build(deps): update uvicorn requirement from ^0.44.0 to >=0.44,<0.50 - #25
build(deps): update uvicorn requirement from ^0.44.0 to >=0.44,<0.50#25dependabot[bot] wants to merge 1 commit into
Conversation
Updates the requirements on [uvicorn](https://github.com/Kludex/uvicorn) to permit the latest version. - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.44.0...0.49.0) --- updated-dependencies: - dependency-name: uvicorn dependency-version: 0.49.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
WalkthroughThe ChangesDependency Updates
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pyproject.toml`:
- Line 12: The uvicorn dependency range in pyproject.toml (the uvicorn = {extras
= ["standard"], version = ">=0.44,<0.50"} entry) is too permissive and can cause
dependency drift; tighten it to the exact tested version (e.g., "==0.44.0") or
narrow the upper bound to the specific verified minor (e.g., ">=0.44,<0.45") and
then regenerate and commit an updated poetry.lock so installs remain
deterministic. Ensure the change is applied to the uvicorn dependency line in
pyproject.toml and that poetry lockfile is updated and committed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: ff2bcc04-92bd-4a93-93dd-2eefd96c603f
📒 Files selected for processing (1)
pyproject.toml
| python = "^3.11" | ||
| fastapi = "^0.135.1" | ||
| uvicorn = {extras = ["standard"], version = "^0.44.0"} | ||
| uvicorn = {extras = ["standard"], version = ">=0.44,<0.50"} |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check if httptools is directly or indirectly constrained elsewhere
rg -n 'httptools' --type=tomlRepository: cryptoxdog/l9-codegraph
Length of output: 49
🏁 Script executed:
#!/bin/bash
# Search for proxy middleware usage that could be affected by behavior changes
rg -nP '\bProxyHeadersMiddleware\b' --type=py
rg -nP '(X-Forwarded-|proxy.?header)' --type=py -C2Repository: cryptoxdog/l9-codegraph
Length of output: 49
🏁 Script executed:
#!/bin/bash
# Verify all uvicorn CLI invocations to assess flag compatibility risk
rg -n 'uvicorn' --type=sh --type=dockerfile -C2Repository: cryptoxdog/l9-codegraph
Length of output: 102
🌐 Web query:
uvicorn changelog breaking changes versions 0.45 0.46 0.47 0.48 0.49
💡 Result:
As of June 8, 2026, the Uvicorn releases from 0.45.0 to 0.49.0 focused primarily on adding features, improving internal implementation details, and addressing specific behaviors in middlewares. While some changes altered existing behavior (notably in ProxyHeadersMiddleware), the official release notes do not explicitly categorize them as "breaking changes." Below is a summary of the releases: 0.45.0 (April 21, 2026) - Added --reset-contextvars flag to isolate ASGI request context [1][2]. - Allowed case-insensitive log_level strings and accepted os.PathLike for log_config [2]. - Reverted the 0.44.0 behavior that emitted http.disconnect on server shutdown for streaming responses [2]. 0.46.0 (April 23, 2026) - Added support for ws_max_size, ws_ping_interval, and ws_ping_timeout in the wsproto implementation [1][3][4]. - Switched to using bytearray for the incoming WebSocket message buffer in websockets-sansio [3][4]. 0.47.0 (May 14, 2026) - Added ssl_context_factory for custom SSLContext configuration [1][5][6]. - Introduced eager import of the ASGI app in the parent process [1][5][6]. - Fixed an issue to treat fd=0 as a valid file descriptor [1][5][6]. 0.48.0 (May 24, 2026) - Changed the default ssl_ciphers to None, utilizing OpenSSL defaults [1][7][8]. - ProxyHeadersMiddleware was updated to ignore duplicate forwarding headers [1][7][8]. 0.49.0 (June 3, 2026) - Bumped the minimum required version of httptools to 0.8.0 [1][9]. - ProxyHeadersMiddleware was updated to consume duplicate forwarding headers, effectively reversing the behavior introduced in version 0.48.0 [1][9]. Top results used: [1][5][8][2][4][9]
Citations:
- 1: https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md
- 2: https://github.com/Kludex/uvicorn/releases/tag/0.45.0
- 3: Kludex/uvicorn@0.45.0...0.46.0
- 4: https://github.com/Kludex/uvicorn/releases/tag/0.46.0
- 5: https://uvicorn.dev/release-notes/
- 6: https://newreleases.io/project/pypi/uvicorn/release/0.47.0
- 7: Kludex/uvicorn@0.47.0...0.48.0
- 8: https://github.com/Kludex/uvicorn/releases/tag/0.48.0
- 9: https://github.com/encode/uvicorn/blob/master/docs/release-notes.md
Narrow/pin the uvicorn version range to avoid dependency drift
pyproject.toml:12 broadens uvicorn from ^0.44.0 to >=0.44,<0.50 (spanning ~0.44–0.49), which can change transitive behavior/dependencies between installs—even though this repo doesn’t reference httptools directly and doesn’t use ProxyHeadersMiddleware/X-Forwarded-* patterns in code. Recommend pinning an exact uvicorn version (and committing an updated poetry.lock) or tightening the upper bound to the specific tested version.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pyproject.toml` at line 12, The uvicorn dependency range in pyproject.toml
(the uvicorn = {extras = ["standard"], version = ">=0.44,<0.50"} entry) is too
permissive and can cause dependency drift; tighten it to the exact tested
version (e.g., "==0.44.0") or narrow the upper bound to the specific verified
minor (e.g., ">=0.44,<0.45") and then regenerate and commit an updated
poetry.lock so installs remain deterministic. Ensure the change is applied to
the uvicorn dependency line in pyproject.toml and that poetry lockfile is
updated and committed.
|
Superseded by #29. |
Updates the requirements on uvicorn to permit the latest version.
Release notes
Sourced from uvicorn's releases.
Changelog
Sourced from uvicorn's changelog.
... (truncated)
Commits
3ef2e3eVersion 0.49.0 (#2973)eeb64b1Consume duplicate forwarding headers in ProxyHeadersMiddleware (#2971)630f4acMake the watchfiles reload tests deterministic (#2972)9154922chore(deps): bump the github-actions group across 1 directory with 6 updates ...739727aMigrate docs deploy from Cloudflare Pages to Workers (#2967)be4a240Gate docs preview deploy on Cloudflare token presence (#2966)c489d7eBump httptools minimum version to 0.8.0 (#2962)9f547bdSkip docs preview deploy for Dependabot PRs (#2961)44446b8Migrate documentation from MkDocs Material to Zensical (#2959)cfd659cBump pymdown-extensions to 10.21.3 (#2958)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit