build(deps): update uvicorn requirement from ^0.44.0 to >=0.44,<0.53 - #33
build(deps): update uvicorn requirement from ^0.44.0 to >=0.44,<0.53#33dependabot[bot] wants to merge 1 commit into
Conversation
Updates the requirements on [uvicorn](https://github.com/Kludex/uvicorn) to permit the latest version. - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.44.0...0.52.0) --- updated-dependencies: - dependency-name: uvicorn dependency-version: 0.52.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
WalkthroughThe PR changes the Poetry ChangesUvicorn dependency update
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pyproject.toml`:
- Line 12: Generate and commit the repository’s poetry.lock file from
pyproject.toml, preserving the uvicorn version constraint >=0.44,<0.53 so
Dockerfile.prod’s COPY dependency is available during builds.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: de250dd1-eb4e-41ab-a8bb-b7f66afeb5e1
📒 Files selected for processing (1)
pyproject.toml
| python = "^3.11" | ||
| fastapi = "^0.135.1" | ||
| uvicorn = {extras = ["standard"], version = "^0.44.0"} | ||
| uvicorn = {extras = ["standard"], version = ">=0.44,<0.53"} |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
if test -f poetry.lock; then
poetry check --lock
rg -n -A12 -B2 'name = "uvicorn"' poetry.lock
else
echo "No poetry.lock found; confirm production resolves dependencies intentionally."
fiRepository: cryptoxdog/l9-codegraph
Length of output: 239
🏁 Script executed:
printf '%s\n' '--- tracked dependency files ---'
git ls-files | rg '(^|/)(pyproject\.toml|poetry\.lock|Dockerfile\.prod|uv\.lock|requirements[^/]*\.txt)$' || true
printf '%s\n' '--- Dockerfile.prod references ---'
if test -f Dockerfile.prod; then
rg -n -C4 'poetry|uvicorn|lock|install|pyproject' Dockerfile.prod
else
printf '%s\n' 'Dockerfile.prod not found at repository root'
fi
printf '%s\n' '--- pyproject.toml dependency configuration ---'
if test -f pyproject.toml; then
sed -n '1,120p' pyproject.toml
else
printf '%s\n' 'pyproject.toml not found at repository root'
fiRepository: cryptoxdog/l9-codegraph
Length of output: 2320
🌐 Web query:
Poetry 1.8 install behavior when poetry.lock does not exist and Dockerfile COPY wildcard has no matching files
💡 Result:
When utilizing Poetry 1.8 in a Docker environment, the behavior is determined by two distinct processes: the Docker build process and the Poetry installation process [1][2]. 1. Docker COPY Behavior If your Dockerfile contains a COPY instruction with a wildcard (e.g., COPY src/*.py /app/) and no files match that pattern, the Docker build will fail [3][4]. Docker requires that at least one source file matches the specified pattern; otherwise, it treats the instruction as a failure and terminates the build process with an error, such as "no such file or directory" or "no matches found" [3][5]. There is no native flag in Docker's COPY command to ignore missing source files [4][6]. 2. Poetry Install Behavior If your Docker build passes and proceeds to the poetry install step, Poetry's behavior when poetry.lock is missing depends on the presence of pyproject.toml [2][7]: * If poetry.lock is present: Poetry uses the locked versions, ensuring deterministic builds [2][8]. * If poetry.lock is missing: Poetry will read the pyproject.toml file, resolve the dependencies defined within it, and perform the installation [2][7]. * After successfully resolving and installing the dependencies, Poetry will automatically create a new poetry.lock file in the current directory [2][8]. Recommendation To avoid issues in Docker builds, it is standard practice to copy only the essential configuration files (pyproject.toml and poetry.lock) first [1][9]. If you must copy files with wildcards, ensure the source files exist in the build context before the COPY command is executed [3]. If you encounter problems with missing lock files, ensure that your CI/CD pipeline or development environment correctly persists the lock file, as it is intended to be checked into version control rather than generated at build time [10].
Citations:
- 1: https://python-poetry.org/docs/1.8/faq/
- 2: https://python-poetry.org/docs/cli/
- 3: https://docs.docker.com/reference/dockerfile/
- 4: "COPY foo/* bar/" not work if no file in foo/ moby/moby#13045
- 5: BuildKit has different behavior than normal mode when COPYing with wildcards moby/buildkit#1266
- 6: "COPY foo/* bar/" not work if no file in foo/ moby/moby#13045
- 7: https://github.com/python-poetry/poetry/blob/f4670233/src/poetry/console/commands/install.py
- 8: https://python-poetry.org/docs/main/cli
- 9: https://depot.dev/docs/container-builds/optimal-dockerfiles/python-poetry-dockerfile
- 10: https://stackoverflow.com/questions/76793368/run-poetry-install-in-dockerfile-does-not-generate-poetry-lock
Add and commit poetry.lock.
Dockerfile.prod uses COPY pyproject.toml poetry.lock* ./. The build fails when poetry.lock is absent. Generate the lock file with the uvicorn constraint and commit it.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pyproject.toml` at line 12, Generate and commit the repository’s poetry.lock
file from pyproject.toml, preserving the uvicorn version constraint >=0.44,<0.53
so Dockerfile.prod’s COPY dependency is available during builds.
Updates the requirements on uvicorn to permit the latest version.
Release notes
Sourced from uvicorn's releases.
Changelog
Sourced from uvicorn's changelog.
... (truncated)
Commits
8f1b884Version 0.52.0 (#3044)f6833dbAdd experimental zttp HTTP/1.1 protocol (#2979)d26c85cPrepare compatibility with websockets 17.0. (#3036)7e11cc6Clarify how limit_concurrency and backlog differ (#3029)e4d0b05Version 0.51.0 (#3028)944e43dRemove colorama from the standard extra (#3027)2e78770Restart workers with overlap on SIGHUP for near-zero-downtime reloads (#3025)a1b570cVersion 0.50.2 (#3022)83c7da7Require websockets>=13.0 for the default sansio implementation (#3021)b4d0116Version 0.50.1 (#3020)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit