Skip to content

build(deps): update uvicorn requirement from ^0.44.0 to >=0.44,<0.53 #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

build(deps): update uvicorn requirement from ^0.44.0 to >=0.44,<0.53 #33

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ packages = [{include = "engine"}]
[tool.poetry.dependencies]
python = "^3.11"
fastapi = "^0.135.1"
uvicorn = {extras = ["standard"], version = "^0.44.0"}
uvicorn = {extras = ["standard"], version = ">=0.44,<0.53"}

@coderabbitai coderabbitai Bot Aug 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

if test -f poetry.lock; then
  poetry check --lock
  rg -n -A12 -B2 'name = "uvicorn"' poetry.lock
else
  echo "No poetry.lock found; confirm production resolves dependencies intentionally."
fi

Repository: cryptoxdog/l9-codegraph

Length of output: 239

🏁 Script executed:

printf '%s\n' '--- tracked dependency files ---'
git ls-files | rg '(^|/)(pyproject\.toml|poetry\.lock|Dockerfile\.prod|uv\.lock|requirements[^/]*\.txt)$' || true
printf '%s\n' '--- Dockerfile.prod references ---'
if test -f Dockerfile.prod; then
  rg -n -C4 'poetry|uvicorn|lock|install|pyproject' Dockerfile.prod
else
  printf '%s\n' 'Dockerfile.prod not found at repository root'
fi
printf '%s\n' '--- pyproject.toml dependency configuration ---'
if test -f pyproject.toml; then
  sed -n '1,120p' pyproject.toml
else
  printf '%s\n' 'pyproject.toml not found at repository root'
fi

Repository: cryptoxdog/l9-codegraph

Length of output: 2320

🌐 Web query:

Poetry 1.8 install behavior when poetry.lock does not exist and Dockerfile COPY wildcard has no matching files

💡 Result:

When utilizing Poetry 1.8 in a Docker environment, the behavior is determined by two distinct processes: the Docker build process and the Poetry installation process [1][2]. 1. Docker COPY Behavior If your Dockerfile contains a COPY instruction with a wildcard (e.g., COPY src/*.py /app/) and no files match that pattern, the Docker build will fail [3][4]. Docker requires that at least one source file matches the specified pattern; otherwise, it treats the instruction as a failure and terminates the build process with an error, such as "no such file or directory" or "no matches found" [3][5]. There is no native flag in Docker's COPY command to ignore missing source files [4][6]. 2. Poetry Install Behavior If your Docker build passes and proceeds to the poetry install step, Poetry's behavior when poetry.lock is missing depends on the presence of pyproject.toml [2][7]: * If poetry.lock is present: Poetry uses the locked versions, ensuring deterministic builds [2][8]. * If poetry.lock is missing: Poetry will read the pyproject.toml file, resolve the dependencies defined within it, and perform the installation [2][7]. * After successfully resolving and installing the dependencies, Poetry will automatically create a new poetry.lock file in the current directory [2][8]. Recommendation To avoid issues in Docker builds, it is standard practice to copy only the essential configuration files (pyproject.toml and poetry.lock) first [1][9]. If you must copy files with wildcards, ensure the source files exist in the build context before the COPY command is executed [3]. If you encounter problems with missing lock files, ensure that your CI/CD pipeline or development environment correctly persists the lock file, as it is intended to be checked into version control rather than generated at build time [10].

Citations:

Add and commit poetry.lock.

Dockerfile.prod uses COPY pyproject.toml poetry.lock* ./. The build fails when poetry.lock is absent. Generate the lock file with the uvicorn constraint and commit it.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pyproject.toml` at line 12, Generate and commit the repository’s poetry.lock
file from pyproject.toml, preserving the uvicorn version constraint >=0.44,<0.53
so Dockerfile.prod’s COPY dependency is available during builds.

pydantic = "^2.10.0"
pydantic-settings = "^2.6.0"
httpx = "^0.28.0"
Expand Down
Loading