Skip to content

Update Python dependencies (non-major) - #12929

Merged
RayBB merged 4 commits into
masterfrom
renovate/python-non-major
Oct 13, 2026
Merged

Update Python dependencies (non-major)#12929
RayBB merged 4 commits into
masterfrom
renovate/python-non-major

Conversation

@renovate

@renovate renovate Bot commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
APScheduler (changelog) ==3.11.2 → ==3.11.3 age confidence
beautifulsoup4 (changelog) ==4.14.3 → ==4.15.0 age confidence
fastapi (changelog) ==0.136.3 → ==0.142.2 age confidence
fastapi (changelog) ==0.115.0 → ==0.142.2 age confidence
feedparser ==6.0.12 → ==6.0.14 age confidence
httpx (changelog) ==0.27.2 → ==0.28.1 age confidence
ijson ==3.5.0 → ==3.5.1 age confidence
internetarchive ==5.9.0 → ==5.11.1 age confidence
luqum ==0.11.0 → ==0.14.0 age confidence
lxml (source, changelog) ==6.1.1 → ==6.1.3 age confidence
mypy (changelog) ==2.1.0 → ==2.4.0 age confidence
nameparser ==1.1.3 → ==1.4.0 age confidence
psycopg (changelog) ==3.3.5 → ==3.3.6 age confidence
psycopg2 (source, changelog) ==2.9.12 → ==2.9.13 age confidence
pydantic (changelog) ==2.13.4 → ==2.13.5 age confidence
pydantic-settings (changelog) ==2.9.1 → ==2.15.0 age confidence
pymarc ==5.3.1 → ==5.4.0 age confidence
pytest (changelog) ==9.0.3 → ==9.1.1 age confidence
ruff (source, changelog) ==0.16.1 → ==0.16.10 age confidence
sentry-sdk (changelog) ==2.61.1 → ==2.71.0 age confidence
uvicorn (changelog) ==0.49.0 → ==0.54.0 age confidence
uvicorn (changelog) ==0.30.6 → ==0.54.0 age confidence

Release Notes

agronholm/apscheduler (APScheduler)

v3.11.3

Compare Source

  • Fixed sub-minute interval jobs stalling for the duration of a DST spring-forward gap when the scheduler was configured with a ZoneInfo time zone, caused by the wakeup delay being computed from the naive wall-clock difference instead of the actual UTC difference (#​1103)
  • Fixed imported jobs missing their scheduler and job store links (#​1119)
fastapi/fastapi (fastapi)

v0.142.2

Compare Source

Fixes

v0.142.1

Compare Source

Fixes

v0.142.0

Compare Source

Features
Refactors
Docs
Translations
Internal

v0.141.1

Compare Source

Fixes
  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #​16105 by @​tiangolo.
Docs

v0.141.0

Compare Source

Features
  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #​16102 by @​tiangolo.

v0.140.13

Compare Source

Fixes
Docs

v0.140.12

Compare Source

Fixes

v0.140.11

Compare Source

Fixes
  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #​15093 by @​YuriiMotov.

v0.140.10

Compare Source

Fixes
Internal

v0.140.9

Compare Source

Fixes
  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #​16043 by @​MBGrao.
Internal

v0.140.8

Compare Source

Fixes

v0.140.7

Compare Source

Refactors
Internal

v0.140.6

Compare Source

Refactors
  • ⚡️ Avoid flattening dependencies for request parameters, mainly for OpenAPI. PR #​16073 by @​tiangolo.

v0.140.5

Compare Source

Refactors

v0.140.4

Compare Source

Refactors

v0.140.3

Compare Source

Refactors

v0.140.2

Compare Source

Refactors
Internal

v0.140.1

Compare Source

Refactors
  • ♻️ Update the lru_cache limit for dependencies to account for large apps. PR #​16062 by @​tiangolo.

v0.140.0

Compare Source

Refactors
Docs
Internal

v0.139.2

Compare Source

Fixes
  • 🐛 Refactor router route building to make it thread-safe, mainly relevant for tests running in parallel threads (uncommon). PR #​16013 by @​tiangolo.

v0.139.1

Compare Source

Fixes
Docs
  • 📝 Fix topic repository list not being displayed and skip_users not being applied. PR #​15995 by @​YuriiMotov.
Translations
Internal

v0.139.0

Compare Source

Features
  • ✨ Support dependencies in app.frontend(), e.g. for automatic cookie authentication for the frontend. PR #​15908 by @​tiangolo.
Translations
Internal

v0.138.2

Compare Source

Refactors
  • ♻️ Make app.frontend() return 404 for methods other than GET or HEAD with no static file matches. PR #​15863 by @​tiangolo.
Internal

v0.138.1

Compare Source

Refactors
Internal

v0.138.0

Compare Source

Features
  • ✨ Add support for app.frontend("/", directory="dist") and router.frontend("/", directory="dist"). PR #​15800 by @​tiangolo.
Docs
Translations
Internal

v0.137.2

Compare Source

Features
  • ✨ Add iter_route_contexts() for advanced use cases that used to use router.routes (e.g. Jupyverse). PR #​15785 by @​tiangolo.
Translations
Internal

v0.137.1

Compare Source

Fixes

v0.137.0

Compare Source

Breaking Changes

Unblocks ✨ SO MANY THINGS ✨

Before this, router.include_router(other_router) would take each path operation from other_router and "clone" it, or recreate it from scratch.

This would mean that in the end there was only one top level router, part of the app.

The way it is structured here is that there are a few additional classes to handle intermediate metadata for router and route inclusion. That way the information of "router X includes Y and Y includes Z" is stored somewhere, without affecting (recreating / clonning) the final route.

Non Objectives

Dependencies for 404: previously I intended to support dependencies that would be executed even for 404, but that would conflict with the fact that a router could not find a match, but the next router did find a match. Executing dependencies in the router that did not find a match would not make sense, they could consume the request, body, etc. This original idea was discarded.

Specific Breaking Changes

Now router.routes is no longer a plain list of APIRoute objects, it can contain these intermediate objects that can contain additional routers, forming a tree.

Any logic that depended on iterating on the router.routes directly would be affected, that logic cannot expect to be able to extract data from a plain list of routes, as it's no longer a plain list but a tree.

Additionally, any logic that iterated on router.routes to modify them would now also see these new objects, and would not see all the routes in the app.

router.routes should be considered an internal implementation detail, only passed around to the FastAPI functions that need it.

Features
  • Adding routes (path operations) after a router is included now works, they are reflected as they are not copied.
  • Including subrouter in mainrouter can be done before adding routes (path operations) to subrouter, because now the the entire object is stored instead of copying the routes.
  • As routes are not copied, in some cases that might save some memory.
Alpha Features

This is not documented yet, so it's not officially supported yet and could change in the future.

But, as APIRoute and APIRouter instances are now preserved, they could be customized.

APIRouter has two new methods, .matches() and .handle(), counterpart to the existing ones in APIRoute. With this a router could customize how it matches and handles requests. For example, it could match only requests that include some specific header, for example for handling versions in headers.

Still, for now, consider this very experimental and potentially changing and breaking in the future.

Future Features Enabled
  • Custom APIRoute subclasses (undocumented, but alraedy works as desccribed above)
  • Custom APIRouter subclasses (undocumented, but already works as described above)
  • Dependencies per router
  • Exception handlers per router
  • Middleware per router
  • Other features planned
Docs

[!IMPORTANT]
✂ PR body was truncated to here.

@renovate
renovate Bot force-pushed the renovate/python-non-major branch from a837f0d to e7b3bdc Compare June 15, 2026 21:12
@renovate renovate Bot changed the title chore(deps): update python dependencies (non-major) Update Python dependencies (non-major) Jun 15, 2026
@renovate renovate Bot changed the title Update Python dependencies (non-major) chore(deps): update python dependencies (non-major) Jun 16, 2026
@renovate
renovate Bot force-pushed the renovate/python-non-major branch from e7b3bdc to d4aa84c Compare June 16, 2026 22:19
@mekarpeles mekarpeles mentioned this pull request Jun 17, 2026
Open
3 of 4 tasks
@renovate
renovate Bot force-pushed the renovate/python-non-major branch 2 times, most recently from 4486df4 to dac9204 Compare June 18, 2026 18:29
@renovate renovate Bot changed the title chore(deps): update python dependencies (non-major) Update Python dependencies (non-major) Jun 18, 2026
@renovate
renovate Bot force-pushed the renovate/python-non-major branch 2 times, most recently from c908250 to 6ec7f18 Compare June 21, 2026 13:44
@renovate renovate Bot changed the title Update Python dependencies (non-major) chore(deps): update python dependencies (non-major) Jun 22, 2026
@renovate
renovate Bot force-pushed the renovate/python-non-major branch 3 times, most recently from 0fdae43 to f06c4d9 Compare June 23, 2026 04:48
@renovate renovate Bot changed the title chore(deps): update python dependencies (non-major) Update Python dependencies (non-major) Jun 23, 2026
@mekarpeles mekarpeles mentioned this pull request Jun 23, 2026
Open
4 tasks done
@renovate
renovate Bot force-pushed the renovate/python-non-major branch 3 times, most recently from 1d3085b to e1b559c Compare June 25, 2026 16:59
@renovate renovate Bot changed the title Update Python dependencies (non-major) chore(deps): update python dependencies (non-major) Jun 25, 2026
@renovate
renovate Bot force-pushed the renovate/python-non-major branch 4 times, most recently from 7c21cdd to 76a115d Compare June 27, 2026 01:09
mekarpeles added a commit that referenced this pull request Jun 27, 2026
@mekarpeles
chore(deps): bump beautifulsoup4 from 4.14.3 to 4.15.0
d2c1c0c 
Closes #12929
@renovate
renovate Bot force-pushed the renovate/python-non-major branch 5 times, most recently from 2922224 to 4bac1ee Compare June 30, 2026 19:12
@renovate
renovate Bot force-pushed the renovate/python-non-major branch 5 times, most recently from b366d8b to 936fc1d Compare July 16, 2026 15:03
@renovate renovate Bot changed the title Update Python dependencies (non-major) chore(deps): update python dependencies (non-major) Jul 16, 2026
@renovate
renovate Bot force-pushed the renovate/python-non-major branch 2 times, most recently from fd81907 to 2fa210c Compare July 16, 2026 20:34
@renovate renovate Bot changed the title chore(deps): update python dependencies (non-major) Update Python dependencies (non-major) Jul 16, 2026
@renovate
renovate Bot force-pushed the renovate/python-non-major branch 5 times, most recently from 9a22460 to b4f98b4 Compare July 20, 2026 22:33
@renovate renovate Bot changed the title Update Python dependencies (non-major) chore(deps): update python dependencies (non-major) Jul 21, 2026
@renovate
renovate Bot force-pushed the renovate/python-non-major branch 6 times, most recently from f1de02b to 23cde32 Compare July 27, 2026 19:42
@renovate renovate Bot changed the title chore(deps): update python dependencies (non-major) Update Python dependencies (non-major) Jul 29, 2026
renovate Bot and others added 2 commits October 13, 2026 17:55
@renovate
Update Python dependencies (non-major)
819b07c
@RayBB @claude
Limit Python updates to FastAPI, Sentry and uvicorn
c11476d 
Revert the other non-major Python bumps from this Renovate PR so it only
updates fastapi, sentry-sdk and uvicorn (incl. docker/mockservices).

FastAPI 0.137 turned `app.routes` into a tree of `_IncludedRouter`
objects, which crashes prometheus-fastapi-instrumentator 7.1.0 on every
router-included endpoint (`'_IncludedRouter' object has no attribute
'path'` -> HTTP 500). Bump it to 8.1.0, which handles the new routing;
8.x requires Starlette >=1.0, so Starlette goes 0.52.1 -> 1.8.0.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
@RayBB

RayBB commented Oct 13, 2026

Copy link
Copy Markdown
Collaborator

I narrowed this PR down to FastAPI, Sentry and uvicorn (c11476d) so it's small enough to test properly and roll back easily. The other bumps (bs4, luqum, pymarc, internetarchive, pydantic-settings, mypy/ruff/pytest, etc.) are reverted and can come in separate PRs.

Package Change
fastapi 0.136.3 → 0.142.2 (mockservices: 0.115.0 → 0.142.2)
sentry-sdk[fastapi] 2.61.1 → 2.71.0
uvicorn[standard] 0.49.0 → 0.54.0 (mockservices: 0.30.6 → 0.54.0)
prometheus-fastapi-instrumentator 7.1.0 → 8.1.0 (required, see below)
starlette (transitive, unpinned) 0.52.1 → 1.8.0 (pulled in by instrumentator 8)

Why the instrumentator bump is required

FastAPI 0.137 changed app.routes from a flat list into a tree containing _IncludedRouter objects. With instrumentator 7.1.0, every endpoint we register via include_router returns HTTP 500 ('_IncludedRouter' object has no attribute 'path'). That covers basically all FastAPI endpoints in both the main app and covers. I reproduced it before the fix. Instrumentator 8.0.1 fixed it (trallnag/prometheus-fastapi-instrumentator#371), but 8.x requires Starlette ≥ 1.0. Sentry ≥ 2.63 also contains FastAPI ≥ 0.137 routing fixes, so these upgrades need to ship together.

Testing

  • Python test suite: 4173 passed on the host (uv) and 4204 passed inside the rebuilt dev image. pip check is clean.
  • Live old-vs-new comparison: I rebuilt the image and probed both stacks with 109 requests: FastAPI JSON endpoints, legacy web.py pages through the fallback proxy, static files (including Range/HEAD/405), CORS preflights, gzip, the X-Forwarded-* headers, a login → authed GET/POST → logout flow, and the covers app.
    • Every status code was identical between old and new.
    • Prometheus handler labels on /metrics were identical for both apps.
    • The OpenAPI schema is identical, apart from an auto-generated operationId on the dev-only fallback route.
  • Sentry: used a capturing transport against old and new, for both FastAPI and the web.py WebPySentryProcessor/bind_to_webpy_db path. Transaction names (route templates), error events, sentry-trace continuation, and SQL spans were identical.
  • Production serving path: ran gunicorn + uvicorn.workers.UvicornWorker with --max-requests for both web and covers. Workers boot and recycle correctly. The occasional dropped connection during a worker recycle happens equally on the old image (1/450 old vs 2/450 new), so it isn't a regression.
  • Mockservices: all 42 tests pass against the rebuilt container, e2e included.

Behavior changes to know about

  1. Vary: Origin is now on every response from both FastAPI apps (Starlette 1.7 CORSMiddleware change; preflight responses also vary on the Access-Control-Request-* headers). It's harmless for browsers, and our nginx configs don't use proxy_cache. Any CDN in front of covers/FastAPI may now cache separate copies per Origin, though plain <img> loads don't send an Origin header.
  2. StaticFiles 405 responses now include Allow: GET, HEAD.
  3. Sentry 2.63+ only sends the ASGI query string and client IP when send_default_pii is on. We don't set it, so FastAPI events may lose query strings and IPs.
  4. enable_logs is deprecated in Sentry 2.68+ but still honored (2.68.1 restored auto-collection), so no config change is needed yet.
  5. FastAPI 0.142 added native OpenTelemetry auto-setup driven by OTEL_* env vars. We don't set any, so it stays dormant (0.143 makes it opt-in anyway).

Heads-up: Renovate will probably stop rebasing this branch now that it has a non-Renovate commit.

@renovate

renovate Bot commented Oct 13, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

RayBB and others added 2 commits October 13, 2026 11:40
@RayBB @claude
Touch Dockerfiles to force image rebuild on testing deploy
1ad6d57 
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
@RayBB @claude
Bump fastapi to 0.143.0 and sentry-sdk to 2.72.0
ec16229 
Also drop the blank lines that were added to the Dockerfiles to force a
rebuild on testing.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
@RayBB

RayBB commented Oct 13, 2026

Copy link
Copy Markdown
Collaborator

Update (ec16229): bumped to the latest releases, fastapi 0.143.0 and sentry-sdk 2.72.0. uvicorn 0.54.0, instrumentator 8.1.0 and Starlette 1.8.0 were already the latest.

  • fastapi 0.143.0's only breaking change makes OpenTelemetry auto-setup opt-in. We don't use it.
  • sentry-sdk 2.72.0 is mostly changes to its AI integrations.

I rebuilt the image and reran the full comparison:

  • 109-request old-vs-new probe: all status codes and Prometheus handler labels identical.
  • OpenAPI schema identical.
  • Sentry capture checks (FastAPI and web.py) identical.
  • Test suite: 4173 passed on host, 4204 in the container.
  • Mockservices: 42/42 passed.
  • gunicorn + UvicornWorker recycling works for web and covers.

I also removed the temporary Dockerfile whitespace.

@RayBB RayBB mentioned this pull request Oct 14, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@RayBB RayBB

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@RayBB