Skip to content

build(deps): Bump uvicorn from 0.51.0 to 0.52.0 in /services/account_unification - #27

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/services/account_unification/uvicorn-0.52.0
Closed

build(deps): Bump uvicorn from 0.51.0 to 0.52.0 in /services/account_unification#27
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/services/account_unification/uvicorn-0.52.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 29, 2026

Copy link
Copy Markdown
Contributor

Bumps uvicorn from 0.51.0 to 0.52.0.

Release notes

Sourced from uvicorn's releases.

Version 0.52.0

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

Full Changelog: Kludex/uvicorn@0.51.0...0.52.0

Changelog

Sourced from uvicorn's changelog.

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by CodeRabbit

  • Chores
    • Uvicorn을 0.52.0 버전으로 업데이트했습니다.
    • 개발 환경에서 사용하는 패키지 무결성 해시를 새 버전에 맞게 갱신했습니다.

Bumps [uvicorn](https://github.com/Kludex/uvicorn) from 0.51.0 to 0.52.0.
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.51.0...0.52.0)

---
updated-dependencies:
- dependency-name: uvicorn
  dependency-version: 0.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jul 29, 2026
@coderabbitai

coderabbitai Bot commented Jul 29, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

Uvicorn 런타임 및 개발 의존성 버전이 0.51.0에서 0.52.0으로 변경되었으며, 개발 의존성 파일의 SHA256 해시도 갱신되었습니다.

Changes

Uvicorn 의존성 갱신

Layer / File(s) Summary
Uvicorn 의존성 버전 정렬
services/account_unification/pyproject.toml, services/account_unification/requirements-dev.txt
프로젝트 의존성과 개발 의존성의 Uvicorn 버전을 0.52.0으로 변경하고 새 버전의 SHA256 해시를 반영했습니다.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed 제목이 /services/account_unification의 uvicorn 버전 업그레이드를 정확히 요약하고 있습니다.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Fix failing CI checks
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch dependabot/pip/services/account_unification/uvicorn-0.52.0

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@services/account_unification/pyproject.toml`:
- Line 17: Update the dependency lock data for uvicorn to 0.52.0 so it matches
the pinned version in pyproject.toml, regenerating the lockfile through the
project’s standard uv workflow and ensuring no 0.51.0 entries remain for this
dependency.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 22bd39e4-e858-4270-9cf6-47f8e652cbbe

📥 Commits

Reviewing files that changed from the base of the PR and between 9385306 and 81c76f5.

📒 Files selected for processing (2)
  • services/account_unification/pyproject.toml
  • services/account_unification/requirements-dev.txt

"httpx==0.28.1",
"pyyaml==6.0.3",
"uvicorn==0.51.0",
"uvicorn==0.52.0",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu
cd services/account_unification
uv lock --check
rg -n 'uvicorn.*0\.(51|52)\.0|version = "0\.(51|52)\.0"' pyproject.toml requirements-dev.txt uv.lock

Repository: ContextualWisdomLab/keyverse

Length of output: 206


🏁 Script executed:

#!/bin/bash
set -eu

# Locate the relevant files
git ls-files 'services/account_unification/pyproject.toml' 'services/account_unification/uv.lock'

# Show the specific dependency entries with line numbers
echo '--- pyproject.toml ---'
rg -n 'uvicorn|0\.51\.0|0\.52\.0' services/account_unification/pyproject.toml || true

echo '--- uv.lock ---'
rg -n 'uvicorn|0\.51\.0|0\.52\.0' services/account_unification/uv.lock || true

Repository: ContextualWisdomLab/keyverse

Length of output: 1027


services/account_unification/uv.lock도 함께 갱신해야 합니다.
pyproject.tomluvicorn==0.52.0인데 uv.lock은 아직 uvicorn==0.51.0을 고정하고 있습니다. lockfile을 다시 생성하지 않으면 잠금 검증이 어긋나거나 0.51.0이 설치될 수 있습니다.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/account_unification/pyproject.toml` at line 17, Update the
dependency lock data for uvicorn to 0.52.0 so it matches the pinned version in
pyproject.toml, regenerating the lockfile through the project’s standard uv
workflow and ensuring no 0.51.0 entries remain for this dependency.

Copy link
Copy Markdown
Contributor

Superseded by #33, which applies this bump together with the required uv.lock regeneration and the related dependency closure. Closing the lock-inconsistent duplicate.

@seonghobae seonghobae closed this Aug 3, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/pip/services/account_unification/uvicorn-0.52.0 branch August 3, 2026 01:42
seonghobae added a commit that referenced this pull request Aug 3, 2026
* build(deps): consolidate account-unification dependency updates and pin ruff rule set

Dependabot opened five PRs (#27-#31) bumping account_unification dependencies,
but each only edited pyproject.toml (or targeted a transitive package) without
regenerating uv.lock, so every one fails `uv sync --locked` on the
account-unification-tests gate ("The lockfile at uv.lock needs to be updated").

Apply all five bumps in one lock-consistent change:

- fastapi 0.139.0 -> 0.140.13 (pulls starlette 1.3.1)
- uvicorn 0.51.0 -> 0.52.0
- ruff 0.15.21 -> 0.16.0 (dev)
- annotated-doc 0.0.4 -> 0.0.5 (transitive)
- annotated-types 0.7.0 -> 0.8.0 (transitive)

ruff 0.16.0 widened its implicit default rule set (adding flake8-bugbear,
pyupgrade, flake8-pyi, flake8-blind-except, RUF100, isort), which surfaced 21
lints on code that previously passed. Pin the classic default select
(["E4","E7","E9","F"]) so the established lint policy stays explicit and stable
across ruff upgrades instead of silently changing on a version bump.

Verified in services/account_unification: `uv sync --locked --extra dev`,
`ruff check app tests tools` (All checks passed), `interrogate .` (100%),
`pytest -q` (52 passed).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AqtiEQFfuYFsS75Aku9tPT

* fix(security): restrict healthcheck URL scheme and resolve Semgrep urllib finding

The org-central "Semgrep (multi-language SAST)" gate reports a real Medium
(WARNING) finding on every keyverse PR, blocking OpenCode approval:

  python.lang.security.audit.dynamic-urllib-use-detected
  services/account_unification/app/healthcheck.py:18 — dynamic value passed to
  urllib.request.urlopen (urllib honours file://, so a caller-controlled URL
  could read arbitrary files).

Mitigate the actual risk by rejecting any non-http(s) scheme before opening the
URL (closes the file:// vector), then annotate the audited call with a narrow,
documented `# nosemgrep` for that single rule. Add a regression test for the
rejected-scheme path. Fixed at base so all open keyverse PRs inherit a clean
SAST gate.

Verified in services/account_unification: `ruff check app tests tools`,
`interrogate .` (100%), `pytest -q`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AqtiEQFfuYFsS75Aku9tPT

* chore: drop superseded healthcheck changes from dependency PR

* test: drop superseded healthcheck coverage from dependency PR

* build(deps-dev): bump anyio to 4.14.2

Integrate the validated AnyIO lockfile refresh into the consolidated account-unification dependency branch.

* build(deps-dev): bump certifi to 2026.7.22

Integrate the validated certificate bundle lockfile refresh into the consolidated account-unification dependency branch.

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: opencode-agent[bot] <219766164+opencode-agent[bot]@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant