From f25d4b751433b49bf89e6b2cd55a03f6130e4d91 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 4 Jul 2026 11:53:04 +0000 Subject: [PATCH 1/2] ci(deps): update fastapi requirement in /constraints Updates the requirements on [fastapi](https://github.com/fastapi/fastapi) to permit the latest version. - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](https://github.com/fastapi/fastapi/compare/0.138.1...0.139.0) --- updated-dependencies: - dependency-name: fastapi dependency-version: 0.139.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- constraints/security.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/constraints/security.txt b/constraints/security.txt index 628cc4f72..a1dcd4e15 100644 --- a/constraints/security.txt +++ b/constraints/security.txt @@ -107,7 +107,7 @@ twisted==26.4.0 # fastapi: Web framework built on starlette, requires compatible starlette version # Pin to ensure secure versions are used starlette>=1.3.1 -fastapi>=0.138.1,<1.0.0 +fastapi>=0.139.0,<1.0.0 # ============================================================================ # Additional Brotli encoding support - Required for urllib3 decompression From e71bd5ee64d5a9562ac2a101e6c3f97affe9a0f6 Mon Sep 17 00:00:00 2001 From: neuron7xLab <226363063+neuron7xLab@users.noreply.github.com> Date: Wed, 8 Jul 2026 06:57:21 +0300 Subject: [PATCH 2/2] fix(deps): raise fastapi floor to >=0.139.0 and relock dev extras Dependabot's PR #1491 only bumped constraints/security.txt's fastapi range; it cannot touch the matching floors elsewhere or regenerate the locks. The D8 constraints/lock exact-pin trap (constraints-lock-sync gate) was already clean -- fastapi==0.139.0 was already the resolved lock pin. The actual CI failures (dependency-operational-determinism, component-test-router, fast-diagnostic-shard) came from a different, related trap: requirements-scan.txt and pyproject.toml still admitted fastapi>=0.138.1, below the new constraints/security.txt floor. - Bump fastapi floor to >=0.139.0,<1.0.0 in pyproject.toml, requirements.txt, requirements-scan.txt to match constraints/security.txt. - Regenerate requirements.lock, requirements-dev.lock, requirements-scan.lock with each file's own recorded pip-compile header command. requirements.lock and requirements-scan.lock came back byte-identical (fastapi was already resolved correctly). requirements-dev.lock picked up the previously-missing cyclonedx-bom dev-extra dependency tree (declared in pyproject.toml but never locked); the two packages documented as manually-merged-after-relock (pot, pytest-timeout) were re-added per their inline lock comments since pip-compile --extra=dev cannot emit them (neuro_advanced extra / -r requirements-dev.txt respectively). Verified locally: validate_dependency_truth.py (D8=0, D1-D6 unchanged at 6 pre-existing/backlogged), check_operational_dependency_determinism.py --self-test, tools/security/check_dependency_manifest_consistency.py, and tests/deps + tests/security dependency gate tests all pass. Co-Authored-By: Claude Sonnet 5 --- pyproject.toml | 2 +- requirements-dev.lock | 63 ++++++++++++++++++++++++++++++++++++++++--- requirements-scan.txt | 2 +- requirements.txt | 2 +- 4 files changed, 63 insertions(+), 6 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index d25236f17..46488b3f8 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -52,7 +52,7 @@ dependencies = [ "ccxt>=4.5.12", "tenacity>=9.1.2", "aiolimiter>=1.2.1", - "fastapi>=0.138.1,<1.0.0", + "fastapi>=0.139.0,<1.0.0", "strawberry-graphql[fastapi]>=0.312.3", "alembic>=1.14.0", "psycopg[binary]>=3.2.3", diff --git a/requirements-dev.lock b/requirements-dev.lock index ae6b9b803..9a3b0088c 100644 --- a/requirements-dev.lock +++ b/requirements-dev.lock @@ -38,6 +38,8 @@ anyio==4.11.0 # via # httpx # starlette +arrow==1.4.0 + # via isoduration async-timeout==5.0.1 # via aiokafka attrs==25.4.0 @@ -55,6 +57,8 @@ black==26.3.1 # via geosync (pyproject.toml) blinker==1.9.0 # via streamlit +boolean-py==5.0 + # via license-expression bracex==2.6 # via cibuildwheel build==1.3.0 @@ -80,6 +84,8 @@ cffi==2.0.0 # via # cryptography # pycares +chardet==5.2.0 + # via cyclonedx-bom charset-normalizer==3.4.4 # via # -c constraints/security.txt @@ -118,8 +124,14 @@ cuda-pathfinder==1.5.2 # via cuda-bindings cuda-toolkit[cublas,cudart,cufft,cufile,cupti,curand,cusolver,cusparse,nvjitlink,nvrtc,nvtx]==13.0.2 # via torch +cyclonedx-bom==7.3.0 + # via geosync (pyproject.toml) +cyclonedx-python-lib[validation]==11.11.0 + # via cyclonedx-bom deap==1.4.3 # via geosync (pyproject.toml) +defusedxml==0.7.1 + # via py-serializable dependency-groups==1.3.1 # via cibuildwheel docutils==0.22.2 @@ -141,6 +153,8 @@ filelock==3.20.3 # torch flake8==7.1.1 # via geosync (pyproject.toml) +fqdn==1.5.1 + # via jsonschema frozenlist==1.8.0 # via # aiohttp @@ -190,6 +204,7 @@ idna==3.18 # -c constraints/security.txt # anyio # httpx + # jsonschema # requests # yarl import-linter==2.11 @@ -198,6 +213,8 @@ importlib-metadata==8.7.0 # via opentelemetry-api iniconfig==2.1.0 # via pytest +isoduration==20.11.0 + # via jsonschema isort==5.13.2 # via geosync (pyproject.toml) jaraco-classes==3.4.0 @@ -230,22 +247,33 @@ joblib==1.5.2 # via # geosync (pyproject.toml) # scikit-learn -jsonschema==4.25.1 - # via altair +jsonpointer==3.1.1 + # via jsonschema +jsonschema[format-nongpl]==4.25.1 + # via + # altair + # cyclonedx-python-lib + # geosync (pyproject.toml) jsonschema-specifications==2025.9.1 # via jsonschema keyring==25.6.0 # via twine korean-lunar-calendar==0.3.1 # via exchange-calendars +lark==1.3.1 + # via rfc3987-syntax libcst==1.7.0 # via mutmut librt==0.9.0 # via mypy +license-expression==30.4.4 + # via cyclonedx-python-lib linkify-it-py==2.0.3 # via markdown-it-py llvmlite==0.46.0 # via numba +lxml==6.1.1 + # via cyclonedx-python-lib mako==1.3.12 # via # -c constraints/security.txt @@ -392,6 +420,10 @@ opt-einsum==3.4.0 # via jax optuna==3.6.2 # via geosync (pyproject.toml) +packageurl-python==0.17.6 + # via + # cyclonedx-bom + # cyclonedx-python-lib packaging==25.0 # via # aiokafka @@ -399,10 +431,12 @@ packaging==25.0 # black # build # cibuildwheel + # cyclonedx-bom # dependency-groups # hydra-core # optuna # pandera + # pip-requirements-parser # pytest # pytest-rerunfailures # strawberry-graphql @@ -429,6 +463,8 @@ pillow==12.2.0 # -c constraints/security.txt # captcha # streamlit +pip-requirements-parser==32.0.1 + # via cyclonedx-bom pip-tools==7.5.1 # via geosync (pyproject.toml) platformdirs==4.5.0 @@ -466,6 +502,8 @@ psycopg-binary==3.2.11 # via psycopg py-cpuinfo==9.0.0 # via pytest-benchmark +py-serializable==2.1.0 + # via cyclonedx-python-lib py-spy==0.4.1 # via geosync (pyproject.toml) pyarrow==24.0.0 @@ -514,6 +552,8 @@ pyjwt[crypto]==2.13.0 # streamlit-authenticator pyluach==2.3.0 # via exchange-calendars +pyparsing==3.3.2 + # via pip-requirements-parser pyproject-hooks==1.2.0 # via # build @@ -553,6 +593,7 @@ pytest-xdist==3.8.0 # via geosync (pyproject.toml) python-dateutil==2.9.0.post0 # via + # arrow # pandas # strawberry-graphql python-dotenv==1.2.2 @@ -580,6 +621,7 @@ redis==7.0.0 # via geosync (pyproject.toml) referencing==0.37.0 # via + # cyclonedx-python-lib # jsonschema # jsonschema-specifications requests==2.34.2 @@ -594,8 +636,14 @@ requests==2.34.2 # twine requests-toolbelt==1.0.0 # via twine +rfc3339-validator==0.1.4 + # via jsonschema rfc3986==2.0.0 # via twine +rfc3986-validator==0.1.1 + # via jsonschema +rfc3987-syntax==1.1.0 + # via jsonschema rich==14.2.0 # via # bandit @@ -630,12 +678,15 @@ six==1.17.0 # via # pytest-profiling # python-dateutil + # rfc3339-validator smmap==5.0.2 # via gitdb sniffio==1.3.1 # via anyio sortedcontainers==2.4.0 - # via hypothesis + # via + # cyclonedx-python-lib + # hypothesis sqlalchemy==2.0.51 # via # -c constraints/security.txt @@ -703,6 +754,7 @@ typing-extensions==4.15.0 # anyio # ccxt # cross-web + # cyclonedx-python-lib # fastapi # grimp # grpcio @@ -737,10 +789,13 @@ typing-inspection==0.4.2 # pydantic-settings tzdata==2025.2 # via + # arrow # exchange-calendars # pandas uc-micro-py==1.0.3 # via linkify-it-py +uri-template==1.3.0 + # via jsonschema urllib3==2.7.0 # via # -c constraints/security.txt @@ -750,6 +805,8 @@ uvicorn==0.49.0 # via geosync (pyproject.toml) watchdog==6.0.0 # via streamlit +webcolors==25.10.0 + # via jsonschema websockets==15.0.1 # via geosync (pyproject.toml) wheel==0.47.0 diff --git a/requirements-scan.txt b/requirements-scan.txt index ce8a5313c..f34840f67 100644 --- a/requirements-scan.txt +++ b/requirements-scan.txt @@ -38,7 +38,7 @@ websockets>=15.0.1 ccxt>=4.5.12 tenacity>=9.1.2 aiolimiter>=1.2.1 -fastapi>=0.138.1,<1.0.0 +fastapi>=0.139.0,<1.0.0 strawberry-graphql[fastapi]>=0.319.0 alembic>=1.14.0 psycopg[binary]>=3.2.3 diff --git a/requirements.txt b/requirements.txt index 3288613a4..0a5bdda89 100644 --- a/requirements.txt +++ b/requirements.txt @@ -33,7 +33,7 @@ websockets>=15.0.1 ccxt>=4.5.12 tenacity>=9.1.2 aiolimiter>=1.2.1 -fastapi>=0.138.1,<1.0.0 +fastapi>=0.139.0,<1.0.0 strawberry-graphql[fastapi]>=0.312.3 alembic>=1.14.0 psycopg[binary]>=3.2.3