build(deps): update anthropic requirement from >=0.120.0 to >=1.0.0 in /services/api - #362
Closed
dependabot[bot] wants to merge 1 commit into
Closed
build(deps): update anthropic requirement from >=0.120.0 to >=1.0.0 in /services/api#362dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
|
Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here. So far, Strix has reviewed 28 pull requests, surfaced 3 security issues (1 critical/high) and blocked 2 risky merges across this workspace. |
ibuilder
added a commit
that referenced
this pull request
Aug 28, 2026
Produced by .github/workflows/lockfile.yml on the previous commit of this branch — the workflow
uploads the freshly-compiled lock as an artifact even when its verify step fails, which is the
documented bootstrap path and the only correct one here: the lock carries --generate-hashes and is
resolved in the prod image, so a Windows compile would produce a different artifact (uvloop has no
Windows build; colorama is absent from a Linux-compiled lock).
EXACTLY FIVE PINS MOVED, 110 in and 110 out — no package added or removed:
pyhanko 0.35.2 -> 0.36.2
pyhanko-certvalidator 0.31.1 -> 0.31.4 (transitive, pulled by pyhanko)
reportlab 5.0.0 -> 5.0.1
scipy 1.18.0 -> 1.18.1
sentry-sdk[fastapi] 2.66.1 -> 2.68.1
anthropic stayed at 0.120.2, which is the point of holding #362 out of this batch.
Verified by parsing both locks and diffing the pin sets rather than by reading the diff — my first
two attempts under-reported, one regex missing bracketed extras () and so
reporting sentry as unmoved when it had moved. A diff is only as good as the pattern that feeds it.
ibuilder
added a commit
that referenced
this pull request
Aug 28, 2026
Produced by .github/workflows/lockfile.yml on the previous commit of this branch — the workflow
uploads the freshly-compiled lock as an artifact even when its verify step fails, which is the
documented bootstrap path and the only correct one here: the lock carries --generate-hashes and is
resolved in the prod image, so a Windows compile would produce a different artifact (uvloop has no
Windows build; colorama is absent from a Linux-compiled lock).
EXACTLY FIVE PINS MOVED, 110 in and 110 out — no package added or removed:
pyhanko 0.35.2 -> 0.36.2
pyhanko-certvalidator 0.31.1 -> 0.31.4 (transitive, pulled by pyhanko)
reportlab 5.0.0 -> 5.0.1
scipy 1.18.0 -> 1.18.1
sentry-sdk[fastapi] 2.66.1 -> 2.68.1
anthropic stayed at 0.120.2, which is the point of holding #362 out of this batch.
Verified by parsing both locks and diffing the PIN SETS rather than by reading a textual diff. My
first two attempts under-reported: one regex did not allow bracketed extras, so it matched no
"sentry-sdk[fastapi]==" line at all and reported sentry as unmoved when it had in fact moved. A diff
is only as good as the pattern that feeds it, and a pattern that silently matches nothing looks
exactly like agreement.
pyhanko 0.35.2 -> 0.36.2 is the one worth watching here: it is the PDF-signing stack, and this venv
cannot install the lock to exercise it (Windows), so CI is the authority for that bump.
Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python) to permit the latest version. - [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md) - [Commits](anthropics/anthropic-sdk-python@v0.120.0...v1.0.0) --- updated-dependencies: - dependency-name: anthropic dependency-version: 1.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/pip/services/api/anthropic-gte-1.0.0
branch
from
August 28, 2026 10:33
68d1bb6 to
3d2edde
Compare
ibuilder
added a commit
that referenced
this pull request
Aug 28, 2026
Compiled by .github/workflows/lockfile.yml in the prod base image, downloaded from that run's artifact and committed unmodified. Six package-level changes: anthropic 0.120.2 -> 1.2.0 + httpx2 2.12.0, httpcore2 2.12.0, truststore 0.10.4 (anthropic's new HTTP layer) - distro 1.9.0 (was reached only via anthropic) `distro` is the useful line here, because it is the control case for the previous commit. It was a transitive dependency whose sole route into the lock was `# via anthropic`, and the bump deleted it outright. That is precisely what would have happened to `httpx` — which two shipped modules import at module scope — had it not been declared first. The lock now records the difference in its own comments: httpx==0.28.1 # via -r services/api/requirements.in (was: # via anthropic) pillow==12.3.0 # via -r services/api/requirements.in / reportlab httpx2==2.12.0 # via anthropic Licences checked against the LICENSE files themselves rather than package summaries, since all three additions are new names in this tree: httpx2 and httpcore2 are BSD-3-Clause, copyright Pydantic Services Inc. and Encode OSS Ltd — Encode being the original httpx copyright holder, which is the provenance that makes an unfamiliar package name legible to a supply-chain scanner rather than alarming. truststore is MIT (Seth Michael Larson); it is the system-trust-store shim pip itself uses. Nothing copyleft, so the supply_chain --gate line is unaffected. No ATTRIBUTIONS.md entry: that file is scoped to code we re-implement or adapt "beyond the dependencies pinned in requirements.txt". One incidental drift worth recording rather than fixing here: the header comment now carries --no-index, which the workflow does not pass. It comes from a newer pip-tools, installed unpinned by the workflow's `pip install pip-tools`. Harmless — it is a recorded command string — but it means the lock's exact formatting can move on a pip-tools release and surface as a spurious "stale lock" on an unrelated push. Pinning pip-tools is a separate decision, not a dependency bump's business. Verified after recompiling: test_lock_satisfies_requirements green (it was correctly red on the previous commit), test_declared_imports green, test_lock_advisories green. The full backend suite is CI's call — this machine's venv still has anthropic 0.120.2 and cannot install a Linux-compiled --require-hashes lock, so a local pass here would be measuring the old SDK. Closes #362. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ibuilder
added a commit
that referenced
this pull request
Aug 28, 2026
… bump would have deleted Dependabot #362 raises the `anthropic` floor from >=0.120.0 to >=1.0.0. Inventoried every call site against the 1.x migration list first, because the SDK's major removed a lot of surface. Ours uses none of it: the seven modules that import it all do plain `client.messages.create(...)`, already on the current `output_config={"format": ...}` shape rather than the deprecated `output_format=`, with a plain float `timeout=` (not an httpx.Timeout). No with_raw_response, no Text Completions, no temperature/top_p/top_k, no Bedrock/Vertex, and no `anthropic.*` exception classes anywhere. The bump is still not free, and what it would have broken was nowhere near anthropic. 1.x moved its HTTP layer from `httpx` to `httpx2`. `httpx` was declared in no requirements file at all — it reached the lock on one transitive edge, `# via anthropic` — while `bsdd.py` and `site_context.py` both `import httpx` at module scope. Recompiling the lock would have dropped the package while two shipped modules still imported it. That failure would not have announced itself. Both consumers are imported inside functions, so the service boots, /health passes, and the suite stays green until someone opens the bSDD lookup or a site-context route and gets a 500 — with nothing connecting it to an AI SDK upgrade. Sweeping for the class found a second one already sitting there: `pillow`, arriving only `# via reportlab`, imported at module scope by `photo_cv.py` — whose sibling `photo_detect.py` calls it "a hard dep" in a comment while nothing declared it. One reportlab release away from blanking site-photo QA the same silent way. Both are now declared, with the floor pillow already carries in services/data/requirements.txt. `test_declared_imports.py` makes the rule enforceable rather than remembered: a package in our own import statements is a DIRECT dependency however else it happens to arrive. Transitive availability is a fact about somebody else's metadata and can change in a release we never review. The exemptions are structural, so the gate does not decay into a name list. Function-local and try/except-ImportError imports stay legal — that is how this codebase spells "optional, supplied by the deployment" (pye57, massingifc_*), and they fail loudly at call time instead of silently. First-party is derived by listing the src roots, so vendoring a fourth package needs no edit here; that derivation is also what corrected my own first pass, which had missed that massingifc_ifc and massingifc_scene are vendored on services/data/src and wrongly called them third-party. Mutation-checked three ways, since a gate that cannot fail proves nothing: un-declaring httpx fails naming bsdd.py, un-declaring pillow fails naming photo_cv.py, and promoting the guarded optional `import pye57` to module scope fails as not-installed — that last one proving the exemption is not swallowing everything. The lock is deliberately stale in this commit; `test_lock_satisfies_requirements` goes red until lockfile.yml recompiles it in python:3.12-slim, which is the next commit on this branch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ibuilder
added a commit
that referenced
this pull request
Aug 28, 2026
Compiled by .github/workflows/lockfile.yml in the prod base image, downloaded from that run's artifact and committed unmodified. Six package-level changes: anthropic 0.120.2 -> 1.2.0 + httpx2 2.12.0, httpcore2 2.12.0, truststore 0.10.4 (anthropic's new HTTP layer) - distro 1.9.0 (was reached only via anthropic) `distro` is the useful line here, because it is the control case for the previous commit. It was a transitive dependency whose sole route into the lock was `# via anthropic`, and the bump deleted it outright. That is precisely what would have happened to `httpx` — which two shipped modules import at module scope — had it not been declared first. The lock now records the difference in its own comments: httpx==0.28.1 # via -r services/api/requirements.in (was: # via anthropic) pillow==12.3.0 # via -r services/api/requirements.in / reportlab httpx2==2.12.0 # via anthropic Licences checked against the LICENSE files themselves rather than package summaries, since all three additions are new names in this tree: httpx2 and httpcore2 are BSD-3-Clause, copyright Pydantic Services Inc. and Encode OSS Ltd — Encode being the original httpx copyright holder, which is the provenance that makes an unfamiliar package name legible to a supply-chain scanner rather than alarming. truststore is MIT (Seth Michael Larson); it is the system-trust-store shim pip itself uses. Nothing copyleft, so the supply_chain --gate line is unaffected. No ATTRIBUTIONS.md entry: that file is scoped to code we re-implement or adapt "beyond the dependencies pinned in requirements.txt". One incidental drift worth recording rather than fixing here: the header comment now carries --no-index, which the workflow does not pass. It comes from a newer pip-tools, installed unpinned by the workflow's `pip install pip-tools`. Harmless — it is a recorded command string — but it means the lock's exact formatting can move on a pip-tools release and surface as a spurious "stale lock" on an unrelated push. Pinning pip-tools is a separate decision, not a dependency bump's business. Verified after recompiling: test_lock_satisfies_requirements green (it was correctly red on the previous commit), test_declared_imports green, test_lock_advisories green. The full backend suite is CI's call — this machine's venv still has anthropic 0.120.2 and cannot install a Linux-compiled --require-hashes lock, so a local pass here would be measuring the old SDK. Closes #362. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/pip/services/api/anthropic-gte-1.0.0
branch
August 28, 2026 13:49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the requirements on anthropic to permit the latest version.
Release notes
Sourced from anthropic's releases.
Changelog
Sourced from anthropic's changelog.
... (truncated)
Commits
23cf458release: 1.0.0f0e51d6codegen metadatabc70186fix(beta): stop warning aboutoutput_format=on the parse/stream/tool_runne...482220cchore(streaming): restore the original event imports in lib/streaming/_types.py9782e88feat(client)!: upgrade to httpx2 and some minor breaking changes. See MIGRATI...5df83badocs(examples): use adaptive thinking in thinking examplesd8d8ee6release: 0.125.004a5b5dfeat(api): managed agents web search config and self hosted sandbox memory781ce5erelease: 0.124.0f51102cfeat(api): Files and Skills APIs are now GA; add computer use and browser use...