chore(deps): uv: bump the all-python group across 1 directory with 6 updates#626
Open
dependabot[bot] wants to merge 1 commit into
Open
chore(deps): uv: bump the all-python group across 1 directory with 6 updates#626dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
…updates Bumps the all-python group with 6 updates in the /agent directory: | Package | From | To | | --- | --- | --- | | [boto3](https://github.com/boto/boto3) | `1.43.40` | `1.43.46` | | [bedrock-agentcore](https://github.com/aws/bedrock-agentcore-sdk-python) | `1.17.0` | `1.18.0` | | [claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-python) | `0.2.110` | `0.2.116` | | [uvicorn](https://github.com/Kludex/uvicorn) | `0.50.0` | `0.51.0` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.20` | `0.15.21` | | [ty](https://github.com/astral-sh/ty) | `0.0.56` | `0.0.58` | Updates `boto3` from 1.43.40 to 1.43.46 - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.43.40...1.43.46) Updates `bedrock-agentcore` from 1.17.0 to 1.18.0 - [Release notes](https://github.com/aws/bedrock-agentcore-sdk-python/releases) - [Changelog](https://github.com/aws/bedrock-agentcore-sdk-python/blob/main/CHANGELOG.md) - [Commits](aws/bedrock-agentcore-sdk-python@v1.17.0...v1.18.0) Updates `claude-agent-sdk` from 0.2.110 to 0.2.116 - [Release notes](https://github.com/anthropics/claude-agent-sdk-python/releases) - [Changelog](https://github.com/anthropics/claude-agent-sdk-python/blob/main/CHANGELOG.md) - [Commits](anthropics/claude-agent-sdk-python@v0.2.110...v0.2.116) Updates `uvicorn` from 0.50.0 to 0.51.0 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.50.0...0.51.0) Updates `ruff` from 0.15.20 to 0.15.21 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.20...0.15.21) Updates `ty` from 0.0.56 to 0.0.58 - [Release notes](https://github.com/astral-sh/ty/releases) - [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md) - [Commits](astral-sh/ty@0.0.56...0.0.58) --- updated-dependencies: - dependency-name: boto3 dependency-version: 1.43.46 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-python - dependency-name: bedrock-agentcore dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-python - dependency-name: claude-agent-sdk dependency-version: 0.2.116 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-python - dependency-name: uvicorn dependency-version: 0.51.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-python - dependency-name: ruff dependency-version: 0.15.21 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-python - dependency-name: ty dependency-version: 0.0.58 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-python ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
scottschreckengaust
requested changes
Jul 21, 2026
scottschreckengaust
left a comment
scottschreckengaust
left a comment
Contributor
There was a problem hiding this comment.
Verdict: Request changes
The build (agentcore) check is red, and I reproduced the cause in the worktree: it is a real incompatibility introduced by the ty 0.0.56 → 0.0.58 bump in this PR, not a flake. A second, quieter problem: the claude-agent-sdk bump silently breaks the documented Dockerfile CLI lockstep invariant (#215). Both must be resolved before merge. The other four bumps (boto3, bedrock-agentcore, uvicorn, ruff) are clean.
Vision alignment
Routine dependency hygiene under the repo's own .github/dependabot.yml uv / all-python group — no tenet impact, no blast-radius change, control plane untouched. Governance is satisfied: the Dependabot config is the standing authorization, so the ADR-003 approved-issue gate does not apply, and dependabot/uv/agent/all-python-... is the standard bot branch format (de-facto-waived nit). The change belongs — but a green build is table stakes, and keeping the CLI lockstep intact is exactly the kind of "bounded, improvable control plane" hygiene the vision calls for.
Blocking issues
B1 — ty 0.0.58 bump breaks the typecheck; the required suppressions/fixes are not in this PR (agent/uv.lock:189-211, source unchanged).
Root cause, verified by running both pins against the same worktree source:
uvx ty@0.0.56 check→ All checks passed (exit 0) — this is main's pin.uv run ty check(this PR's0.0.58) → Found 9 diagnostics (exit 1) — identical to the CI log for run 29633654727.
So the bump alone flips the build red. ty 0.0.58 changed two behaviors:
- It now treats frozen-Pydantic (
ConfigDict(frozen=True)) fields as read-only properties and statically errors on assignment. Every failing site is inside a deliberatewith pytest.raises(ValidationError):block that mutates a frozen model to assert the runtime rejects it — a correct, intentional test pattern (agent/tests/test_attachments.py:46;agent/tests/test_models.py:30,63,140,170,416,447). The test code is correct at runtime; only the new checker rejects it. - It tightened dict-literal inference:
content_trust={...}literals are inferred asdict[str, str], no longer assignable toMapping[str, Literal["trusted","untrusted-external","memory"]] | None(agent/tests/test_models.py:237,244).
Fix (pick one, in this PR so it lands atomically with the bump):
- Add targeted
# ty: ignore[invalid-assignment]to the seven frozen-mutation lines and# ty: ignore[invalid-argument-type](or annotate the literal, e.g.content_trust: dict[str, ContentTrust] = {...}/cast(...)) to the twocontent_trustsites; or - Hold
tyat0.0.56(exclude it from this group bump) until the test suppressions are prepared separately.
Merging as-is lands a red build onmain.
B2 — claude-agent-sdk 0.2.116 breaks the #215 CLI lockstep; Dockerfile npm pin and comment not updated (agent/pyproject.toml:19, agent/Dockerfile:49,56).
The pin comment states the SDK is "kept in lockstep with the npm CLI pin in the Dockerfile, #215." Per the upstream v0.2.116 release notes, claude-agent-sdk 0.2.116 bundles Claude CLI 2.1.207, but:
agent/Dockerfile:56still installs@anthropic-ai/claude-code@2.1.191.agent/Dockerfile:49comment still says "Pinned 2.1.191 to match the CLI bundled by claude-agent-sdk 0.2.110."agent/pyproject.toml:19comment still reads.../releases/tag/v0.2.110 (bundles claude CLI 2.1.191...)while pinning0.2.116— stale and now wrong on both the version and the CLI number.
This is precisely the divergence the invariant exists to prevent: the SDK's bundled subprocess CLI (2.1.207) and the globally-installed npm CLI (2.1.191) would drift apart. Fix: bump the Dockerfile npm pin to@anthropic-ai/claude-code@2.1.207and update both comments — or, if the mismatch is deliberate, document why in the comment. Note Dependabot cannot cross-update the Dockerfile npm pin from auvgroup, so this must be done by hand on the branch.
Non-blocking suggestions / nits
- N1 —
tyis unpinned inpyproject.toml(agent/pyproject.toml:88, bare"ty",) yet pinned inuv.lock. That is why Dependabot moved it as part of the group even though there is no explicit==spec to bump. Consider pinningty==<version>like the other dev tools so pre-release type-checker churn cannot silently re-break the build on the next lock refresh. - N2 — Branch name
dependabot/uv/agent/all-python-562714a858does not match(feat|fix|chore|docs)/<issue>-desc; standard for Dependabot, de-facto waived.
Documentation
No docs/guides/design changes required for a dep bump, and the Starlight mirror is untouched (no docs/ edits) — mirror-sync N/A. However, B2 is partly a documentation-accuracy defect: the pyproject.toml:19 and Dockerfile:49 comments are now factually stale (v0.2.110 / CLI 2.1.191) and must be corrected alongside the code fix.
Tests & CI
- No test logic changed; the two edited files are
agent/pyproject.tomlandagent/uv.lockonly. - CI:
build (agentcore)FAILURE (the//agent:typecheckstep — B1).Secrets, deps, and workflow scanSUCCESS,Validate PR titleSUCCESS,Dead-code detectionSUCCESS (advisory), CodeQL NEUTRAL,auto-approveSKIPPED.mergeStateStatus: BLOCKEDon the red check. - Bootstrap synth-coverage: not applicable — no CDK construct/stack/handler or CFN resource-type change.
- Supply-chain integrity (checked directly on the lock diff): all 50 added
url/sdistentries carrysha256:hashes; no hash-stripped or unpinned lines; no newname =package sections (no stealth transitive additions — versions/hashes updated in place). No OSV/malware advisory names uvicorn 0.51.0, boto3 1.43.46, or bedrock-agentcore 1.18.0 as affected. bedrock-agentcore 1.18.0 release notes show no breaking changes.
Review agents run
- /security-review (supply-chain scope) — Ran. Its auto-collected git context resolved to the repo root (empty diff), so I performed the supply-chain assessment directly against the lock diff in the worktree: hash-pin integrity, no unexpected/transitive package additions, and OSV/malware cross-check of the six versions (esp. the poisoned-"fix" pattern from the astro 7.1.0 / MAL-2026-10726 incident). No supply-chain findings.
- code-reviewer — Effectively performed by hand for a two-file manifest diff: the load-bearing issues are B1 (version delta vs. CI) and B2 (cross-file lockstep with the Dockerfile), both covered above.
- silent-failure-hunter — Omitted: no error-handling/fallback code in the diff (manifests only).
- type-design-analyzer — Omitted: no new/changed types (the
tydiagnostics are checker-behavior changes against existing types, addressed in B1). - comment-analyzer — In scope and applied: found the stale
claude-agent-sdkcomment (folded into B2/N1). - pr-test-analyzer — Omitted: no test code added/changed; the failing tests are unchanged and correct at runtime (the checker regressed, not the tests).
Human heuristics
- Proportionality — Pass. A grouped patch/minor dep bump; scope matches the problem.
- Coherence — Concern. The
claude-agent-sdkSDK pin and the Dockerfile npm CLI pin encode the same concept (which Claude CLI version runs) and must move together per #215; this PR moves one and not the other (agent/pyproject.toml:19vsagent/Dockerfile:56). - Clarity — Concern. The
pyproject.toml:19comment now misstates both the SDK release tag (v0.2.110) and the bundled CLI (2.1.191) after the bump to 0.2.116 / CLI 2.1.207. - Appropriateness — Concern. Verified against real upstream behavior, not mocks: I reproduced the typecheck delta with
uvx ty@0.0.56vs0.0.58and confirmed the bundled-CLI number from the upstream release notes. As shipped, the change is not mergeable (red build) and not maintainable-as-is (silent lockstep drift).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the all-python group with 6 updates in the /agent directory:
1.43.401.43.461.17.01.18.00.2.1100.2.1160.50.00.51.00.15.200.15.210.0.560.0.58Updates
boto3from 1.43.40 to 1.43.46Commits
c7888d6Merge branch 'release-1.43.46'1479621Bumping version to 1.43.4654abdb4Add changelog entries from botocore75de637Merge branch 'release-1.43.45'd3449aaMerge branch 'release-1.43.45' into develop497253dBumping version to 1.43.455e9768eAdd changelog entries from botocore19a915bMerge branch 'release-1.43.44'1b69a06Merge branch 'release-1.43.44' into developb0e3f6aBumping version to 1.43.44Updates
bedrock-agentcorefrom 1.17.0 to 1.18.0Release notes
Sourced from bedrock-agentcore's releases.
Changelog
Sourced from bedrock-agentcore's changelog.
Commits
8df87bbchore: bump version to 1.18.0 (#574)f855616fix: floor monotonic timestamps to milliseconds before comparison (#573)a271ab4fix: order AgentCore Memory events at millisecond resolution (#572)168f4beci: add API reference docs generation workflow (#569)46a0beafix(payments): address langgraph middleware review follow-ups (#570)0a8a486feat(payments): Add LangGraph integration for payment handling (#546)Updates
claude-agent-sdkfrom 0.2.110 to 0.2.116Release notes
Sourced from claude-agent-sdk's releases.
... (truncated)
Changelog
Sourced from claude-agent-sdk's changelog.
Commits
528265fdocs: update changelog for v0.2.1161a887d9chore: release v0.2.11685ad6a6chore: bump bundled CLI version to 2.1.207b817bf5ci: trust the checkout workspace so Claude Code honors project-scoped grants ...41f7b2ddocs: update changelog for v0.2.115ac4772echore: release v0.2.11566bfd70chore: bump bundled CLI version to 2.1.206fdee0addocs: update changelog for v0.2.1145aa66aechore: release v0.2.1148d4ab78chore: bump bundled CLI version to 2.1.205Updates
uvicornfrom 0.50.0 to 0.51.0Release notes
Sourced from uvicorn's releases.
Changelog
Sourced from uvicorn's changelog.
Commits
e4d0b05Version 0.51.0 (#3028)944e43dRemove colorama from the standard extra (#3027)2e78770Restart workers with overlap on SIGHUP for near-zero-downtime reloads (#3025)a1b570cVersion 0.50.2 (#3022)83c7da7Require websockets>=13.0 for the default sansio implementation (#3021)b4d0116Version 0.50.1 (#3020)2a9151dSplit comma-separatedSec-WebSocket-Protocolvalues in the websockets-sansi...1bf3ab4Cover the excluded-directory branch inFileFilterwith a direct test (#3014)837b5f9Deflake multiprocess, reload, and signal supervisor tests (#2975)Updates
rufffrom 0.15.20 to 0.15.21Release notes
Sourced from ruff's releases.
... (truncated)
Changelog
Sourced from ruff's changelog.
... (truncated)
Commits
3e1f636Bump 0.15.21 (#26676)4059807[ty] Infer metaclass-declared attributes on class instances (#26512)013e5d0[ty] Use a dedicated project name type (#26665)7ad39ad[ty] Avoid allocating decorated parameter names (#26666)c36f662Improve performance of rendering edits in preview mode (#26565)ad26408[ty] Gate membership narrowing on__contains__semantics (#25964)4594ca7[ty] Add variant discriminators forCodeGeneratorKind(#26659)1af03da[ty] Pydantic: Fix float conversion in unions (#26655)a004a36[ty] Handle callable classes in solver (#26090)d8ef3b0[ty] Parse all supported Google docstring sections. (#26653)Updates
tyfrom 0.0.56 to 0.0.58Release notes
Sourced from ty's releases.
... (truncated)
Changelog
Sourced from ty's changelog.
... (truncated)
Commits
17d3f6dBump version to 0.0.58 (#3955)03cfaafBump version to 0.0.57 (#3927)1b3b573Update actions/attest-build-provenance action to v4.1.1 (#3928)0e9cbe1Update actions/cache action to v6.1.0 (#3930)83f4009Update actions/setup-python action to v6.3.0 (#3931)ad99bb9Update prek dependencies (#3929)aeeeed5Update astral-sh/setup-uv action to v8.3.1 (#3932)d171a78Document PYTHONPATH support in module discovery (#3889)c6920a2Fix trailing whitespace (#3911)546f220chore: pin pre-commit refs and lock prek in CI (#3897)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions