Bump starlette, fastapi, opentelemetry, add additional test coverage - #5032
Conversation
Bumps the pip group with 1 update in the /e2e_tests directory: [starlette](https://github.com/Kludex/starlette). Updates `starlette` from 0.50.0 to 1.3.1 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
Updates the e2e test dependency constraints by changing the pinned Starlette version.
Changes:
- Bump
starletteine2e_tests/requirements.txtfrom0.50.0to1.3.1
Unit Test Results755 tests 755 ✅ 11s ⏱️ Results for commit bc064a4. ♻️ This comment has been updated with latest results. |
|
/test-extended |
|
🤖 pr-bot 🤖
(in response to this comment from Jack Morris (@rudolphjacksonm)) |
|
/test-extended 921a8b6 |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/31394956452 (with refid (in response to this comment from Jack Morris (@rudolphjacksonm)) |
fastapi must be bumped to 0.139.2 to be compatible with starlette 1.3.1
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.
Suppressed comments (2)
api_app/requirements.txt:14
- The title and description state that this PR only updates Starlette under
/e2e_testsin one directory, but this also upgrades the production API's FastAPI dependency. Update the PR metadata to disclose the API runtime change and explain that it is the compatibility companion to the Starlette upgrade.
fastapi==0.139.2
e2e_tests/requirements.txt:5
- This major Starlette/FastAPI dependency update is missing from the unreleased changelog. Equivalent updates are explicitly recorded in
CHANGELOG.md:189andCHANGELOG.md:197, and the repository instructions require significant changes to be listed. Add an unreleased entry with the PR reference.
starlette==1.3.1
|
/test-extended 74a4c05 |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/31400251822 (with refid (in response to this comment from Jack Morris (@rudolphjacksonm)) |
Align Azure Monitor instrumentation with FastAPI's nested router model and add instrumented routing regression coverage.\n\nCo-Authored-By: Claude <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.
Suppressed comments (3)
api_app/requirements.txt:14
- These production API dependency upgrades (together with the resource-processor changes and new API tests) are outside the PR's stated
/e2e_tests-only Starlette update. This materially broadens the release and review risk. Either revert the unrelated production changes or update the title/description to explain the FastAPI/OpenTelemetry upgrade and its validation.
azure-monitor-opentelemetry==1.8.9
azure-servicebus==7.14.3
azure-storage-blob==12.27.1
fastapi==0.139.2
resource_processor/vmss_porter/requirements.txt:6
- These dependency changes alter the deployable resource processor, but
resource_processor/_version.pyremains at0.13.5. The repository's component versioning policy requires a semantic version increment when a component is edited; bump the resource-processor version so this updated runtime can be released and identified correctly.
azure-monitor-opentelemetry==1.8.9
azure-servicebus==7.14.3
opentelemetry-instrumentation-logging==0.64b0
api_app/_version.py:1
- The API is being released as
0.26.4, but the Unreleased changelog has no entry for this API/FastAPI/OpenTelemetry update. Add an ENHANCEMENTS or BUG FIXES entry with the PR reference, as required by the repository's changelog policy.
__version__ = "0.26.4"
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.
Suppressed comments (2)
api_app/requirements.txt:14
- The title and description say this PR only updates Starlette under
e2e_tests, but this line is part of a production API framework upgrade; the diff also changes telemetry instrumentation, API/resource-processor dependencies, tests, and deployable component versions. Please either update the PR title and description to disclose and explain this expanded runtime scope, or split the unrelated production changes into a separate PR so reviewers and release automation are not evaluating a materially misdescribed change.
fastapi==0.139.2
api_app/_version.py:1
- This releases a new API version (and the PR also increments the resource processor), but the Unreleased section of
CHANGELOG.mdhas no entry for these production dependency and instrumentation changes. Add an ENHANCEMENTS or BUG FIXES entry with the PR/issue reference and the affected component versions, as required for significant changes and component releases.
__version__ = "0.26.4"
|
/test-extended 84218a4 |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/31481550375 (with refid (in response to this comment from Jack Morris (@rudolphjacksonm)) |
Co-Authored-By: Claude <noreply@anthropic.com>
|
/test-extended 32fcb0e |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/31498122739 (with refid (in response to this comment from Jack Morris (@rudolphjacksonm)) |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.
Suppressed comments (4)
resource_processor/vmss_porter/requirements.txt:6
- The resource processor OpenTelemetry upgrades are unrelated to the described Starlette update in
e2e_testsand materially alter a production component. Please remove/split them, or expand the PR description to justify and document this additional upgrade scope.
azure-monitor-opentelemetry==1.8.9
azure-servicebus==7.14.3
opentelemetry-instrumentation-logging==0.64b0
api_app/_version.py:1
- The API component version is bumped without a corresponding entry in the unreleased CHANGELOG section. Add an ENHANCEMENTS or BUG FIXES entry describing the API dependency/instrumentation change and referencing this PR or its issue.
__version__ = "0.26.5"
resource_processor/_version.py:1
- The resource processor component version is bumped without a corresponding entry in the unreleased CHANGELOG section. Add an ENHANCEMENTS or BUG FIXES entry for its OpenTelemetry dependency update with a PR or issue reference.
__version__ = "0.13.6"
api_app/requirements.txt:14
- The PR description says the only update is Starlette under
e2e_tests, but this also changes the production API's FastAPI and OpenTelemetry dependency set and adds API tests/version changes. Either split these API changes into their own PR or update the description to explain their purpose, compatibility impact, and validation; as written, reviewers cannot assess the actual stated scope.
fastapi==0.139.2
Jack Morris (rudolphjacksonm)
changed the title
Marcus Robinson (marrobi)
left a comment
Marcus Robinson (marrobi)
left a comment
There was a problem hiding this comment.
Changelog needs doing.
Co-Authored-By: Claude <noreply@anthropic.com>
|
/test-force-approve |
|
🤖 pr-bot 🤖 ✅ Marking tests as complete (for commit bc064a4) (in response to this comment from Jack Morris (@rudolphjacksonm)) |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.
Suppressed comments (1)
CHANGELOG.md:9
- The new changelog entry omits the required issue or PR reference. Add the current PR (or its tracking issue) in the established
([#NNNN](https://github.com/microsoft/AzureTRE/pull/NNNN))format so the release note remains traceable.
* Upgrade FastAPI to 0.139.2, Starlette to 1.3.1, and compatible OpenTelemetry dependencies, with routing updates for newer FastAPI and Pydantic v2 compatibility.
…icrosoft#5032) * Bump starlette in /e2e_tests in the pip group across 1 directory Bumps the pip group with 1 update in the /e2e_tests directory: [starlette](https://github.com/Kludex/starlette). Updates `starlette` from 0.50.0 to 1.3.1 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com> * bump fastapi fastapi must be bumped to 0.139.2 to be compatible with starlette 1.3.1 * Update api version * Upgrade OpenTelemetry for FastAPI 0.139 Align Azure Monitor instrumentation with FastAPI's nested router model and add instrumented routing regression coverage.\n\nCo-Authored-By: Claude <noreply@anthropic.com> * bump resource processor version * Bump API version to 0.26.5 Co-Authored-By: Claude <noreply@anthropic.com> * Update changelog for FastAPI upgrade Co-Authored-By: Claude <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jack Morris <13438569+rudolphjacksonm@users.noreply.github.com> Co-authored-by: Jack Morris <jackmorris@UK-2SZ4CC4.localdomain> Co-authored-by: Claude <noreply@anthropic.com>
Bumps the pip group with 1 update in the /e2e_tests directory: starlette.
Updates
starlettefrom 0.50.0 to 1.3.1Release notes
Sourced from starlette's releases.
... (truncated)
Changelog
Sourced from starlette's changelog.
... (truncated)
Commits
8ebffd0Version 1.3.1 (#3330)25b8e17EnforceFormParserlimits in parser callbacks (#3331)dba1c4bEnforcemax_fieldsandmax_part_sizeinFormParser(#3329)45e51dcUseStarletteDeprecationWarninginstead ofDeprecationWarning(#3119)5f8610cVersion 1.3.0 (#3327)167b585Buildrequest.urlfrom structured components (#3326)3730925Useremoveprefixto strip weak ETag indicator inis_not_modified(#3193)e6f7ad1avoid collapsing exception groups from user code (#2830)115228fAnnotate URLPath protocol parameter with Literal (#3285)113f193docs: replace inline ASGI server list with link to canonical implemen… (#3204)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.