build(deps): Bump uvicorn from 0.51.0 to 0.52.0 in /services/account_unification - #27
Conversation
Bumps [uvicorn](https://github.com/Kludex/uvicorn) from 0.51.0 to 0.52.0. - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.51.0...0.52.0) --- updated-dependencies: - dependency-name: uvicorn dependency-version: 0.52.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
📝 WalkthroughWalkthroughUvicorn 런타임 및 개발 의존성 버전이 0.51.0에서 0.52.0으로 변경되었으며, 개발 의존성 파일의 SHA256 해시도 갱신되었습니다. ChangesUvicorn 의존성 갱신
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@services/account_unification/pyproject.toml`:
- Line 17: Update the dependency lock data for uvicorn to 0.52.0 so it matches
the pinned version in pyproject.toml, regenerating the lockfile through the
project’s standard uv workflow and ensuring no 0.51.0 entries remain for this
dependency.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 22bd39e4-e858-4270-9cf6-47f8e652cbbe
📒 Files selected for processing (2)
services/account_unification/pyproject.tomlservices/account_unification/requirements-dev.txt
| "httpx==0.28.1", | ||
| "pyyaml==6.0.3", | ||
| "uvicorn==0.51.0", | ||
| "uvicorn==0.52.0", |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
cd services/account_unification
uv lock --check
rg -n 'uvicorn.*0\.(51|52)\.0|version = "0\.(51|52)\.0"' pyproject.toml requirements-dev.txt uv.lockRepository: ContextualWisdomLab/keyverse
Length of output: 206
🏁 Script executed:
#!/bin/bash
set -eu
# Locate the relevant files
git ls-files 'services/account_unification/pyproject.toml' 'services/account_unification/uv.lock'
# Show the specific dependency entries with line numbers
echo '--- pyproject.toml ---'
rg -n 'uvicorn|0\.51\.0|0\.52\.0' services/account_unification/pyproject.toml || true
echo '--- uv.lock ---'
rg -n 'uvicorn|0\.51\.0|0\.52\.0' services/account_unification/uv.lock || trueRepository: ContextualWisdomLab/keyverse
Length of output: 1027
services/account_unification/uv.lock도 함께 갱신해야 합니다.
pyproject.toml은 uvicorn==0.52.0인데 uv.lock은 아직 uvicorn==0.51.0을 고정하고 있습니다. lockfile을 다시 생성하지 않으면 잠금 검증이 어긋나거나 0.51.0이 설치될 수 있습니다.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@services/account_unification/pyproject.toml` at line 17, Update the
dependency lock data for uvicorn to 0.52.0 so it matches the pinned version in
pyproject.toml, regenerating the lockfile through the project’s standard uv
workflow and ensuring no 0.51.0 entries remain for this dependency.
|
Superseded by #33, which applies this bump together with the required |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
* build(deps): consolidate account-unification dependency updates and pin ruff rule set Dependabot opened five PRs (#27-#31) bumping account_unification dependencies, but each only edited pyproject.toml (or targeted a transitive package) without regenerating uv.lock, so every one fails `uv sync --locked` on the account-unification-tests gate ("The lockfile at uv.lock needs to be updated"). Apply all five bumps in one lock-consistent change: - fastapi 0.139.0 -> 0.140.13 (pulls starlette 1.3.1) - uvicorn 0.51.0 -> 0.52.0 - ruff 0.15.21 -> 0.16.0 (dev) - annotated-doc 0.0.4 -> 0.0.5 (transitive) - annotated-types 0.7.0 -> 0.8.0 (transitive) ruff 0.16.0 widened its implicit default rule set (adding flake8-bugbear, pyupgrade, flake8-pyi, flake8-blind-except, RUF100, isort), which surfaced 21 lints on code that previously passed. Pin the classic default select (["E4","E7","E9","F"]) so the established lint policy stays explicit and stable across ruff upgrades instead of silently changing on a version bump. Verified in services/account_unification: `uv sync --locked --extra dev`, `ruff check app tests tools` (All checks passed), `interrogate .` (100%), `pytest -q` (52 passed). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AqtiEQFfuYFsS75Aku9tPT * fix(security): restrict healthcheck URL scheme and resolve Semgrep urllib finding The org-central "Semgrep (multi-language SAST)" gate reports a real Medium (WARNING) finding on every keyverse PR, blocking OpenCode approval: python.lang.security.audit.dynamic-urllib-use-detected services/account_unification/app/healthcheck.py:18 — dynamic value passed to urllib.request.urlopen (urllib honours file://, so a caller-controlled URL could read arbitrary files). Mitigate the actual risk by rejecting any non-http(s) scheme before opening the URL (closes the file:// vector), then annotate the audited call with a narrow, documented `# nosemgrep` for that single rule. Add a regression test for the rejected-scheme path. Fixed at base so all open keyverse PRs inherit a clean SAST gate. Verified in services/account_unification: `ruff check app tests tools`, `interrogate .` (100%), `pytest -q`. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AqtiEQFfuYFsS75Aku9tPT * chore: drop superseded healthcheck changes from dependency PR * test: drop superseded healthcheck coverage from dependency PR * build(deps-dev): bump anyio to 4.14.2 Integrate the validated AnyIO lockfile refresh into the consolidated account-unification dependency branch. * build(deps-dev): bump certifi to 2026.7.22 Integrate the validated certificate bundle lockfile refresh into the consolidated account-unification dependency branch. --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: opencode-agent[bot] <219766164+opencode-agent[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps uvicorn from 0.51.0 to 0.52.0.
Release notes
Sourced from uvicorn's releases.
Changelog
Sourced from uvicorn's changelog.
Commits
8f1b884Version 0.52.0 (#3044)f6833dbAdd experimental zttp HTTP/1.1 protocol (#2979)d26c85cPrepare compatibility with websockets 17.0. (#3036)7e11cc6Clarify how limit_concurrency and backlog differ (#3029)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit