chore(deps): upgrade Python dependencies via uv by Zingzy · Pull Request #204 · spoo-me/spoo

Zingzy · 2026-06-14T19:03:13Z

Upgrades all Python dependencies to their latest compatible versions.

Regenerated cleanly from main with:

uv sync
uv lock --upgrade
uv sync
uv pip freeze > requirements.txt

Only uv.lock and requirements.txt changed — no source changes.

Notable bumps

redis 7.4.0 → 8.0.0 (major)
starlette 1.0.0 → 1.3.1
cryptography 48.0.0 → 49.0.0
aiohttp 3.13.5 → 3.14.1
fastapi 0.136.1 → 0.137.0
sentry-sdk 2.59.0 → 2.62.0
structlog 25.5.0 → 26.1.0

Notes

This supersedes the earlier deps branch (feat/uv-deps-upgrade), which accidentally included unrelated onboarding commits. This PR is deps-only.

Summary by Sourcery

Upgrade Python dependency lockfile and requirements to latest compatible versions with no source code changes.

Build:

Refresh uv.lock and requirements.txt with updated dependency versions, including runtime, tooling, and test libraries.

Chores:

Perform a dependency maintenance pass to bump multiple third-party libraries (e.g., redis, FastAPI, Starlette, cryptography, aiohttp, sentry-sdk, structlog) to newer releases.

Summary by CodeRabbit

Chores
- Updated Python dependencies to newer versions across the dependency stack, including HTTP/networking libraries, web frameworks, security packages, and development tools. These updates include potential bug fixes, performance improvements, and security patches.

Regenerated from origin/main with: uv sync && uv lock --upgrade && uv sync && uv pip freeze > requirements.txt Notable bumps: redis 7.4.0->8.0.0, starlette 1.0.0->1.3.1, cryptography 48.0.0->49.0.0, aiohttp 3.13.5->3.14.1, fastapi 0.136.1->0.137.0, sentry-sdk 2.59.0->2.62.0, structlog 25.5.0->26.1.0. No source changes.

Copilot

Copilot wasn't able to review any files in this pull request.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

sourcery-ai · 2026-06-14T19:03:25Z

Reviewer's Guide

Dependency-only update: Python dependencies are upgraded to their latest compatible versions using uv, updating uv.lock and requirements.txt without any source code changes, including a major redis bump and minor/patch bumps for FastAPI/Starlette and other runtime/test tooling libraries.

File-Level Changes

Change	Details	Files
Upgrade all Python dependencies via uv, updating the lockfile and pinned runtime/test requirements without modifying application source code.	Regenerate uv.lock with `uv sync` / `uv lock --upgrade` from main to capture latest compatible versions of all Python dependencies. Update requirements.txt pins from uv’s environment (`uv pip freeze`) to reflect the new dependency graph, including a major redis bump (7.4.0 → 8.0.0). Refresh key framework and infrastructure libraries (FastAPI, Starlette, aiohttp, cryptography, sentry-sdk, structlog, uvicorn, ruff, pytest stack, etc.) to newer minor/patch versions for security and compatibility.	`requirements.txt` `uv.lock`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

coderabbitai · 2026-06-14T19:03:27Z

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

requirements.txt has 36 pinned dependency versions updated to newer patch or minor releases. Packages span async HTTP (aiohappyeyeballs, aiohttp), TLS/crypto (certifi, cryptography), web/API stack (fastapi, starlette, uvicorn, httpx), JWT handling (joserfc, pyjwt), data clients (redis), and testing/tooling (pytest family, ruff, coverage, pre-commit, uv). No dependencies were added or removed.

Changes

Dependency Version Retargeting

Layer / File(s)	Summary
All dependency pin updates `requirements.txt`	Bumps 36 pinned versions across async I/O (`aiohappyeyeballs`, `aiohttp`), TLS/crypto (`certifi`, `cryptography`), web/API stack (`fastapi`, `starlette`, `uvicorn`, `httptools`, `httpx`), JWT (`joserfc`, `pyjwt`), data clients (`redis`), and testing/tooling (`pytest` family, `ruff`, `coverage`, `pre-commit`, `uv`, `sentry-sdk`, `urllib3`, `virtualenv`, `wrapt`) to newer pinned releases.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

spoo-me/spoo#117: Also modifies only requirements.txt by bumping the same set of pinned dependency versions (aiohttp, cryptography, redis, pytest, ruff, urllib3, uv, wrapt), making it a direct predecessor of this PR.

Poem

🐇 Hop, hop, hooray for fresher deps today!
Old version pins quietly swept away,
certifi shines, cryptography gleams bright,
pytest and ruff are now pinned just right.
A tidy requirements.txt — pure delight! 🌿

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: upgrading Python dependencies via uv package manager, which aligns with the PR's primary objective.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/uv-deps-upgrade

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

sourcery-ai

Hey - I've reviewed your changes and they look great!

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

The dependency upgrade (spoo-me#204) bumped pyjwt 2.12.1->2.13.0 and fastapi 0.136.1->0.137.0, breaking 7 tests. Both are test-only — production is unaffected (routing verified working, Deploy to Production passed on the same commit, 1647 non-affected tests stayed green). - pyjwt 2.13 now raises InvalidKeyError on empty HMAC keys. The JWT security tests sign tokens with jwt_secret, which is "" in CI (no JWT_SECRET env var and .env is gitignored). Set a non-prod JWT_SECRET in the root conftest, before any test constructs AppSettings(). - fastapi 0.137 no longer flattens include_router() routes into app.routes; included routers appear as _IncludedRouter wrappers with the prefix on .include_context. Rebuild full paths (incl. HEAD) by walking that tree in the route-registration smoke test.

Copilot AI review requested due to automatic review settings June 14, 2026 19:03

github-project-automation Bot added this to spoo.me Development Roadmap Jun 14, 2026

Copilot AI reviewed Jun 14, 2026

View reviewed changes

sourcery-ai Bot reviewed Jun 14, 2026

View reviewed changes

Zingzy added the dependencies Pull requests that update a dependency file label Jun 14, 2026

Zingzy moved this to 🏗️ In Progress in spoo.me Development Roadmap Jun 14, 2026

Zingzy self-assigned this Jun 14, 2026

Zingzy added this to the Miscellaneous milestone Jun 14, 2026

Zingzy merged commit 863f641 into main Jun 14, 2026
7 of 8 checks passed

github-project-automation Bot moved this from 🏗️ In Progress to ✔️ Done in spoo.me Development Roadmap Jun 14, 2026

This was referenced Jun 14, 2026

build(deps): bump urllib3 from 2.6.3 to 2.7.0 #184

Closed

chore(deps): bump pygments from 2.19.2 to 2.20.0 #140

Closed

fix(tests): restore CI compat with pyjwt 2.13 and fastapi 0.137 #206

Merged

coderabbitai Bot mentioned this pull request Jul 3, 2026

chore: bump dependencies #215

Merged

Zingzy deleted the chore/uv-deps-upgrade branch August 16, 2026 12:34

Navigation Menu

Uh oh!

Uh oh!

chore(deps): upgrade Python dependencies via uv - #204

chore(deps): upgrade Python dependencies via uv#204
Zingzy merged 1 commit into
mainfrom
chore/uv-deps-upgrade

Zingzy commented Jun 14, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

sourcery-ai Bot commented Jun 14, 2026 •

edited

Loading

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

coderabbitai Bot commented Jun 14, 2026 •

edited

Loading

Review failed

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Poem

Uh oh!

sourcery-ai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

Zingzy commented Jun 14, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Notable bumps

Notes

Summary by Sourcery

Summary by CodeRabbit

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

sourcery-ai Bot commented Jun 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

coderabbitai Bot commented Jun 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Poem

Uh oh!

sourcery-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Zingzy commented Jun 14, 2026 •

edited by coderabbitai Bot

Loading

sourcery-ai Bot commented Jun 14, 2026 •

edited

Loading

coderabbitai Bot commented Jun 14, 2026 •

edited

Loading