Repository navigation
ci(deps): update fastapi requirement from <1.0.0,>=0.138.1 to >=0.139.0,<1.0.0 in /constraints - #1491
Merged
neuron7xLab merged 2 commits intoJul 8, 2026
Conversation
Updates the requirements on [fastapi](https://github.com/fastapi/fastapi) to permit the latest version. - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.138.1...0.139.0) --- updated-dependencies: - dependency-name: fastapi dependency-version: 0.139.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Dependabot's PR #1491 only bumped constraints/security.txt's fastapi range; it cannot touch the matching floors elsewhere or regenerate the locks. The D8 constraints/lock exact-pin trap (constraints-lock-sync gate) was already clean -- fastapi==0.139.0 was already the resolved lock pin. The actual CI failures (dependency-operational-determinism, component-test-router, fast-diagnostic-shard) came from a different, related trap: requirements-scan.txt and pyproject.toml still admitted fastapi>=0.138.1, below the new constraints/security.txt floor. - Bump fastapi floor to >=0.139.0,<1.0.0 in pyproject.toml, requirements.txt, requirements-scan.txt to match constraints/security.txt. - Regenerate requirements.lock, requirements-dev.lock, requirements-scan.lock with each file's own recorded pip-compile header command. requirements.lock and requirements-scan.lock came back byte-identical (fastapi was already resolved correctly). requirements-dev.lock picked up the previously-missing cyclonedx-bom dev-extra dependency tree (declared in pyproject.toml but never locked); the two packages documented as manually-merged-after-relock (pot, pytest-timeout) were re-added per their inline lock comments since pip-compile --extra=dev cannot emit them (neuro_advanced extra / -r requirements-dev.txt respectively). Verified locally: validate_dependency_truth.py (D8=0, D1-D6 unchanged at 6 pre-existing/backlogged), check_operational_dependency_determinism.py --self-test, tools/security/check_dependency_manifest_consistency.py, and tests/deps + tests/security dependency gate tests all pass. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
neuron7xLab
deleted the
dependabot/pip/constraints/fastapi-gte-0.139.0-and-lt-1.0.0
branch
July 8, 2026 08:29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the requirements on fastapi to permit the latest version.
Release notes
Sourced from fastapi's releases.
Commits
cecd96d🔖 Release version 0.139.0 (#15910)aea6609📝 Update release notes319be50✨ Support dependencies inapp.frontend(), e.g. for automatic cookie authent...66a90f6📝 Update release notesd30a3eb👥 Update FastAPI People - Experts (#15909)122f1b5📝 Update release notesfd6ece3👥 Update FastAPI GitHub topic repositories (#15906)ec2a6ad📝 Update release notes9d7d7fe🌐 Update translations for fr (update-outdated) (#15897)8dc852d📝 Update release notesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)