Update dependency s3transfer to v0.19.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
s3transfer	==0.16.1 → ==0.19.0

---

Release Notes

boto/s3transfer (s3transfer)

v0.19.0

Compare Source

======

• feature:s3: Update multi-part copy logic to match single-part behavior for TaggingDirective and AnnotationDirective
• enhancement:s3: Warn when Metadata or Tagging is supplied to a copy without the corresponding directive set to REPLACE, in which case the supplied value is silently ignored. This matches the CopyObject behavior.

v0.18.0

Compare Source

======

• feature:Copy: By default, preserve source object metadata during multipart copies to match single CopyObject behavior.

v0.17.1

Compare Source

======

• enhancement:s3: Skip the HEAD request during S3 downloads when the client is configured with response_checksum_validation='when_required', reducing latency for small-object transfers. The HEAD request remains in place by default to enable full-object checksum validation.

v0.17.0

Compare Source

======

• feature:Python: End of support for Python 3.9

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[fullsend-ai-review]

🤖 Review · Started 12:09 PM UTC
Commit: e686f8c · View workflow run →

[fullsend-ai-review]

Looks good to me

Previous run

Review

Findings

Critical

• [api-contract] requirements.txt:1065 — s3transfer is being upgraded from 0.16.1 to 0.19.0 while boto3 remains pinned at 1.42.96. boto3 1.42.96 declares s3transfer>=0.16.0,<0.17.0 as its dependency constraint. s3transfer 0.19.0 falls outside this allowed range and pip will refuse to install the incompatible combination (or the hash-checking mode in these requirements files will fail). The same issue applies to requirements-test.txt.
  Remediation: Either (a) upgrade boto3 and botocore to versions that declare compatibility with s3transfer 0.19.0, or (b) keep s3transfer at 0.16.1 to remain compatible with the current boto3 1.42.96 pin.

Previous run (2)

Review

Findings

Critical

• [api-contract] requirements.txt:1065 — s3transfer is bumped to 0.19.0 while boto3 remains pinned at 1.42.96 and botocore at 1.42.96. boto3 constrains s3transfer with a strict upper bound (typically s3transfer>=0.x.0,<0.(x+1).0). boto3 1.42.96 currently resolves to s3transfer 0.16.1, implying a constraint of >=0.16.0,<0.17.0. Installing s3transfer 0.19.0 alongside boto3 1.42.96 will produce a dependency conflict and pip will refuse to install, breaking the build. The same issue exists in requirements-test.txt. Renovate's pip_requirements manager bumps individual pins directly without running pip-compile, so it cannot detect transitive dependency conflicts that pip-compile would catch.
  Remediation: Update boto3 and botocore to versions that declare compatibility with s3transfer >=0.19.0 (likely boto3 >=1.38.x), or run pip-compile to regenerate consistent, hash-pinned requirements files rather than accepting Renovate's single-dependency bump.

Previous run (3)

Review

Findings

No findings.

Previous run (4)

Review

Findings

Medium

• [api-contract] requirements.txt:1065, requirements-test.txt:1272 — s3transfer is bumped from 0.16.1 to 0.18.0 via text substitution in pip-compile-generated lockfiles, bypassing the dependency resolver. boto3 (pinned at 1.42.96) is known to declare tight upper-bound constraints on s3transfer (e.g., s3transfer>=0.X.0,<0.Y.0). A two-minor-version jump without re-running pip-compile risks violating boto3's declared compatibility range. If the constraint is violated, pip install will fail at CI time, but the lockfile state would still be invalid.
  Remediation: Re-run pip-compile --generate-hashes --output-file=requirements.txt and the corresponding command for requirements-test.txt to let the resolver validate the full dependency graph. Alternatively, verify that boto3 1.42.96 declares compatibility with s3transfer >=0.18.0 before merging.

Info

• [sub-agent-failure] N/A — The style-conventions sub-agent did not return findings: model unavailable. Given this is a mechanical version bump in lockfiles, no style findings are expected.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:09 PM UTC · Completed 12:15 PM UTC
Commit: e686f8c · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:07 PM UTC · Completed 6:11 PM UTC
Commit: 45f7743 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:14 AM UTC · Completed 12:22 AM UTC
Commit: 45f7743 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[critical] api-contract

s3transfer is bumped to 0.19.0 while boto3 remains pinned at 1.42.96 and botocore at 1.42.96. boto3 constrains s3transfer with a strict upper bound (typically s3transfer>=0.x.0,<0.(x+1).0). boto3 1.42.96 currently resolves to s3transfer 0.16.1, implying a constraint of >=0.16.0,<0.17.0. Installing s3transfer 0.19.0 alongside boto3 1.42.96 will produce a dependency conflict and pip will refuse to install, breaking the build. The same issue exists in requirements-test.txt. Renovate pip_requirements manager bumps individual pins directly without running pip-compile, so it cannot detect transitive dependency conflicts that pip-compile would catch.

Suggested fix: Update boto3 and botocore to versions that declare compatibility with s3transfer >=0.19.0 (likely boto3 >=1.38.x), or run pip-compile to regenerate consistent, hash-pinned requirements files rather than accepting Renovate single-dependency bump.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:33 PM UTC · Completed 5:41 PM UTC
Commit: f930a4c · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[critical] api-contract

s3transfer is being upgraded from 0.16.1 to 0.19.0 while boto3 remains pinned at 1.42.96. boto3 1.42.96 declares s3transfer>=0.16.0,<0.17.0 as its dependency constraint. s3transfer 0.19.0 falls outside this allowed range and pip will refuse to install the incompatible combination. The same issue applies to requirements-test.txt.

Suggested fix: Either (a) upgrade boto3 and botocore to versions that declare compatibility with s3transfer 0.19.0, or (b) keep s3transfer at 0.16.1 to remain compatible with the current boto3 1.42.96 pin.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:41 PM UTC · Completed 2:45 PM UTC
Commit: 8207ad4 · View workflow run →