deps(python): Bump the python-minor group across 1 directory with 7 updates#9674
Merged
Conversation
…pdates Bumps the python-minor group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [fastapi](https://github.com/fastapi/fastapi) | `0.139.1` | `0.139.2` | | [pandas](https://github.com/pandas-dev/pandas) | `3.0.3` | `3.0.5` | | [matplotlib](https://github.com/matplotlib/matplotlib) | `3.11.0` | `3.11.1` | | [anthropic](https://github.com/anthropics/anthropic-sdk-python) | `0.116.0` | `0.119.0` | | [cachetools](https://github.com/tkem/cachetools) | `7.1.4` | `7.1.5` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.21` | `0.16.0` | | [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.0` | `4.6.1` | Updates `fastapi` from 0.139.1 to 0.139.2 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.139.1...0.139.2) Updates `pandas` from 3.0.3 to 3.0.5 - [Release notes](https://github.com/pandas-dev/pandas/releases) - [Commits](pandas-dev/pandas@v3.0.3...v3.0.5) Updates `matplotlib` from 3.11.0 to 3.11.1 - [Release notes](https://github.com/matplotlib/matplotlib/releases) - [Commits](matplotlib/matplotlib@v3.11.0...v3.11.1) Updates `anthropic` from 0.116.0 to 0.119.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md) - [Commits](anthropics/anthropic-sdk-python@v0.116.0...v0.119.0) Updates `cachetools` from 7.1.4 to 7.1.5 - [Changelog](https://github.com/tkem/cachetools/blob/master/CHANGELOG.rst) - [Commits](tkem/cachetools@v7.1.4...v7.1.5) Updates `ruff` from 0.15.21 to 0.16.0 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.21...0.16.0) Updates `pre-commit` from 4.6.0 to 4.6.1 - [Release notes](https://github.com/pre-commit/pre-commit/releases) - [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md) - [Commits](pre-commit/pre-commit@v4.6.0...v4.6.1) --- updated-dependencies: - dependency-name: fastapi dependency-version: 0.139.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: pandas dependency-version: 3.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: matplotlib dependency-version: 3.11.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: anthropic dependency-version: 0.119.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: cachetools dependency-version: 7.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: ruff dependency-version: 0.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: pre-commit dependency-version: 4.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
MarkusNeusinger
enabled auto-merge (squash)
July 23, 2026 22:52
MarkusNeusinger
added a commit
that referenced
this pull request
Jul 24, 2026
Approving the gated run once is enough — verified that the required contexts (Run Linting / Run Tests / Run Frontend Tests) do report as SUCCESS on a github-actions[bot]-authored head once the run is approved (#9674, commit 5954507). The head only kept getting re-gated because this workflow kept pushing to it; with that stopped, one approval sticks. `@dependabot recreate` is an alternative, not a requirement. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
MarkusNeusinger
added a commit
that referenced
this pull request
Jul 24, 2026
…illed (#9772) ## What happened On **2026-07-24, ~16:05–16:26 UTC** GitHub's API browned out — HTTP 502 on the workflow-dispatch endpoint, HTTP 504 on GraphQL, HTTP 429 on codeload. Four `radar-basic` PRs fell out of the pipeline and stayed out, because the calls that hand work to the next workflow had no retry: | PR | Library | State it was left in | Call that died | |---|---|---|---| | #9742 | seaborn | `ai-approved` q90 | `impl-merge` → `gh pr view` → **504** | | #9744 | pygal | `ai-rejected` q87 | repair dispatch → **504**; `ai-attempt-1` also lost | | #9749 | makie | `ai-rejected` q88 | repair dispatch → **502** | | #9751 | highcharts | `ai-rejected` q88 | repair dispatch → **502** | `impl-review`'s verdict step is the pipeline's **only hand-off point** — every downstream workflow starts from a call made there. So an unretried blip doesn't merely fail a step; it leaves a PR carrying a verdict label with nothing listening. All four have since been recovered manually and merged; this PR stops it recurring. ## Changes **`impl-review.yml` — the verdict step** - every API call retries 3× with linear backoff (same shape as the existing `Extract PR info` retry, added 2026-05-06 for this same class of failure) - the repair is **dispatched before** the attempt label is added, and the label can no longer gate it. Losing the label costs one over-strict review; losing the dispatch costs the whole PR - if the dispatch still exhausts its retries, the step drops `ai-rejected` on the way out: `ai-rejected` + `ai-attempt-N` matches **no** watchdog case (Case 2 excludes any verdict label, Case 4 excludes PRs that already have an attempt label), while the label-less state is exactly Case 2 — which re-dispatches the repair at the attempt number the remaining label still encodes - the label read tracks success explicitly instead of inferring it from empty output, and a successful read with no verdict label now fails loudly instead of ending the step green **Two bugs found while verifying the above** - **`ai-attempt-4` never existed as a label.** The attempt label encodes the cascading threshold (90 → 80 → 70 → 60 → 50), but the repo only has `ai-attempt-1..3`, so on the 4th repair the add failed every time and `|| true` swallowed it — #7268 and #7039 both reached "Repair Attempt 4/4" carrying only `ai-attempt-1..3`. Every 4th review therefore re-applied the ≥ 90 attempt-0 bar, and the attempts-exhausted branch (close PR, remove stale implementation) could never be reached. Labels are now created on demand. *This also means my first draft of this PR was a hard blocker:* with the label add fatal, the 4th repair would never have been dispatched at all. - **That newly-reachable branch rendered a literal `$SCORE/100`** — quoted heredoc. Now expands, with the markdown backticks escaped so they can't become command substitution. **`impl-merge.yml`** - the 5× merge retry re-reads PR state first. A merge that succeeded server-side but lost its HTTP response used to fail four more times with "already merged" and exit 1 — and because every post-merge step is gated on `should_run == 'true'` (implicit `success()`), that skipped GCS promotion, the `impl:{lib}:done` label, closing the issue and the Postgres sync. A merged PR with none of its bookkeeping: exactly the silent partial completion CLAUDE.md warns about **`auto-update-pr-branches.yml` — Dependabot PRs could never merge while the pipeline ran** - the workflow called `update-branch` on Dependabot PRs. That push is authored by `github-actions[bot]`, so GitHub gates the resulting runs behind manual approval (`action_required`) — and because `main` advances every few minutes during impl merges, each branch was re-updated long before anyone could approve. **PR #9674 accumulated 174 runs in 22 h: 162 `action_required` against only 4 green** (the original `dependabot[bot]` push) - Dependabot branches are now skipped. They merge fine while behind — the `main` ruleset is **not** strict (`strict_required_status_checks_policy: false`); the file's header claimed the opposite and is corrected - `/dependabot`'s playbook told operators to run that same harmful `update-branch` by hand; it now says the opposite and documents the `@dependabot recreate` remedy ## Verification `.github/workflows/` has no verification loop (CLAUDE.md), so this was reviewed by a 4-lens adversarial pass with an independent refutation round (regression / shell-under-`bash -e` / retry idempotency / the Dependabot premise), and every claim was re-checked against the live repo before acting. That pass is what caught the `ai-attempt-4` blocker and the false Dependabot-rebase premise in my first draft. - YAML parses; `bash -n` clean on the extracted steps - `gh_retry` semantics exercised under `bash -e`: succeeds first try / recovers after 2 failures / multi-arg passthrough / hard failure aborts the step - the corrected control flow tested for all three cases — normal, **attempt 4 with a permanently failing label add (dispatch must still fire)**, and dispatch exhaustion (`ai-rejected` dropped, exit 1) - confirmed the CI runner's `gh` adds labels fine; only the locally-installed gh 2.45.0 hits the `projectCards` GraphQL deprecation, so hard-failing on `--add-label` is safe in CI - ruleset strictness, the `ai-attempt-*` label set, and the poisoned Dependabot head commits were all read from the live repo, not assumed ## Follow-up (not in this PR) - #9674, #9648 and #8820 already have a `github-actions[bot]` merge commit as their head. Once this merges their head stops moving, so approving each gated run **once** is enough — verified that the required contexts do report as SUCCESS on a bot-authored head after approval (#9674, commit `59545076`). Doing it before this merges would just get re-gated by the next push to `main`. (`@dependabot recreate` is an equivalent alternative; it also restores a clean `dependabot[bot]` head but re-resolves the versions.) - Whether `auto-update-pr-branches.yml` should exist at all now that the ruleset is non-strict is worth deciding separately — it affects every auto-merge PR, so it isn't folded in here. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the python-minor group with 7 updates in the / directory:
0.139.10.139.23.0.33.0.53.11.03.11.10.116.00.119.07.1.47.1.50.15.210.16.04.6.04.6.1Updates
fastapifrom 0.139.1 to 0.139.2Release notes
Sourced from fastapi's releases.
Commits
866b7a3🔖 Release version 0.139.2 (#16014)7b3effe📝 Update release notes7fe315c🐛 Refactor router route building to make it thread-safe, mainly relevant for ...Updates
pandasfrom 3.0.3 to 3.0.5Release notes
Sourced from pandas's releases.
Commits
e68db09RLS: 3.0.50697623Backport PR #66428: DOC: update whatsnew for 3.0.5 (#66430)5d846d0Backport PR #66090 on branch 3.0.x (BLD: exclude numpy 2.5.0 when building wh...bef7a2bBackport PR #66169 on branch 3.0.x (CI: Fix pyarrow-nightly job (stale nightl...8188eb1RLS: 3.0.4 (#66079)bd35f15[3.0.x] BUG: fix CoW issue in eval() (#66072)6195872[backport 3.0.x] BUG: anchor whole alternation in Series.str.match for PyArro...70313beBackport PR #66051 on branch 3.0.x (BUG: fix regression in DataFrame setitem ...57ed3e2[backport 3.0.x] Bump pypa/cibuildwheel from 3.4.1 to 4.1.0 (#65934) (#66026)f9693fc[backport 3.0.x] BUG(pandas 3.0 regression): drop(index=...) doesn't accept N...Updates
matplotlibfrom 3.11.0 to 3.11.1Release notes
Sourced from matplotlib's releases.
Commits
3c1757aREL: v3.11.1792c6b5DOC: Prepare for 3.11.1aaff9f6Merge branch 'v3.11.0-doc' into v3.11.xd4f4527Merge pull request #32052 from meeseeksmachine/auto-backport-of-pr-32038-on-v...6ad4bcfMerge pull request #32050 from meeseeksmachine/auto-backport-of-pr-31304-on-v...7fb74d3Merge pull request #32051 from meeseeksmachine/auto-backport-of-pr-32037-on-v...c624aecBackport PR #32038: Fix occasional misalignment in reported mouse position (a...8eda2b7Backport PR #32037: Bump the actions group with 3 updatesa0e7ae5Backport PR #31304: Fix restoring 'auto' aspect in 3D axes after switching fr...9001323Merge pull request #32047 from meeseeksmachine/auto-backport-of-pr-32025-on-v...Updates
anthropicfrom 0.116.0 to 0.119.0Release notes
Sourced from anthropic's releases.
... (truncated)
Changelog
Sourced from anthropic's changelog.
... (truncated)
Commits
eb178ecrelease: 0.119.06914718feat(api): add new stop reason 'model_context_window_exceeded'd2bad4ffix(tools): handle binary files in agent toolset read/edit (#283)b527708release: 0.118.0f2412fdfeat(api): add support for Managed Agents model effort, initial session event...d7c0ea2release: 0.117.15ebdcb0chore(api): add support for new refusal categoryb50f8b1chore(deps): bump http-snapshot to 0.1.9 (#275)dc61d3bchore(internal): codegen related update42e2d86chore(deps): pin httpx_aiohttp major version (#271)Updates
cachetoolsfrom 7.1.4 to 7.1.5Changelog
Sourced from cachetools's changelog.
Commits
0d2a6eaRelease v7.1.5.d64cf80Prepare v7.1.5.fcbb0deFix #406: Merge branch 'gaoflow-fix-tlru-overwrite-expired-stale-value' into ...c0fdf6aFix TLRUCache silently keeping stale value on expired overwrite978d34dBump actions/setup-python from 6.2.0 to 6.3.0d5c7eeaReject negative cache item sizes578e976Update build environment.e164b70Bump codecov/codecov-action from 6.0.0 to 7.0.0f5a63a9Bump actions/checkout from 6.0.2 to 7.0.0Updates
rufffrom 0.15.21 to 0.16.0Release notes
Sourced from ruff's releases.
... (truncated)
Changelog
Sourced from ruff's changelog.
... (truncated)
Commits
a2635fdBump 0.16.0 (#27136)3433449[ty] Reuse full call diagnostics for implicit setter calls (#27115)2240070Reflectruff: ignoreand--add-ignorestabilization in documentation (#27...17ef711Stabilize--add-ignore(#27125)ef912bbAdd newly stabilized rules to defaults (#27055)b30f040Stabilize new default rules (#27035)bcd70c5Exclude Markdown files fromformat-devruns (#27052)87e51e2Fixformat --checkspans for syntax errors (#27045)afe2723[flake8-gettext] Stabilize qualified-name and built-in binding resolution (...a9702d8[flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)Updates
pre-commitfrom 4.6.0 to 4.6.1Release notes
Sourced from pre-commit's releases.
Changelog
Sourced from pre-commit's changelog.
Commits
242ce8av4.6.1766e550Merge pull request #3727 from pre-commit/dedupe1558d06Merge pull request #3726 from pre-commit/exists-faster8a1c47aavoid duplicate files in --all-files during conflict2e01c99faster check of rev existing locally as a commit3613bf2Merge pull request #3701 from pre-commit/autoupdate-repos1d811d9Return an error for invalid --repo374d354Merge pull request #3711 from damonbayer/dmb_JULIA_DEPOT_PATH1e7994fset JULIA_DEPOT_PATHb2b9119Merge pull request #3719 from pre-commit/npm-unknown-optionsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions