 from 1.42.82 to 1.42.83 in the python-packages group (#837)c5401a2Introduce yamlfmt (#836)953e28eBump the python-packages group with 3 updates (#833)Updates
sentry-sdkfrom 2.57.0 to 2.58.0Release notes
Sourced from sentry-sdk's releases.
... (truncated)
Changelog
Sourced from sentry-sdk's changelog.
Commits
ce445d9release: 2.58.0c0c0e9cfeat(litellm): Add async callbacks (#5969)ea74b63test(litellm): Replace mocks withhttpxtypes in rate-limit test (#5975)06ed1bctest(litellm): Replace mocks withhttpxtypes in embedding tests (#5970)66ef2e6test(litellm): Replace mocks withhttpxtypes in nonstreaming `completion()...96ebbf6fix(litellm): Avoid double span exits when streaming (#5933)7e22b5dbuild(deps): bump actions/github-script from 8.0.0 to 9.0.0 (#5979)35151a9build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#5980)d1c5b53build(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1 (#5981)e255aafbuild(deps): bump getsentry/testing-ai-sdk-integrations from 6b1f51ec8af03e19...Updates
uvicornfrom 0.43.0 to 0.46.0Release notes
Sourced from uvicorn's releases.
Changelog
Sourced from uvicorn's changelog.
Commits
b224045Version 0.46.0 (#2918)7375b5bUsebytearrayfor incoming WebSocket message buffer in websockets-sansio (#...d438fb1Supportws_ping_intervalandws_ping_timeoutinwsprotoimplementation ...3e6b964Supportws_max_sizeinwsprotoimplementation (#2915)2c423bdVersion 0.45.0 (#2914)7f027f8Revert "Emithttp.disconnecton server shutdown for streaming responses" (#...73a80c3Add--reset-contextvarsflag to isolate ASGI request context (#2912)45c0b56Revert empty context for ASGI runs (#2911)850d926Raise helpfulImportErrorwhen PyYAML is missing for YAML log config (#2906)fdcacb4Acceptlog_levelstrings case-insensitively (#2907)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions