Upgrade toolchain and move to Python 3.14 - #27
Merged
Conversation
Refresh the lockfile across the board (FastAPI 0.128 -> 0.140.7, Starlette 1.3, OpenTelemetry 1.44/0.65b0, structlog 26, wrapt 2), update the ruff pre-commit hook from v0.8.6 to v0.16.0 with the ruff-check id and apply its fixes, and move to Python 3.14 across .python-version, requires-python, ruff target-version, and the Docker base image. Pin the Dockerfile uv stage, bump CI to checkout@v7 and setup-uv@v9.0.0, and add weekly grouped Dependabot updates. Unlike sibling services no FastAPI hold is needed: rate limiting here is an in-house http middleware calling limits directly, not slowapi's SlowAPIMiddleware default_limits path that FastAPI >=0.137 breaks, and the full suite passes on the new stack. The dev compose Postgres stays on 16 pending a coordinated production upgrade.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Applies the api-template refresh. This service was furthest behind (fastapi floor 0.115, locked 0.128).
ruff-checkid) + autofixesuv lock --upgrade: FastAPI 0.128 → 0.140.7, Starlette 1.3.1, OTel 1.44/0.65b0, structlog 26, wrapt 2.python-version,requires-python, ruff target, Docker base); 122/122 tests green on 3.14.4v9.0.0; GCP deploy actions already currentWhy no
fastapi<0.136hold here (unlike vagrant-story-api #86): rate limiting is an in-house http middleware callinglimitsdirectly — slowapi's brokenSlowAPIMiddleware/default_limitspath isn't used, and the full suite (including auth rate-limit coverage) passes on FastAPI 0.140.7 + Starlette 1.3.1.Two observations for follow-up, not changed here: slowapi is now only used for its
Limiterwrapper + 429 handler (could be replaced bylimitsalone), and non-auth routes have no rate limiting at all — worth a deliberate decision given the public API audience.Deliberately not bumped: dev compose Postgres 16 (coordinate with production separately). Deploy note: Docker base 3.14 ships on next Cloud Run deploy.
Test note: the suite requires an AWS profile (
ag-tech-admin); verified with an isolated config, all 122 green.