Upgrade toolchain and move to Python 3.14 - #54
Merged
Conversation
The hook was pinned to v0.8.6 while the project's ruff is 0.15+, so the hook and CI could disagree about the same code. Pin the hook to v0.16.0, switch to the ruff-check hook id (ruff is now a legacy alias), and apply the resulting annotation modernizations.
Refresh the lockfile across the board (FastAPI 0.140, httpx-oauth 0.17, fastapi-users 15.0.5, OpenTelemetry 1.44/0.65b0, structlog 26, wrapt 2) and move to Python 3.14 (.python-version, requires-python, ruff target, Docker base image); every compiled dependency ships cp314 wheels. The uv copy stage in the Dockerfile is pinned instead of floating on latest. No FastAPI hold is needed here, unlike sibling services: rate limiting is enforced by an in-house http middleware calling limits directly, not by slowapi's SlowAPIMiddleware default_limits path that FastAPI >=0.137 breaks, and the end-to-end limiter tests pass on the new stack. FastAPI >=0.137 materializes included routers' routes lazily, so the OAuth registration subprocess test no longer scans app.routes (empty at import time despite routes being served) and instead treats the 200 response itself as the registration proof.
Bump actions/checkout to v7 and pin astral-sh/setup-uv to v9.0.0 (no v9 major alias tag exists yet), and add weekly grouped Dependabot updates for the uv, github-actions, and docker ecosystems.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Applies the dependency/toolchain refresh recently made to api-template, adapted to this service's divergences.
What changed
ruff-checkid), with its autofixes applieduv lock --upgrade: FastAPI 0.140.7, httpx-oauth 0.17.0, fastapi-users 15.0.5, OpenTelemetry 1.44/0.65b0, structlog 26, wrapt 2, and the rest of the floor-permitted refresh.python-version,requires-python, rufftarget-version, and the Docker base image — all compiled deps (cryptography, cffi, bcrypt, asyncpg, uvloop, greenlet, grpcio, pydantic-core, httptools, watchfiles) ship cp314 wheels; full suite green on 3.14.4v9.0.0(nov9alias tag exists); Dockerfile uv stage pinned; weekly grouped Dependabot addedWhy there is no
fastapi<0.136hold here (unlike the template)FastAPI ≥0.137 breaks slowapi's
SlowAPIMiddlewareenforcement ofdefault_limits(slowapi issue #281). This service never uses that path — rate limiting is the in-houserate_limit_authhttp middleware callinglimitsdirectly with the Cloudflare-aware key — and the end-to-end limiter tests (test_client_ip.py) pass on the upgraded stack.One test adapted, with cause
FastAPI ≥0.137 materializes included routers' routes lazily: routes are served correctly but no longer appear in
app.routesat import time. Verified directly —GET /auth/google/authorizereturns 200 whileapp.routescontains no provider paths. The OAuth-CSRF subprocess test asserted registration by scanningapp.routes; it now treats the 200 response as the registration proof (same intent, behavioral evidence).Deliberately not included
docker-composePostgres stays on 16 — bumping dev while production runs its current major would create skew; coordinate a prod upgrade separately.Deploy note: the Docker base moving to 3.14 ships a runtime change on next deploy; suggest deploying this service after a lower-stakes sibling has validated 3.14 in production.
Test results: 151 passed, 2 skipped on Python 3.14.4; ruff check/format and pre-commit all green.