chore(deps): update psycopg[binary,pool] requirement from >=3.2 to >=3.3.4#790
Merged
rafeekpro merged 3 commits intoJun 17, 2026
Merged
Conversation
Updates the requirements on [psycopg[binary,pool]](https://github.com/psycopg/psycopg) to permit the latest version. - [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst) - [Commits](psycopg/psycopg@3.2.0...3.3.4) --- updated-dependencies: - dependency-name: psycopg[binary,pool] dependency-version: 3.3.4 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Dependabot edited uv.lock to require psycopg>=3.3.4 but left pyproject.toml at >=3.2, so 'uv lock --check' failed in CI. This commit bumps the pyproject.toml constraint to match, matching dependabot's actual intent for the security/stability floor. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
5 tasks
rafeekpro
added a commit
that referenced
this pull request
Jun 17, 2026
…lear active CVEs (#791) * fix(security): floor cryptography / python-multipart / starlette to clear active CVEs Develop's Python deps CVE scan started failing after fresh advisories were published against transitive dependencies. None of these were explicitly pinned in apps/engine/pyproject.toml at versions above the patched floor, so 'uv lock' was happily resolving the vulnerable versions and the gate was blocking every Python PR (#789, #790, plus any future ones). Add explicit floors: - cryptography>=48.0.1 GHSA-537c-gmf6-5ccf - python-multipart>=0.0.31 CVE-2026-53538/53539/53540 - starlette>=1.3.1 CVE-2026-54282/54283 Resolution result (uv.lock): cryptography 48.0.0 -> 49.0.0 python-multipart 0.0.28 -> 0.0.32 starlette 1.1.0 -> 1.3.1 Smoke-test sweep on the bumped resolution passes the same set develop passes today — the two failures observed (test_assistant test_chat_returns_assistant_message and test_error_explainer test_explain_endpoint_ai_falls_back_to_deterministic_without_provider) also fail on develop verbatim, are unrelated to the bumps, and stem from a pre-existing GLM provider auto-detection bug. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore(types): wrap status-code range comparisons in bool() Starlette 1.3 ships stricter type stubs and httpx now returns ``Any`` for ``response.status_code`` in some contexts, so the ``return 200 <= response.status_code < 300`` pattern in the standalone JWT-login helpers trips mypy's ``no-any-return``. Explicit ``bool(...)`` keeps the semantics identical and gives mypy a concrete annotation without an ``# type: ignore`` escape hatch. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Collaborator
|
@dependabot rebase |
Contributor
Author
|
Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry! If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request |
rlagowski
approved these changes
Jun 17, 2026
rafeekpro
deleted the
dependabot/uv/develop/psycopg-binarypool--gte-3.3.4
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the requirements on psycopg[binary,pool] to permit the latest version.
Changelog
Sourced from psycopg[binary,pool]'s changelog.
... (truncated)
Commits
83f1103chore: bump psycopg_pool package version to 3.3.11828770chore: bump psycopg package version to 3.3.48be14bbMerge pull request #1301 from oliverhaas/fix/sync-pool-open-raceaee0bf2fix(pool): fix race in the construction of the sync ConnectionPool lockbc4d303chore(deps): bump the actions group across 1 directory with 4 updates785379ffix: retain statusmessage after executemany with returning=False8882a73perf: do less if X in Y: return Y[X] for cache-like patterns2f78539Merge pull request #1299 from dvarrazzo/fix-camel-enum37ef1dctest: skip test on crdb depending on precise regtype behaviour7f2f1d1fix: fix client-side representation of enums requiring quotesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)