chore(deps): consolidated dependency refresh (supersedes #31, #35, #36, #37) #126

Merged

claude-bot merged 1 commit from chore/deps-consolidated-refresh into main

2026-07-24 20:51:08 +00:00

claude-bot commented

2026-07-24 20:26:09 +00:00

Contributor

Consolidates the four entangled Renovate dependency PRs into one coherent, CI-verified update. Individually, three of them cannot pass — they're chained together by the resolver:

#31 (minor/patch batch) bumps authlib → 1.7.2, which now pulls in joserfc ≥1.6.0 → cryptography ≥45.0.1, but left cryptography pinned at 44 → ResolutionImpossible.
Satisfying that needs cryptography 49 (#35), which requires cffi ≥2, which conflicts with timezonefinder 6.x (cffi <2) → so timezonefinder 8 (#37) is required too.
#36 (Pillow 12) is folded in as well so the whole stack moves together.

What changed

Only dependency pins — no application or test code changes were needed.

requirements.txt: fastapi 0.115.5→0.139.2, uvicorn 0.32.1→0.51.0, jinja2 3.1.4→3.1.6, python-multipart 0.0.12→0.0.32, starlette 0.41.3→0.52.1, sqlalchemy 2.0.36→2.0.51, asyncpg 0.30.0→0.31.0, alembic 1.14.0→1.18.5, authlib 1.3.2→1.7.2, httpx 0.28.0→0.28.1, cryptography 44.0.3→49.0.0, apscheduler 3.10.4→3.11.3, discord.py 2.4.0→2.7.1, matrix-nio 0.25.2→0.26.0, Pillow 11.0.0→12.3.0, twilio 9.3.7→9.10.9, pydantic-settings 2.6.1→2.14.2, python-dotenv 1.0.1→1.2.2, timezonefinder 6.5.3→8.2.5.

requirements-test.txt: ruff 0.15.22→0.16.0.

Verification

Reproduced CI faithfully in a clean python:3.12-slim container against postgres:16-alpine:

Step	Result
`pip install -r requirements-test.txt`	resolves cleanly, no added transitive pin
`ruff check .`	All checks passed
`python -m compileall app`	ok
`alembic upgrade head`	0001→0030 ok
`pytest -q` (SQLite bulk tier)	779 passed
`pytest -q -m postgres` (Postgres tier)	4 passed

Supersedes

Closes #31, closes #35, closes #36, closes #37.

(Handled separately: #30 Python 3.14 — deferred pending 3.13/ecosystem; #34 starlette v1 — closed, no compatible FastAPI.)

🤖 Generated with Claude Code

Consolidates the four entangled Renovate dependency PRs into one coherent, CI-verified update. Individually, three of them **cannot** pass — they're chained together by the resolver: - **#31** (minor/patch batch) bumps **authlib → 1.7.2**, which now pulls in **joserfc ≥1.6.0 → cryptography ≥45.0.1**, but left cryptography pinned at 44 → `ResolutionImpossible`. - Satisfying that needs **cryptography 49** (#35), which requires **cffi ≥2**, which conflicts with **timezonefinder 6.x (cffi <2)** → so **timezonefinder 8** (#37) is required too. - **#36** (Pillow 12) is folded in as well so the whole stack moves together. ### What changed Only dependency pins — **no application or test code changes were needed.** `requirements.txt`: fastapi 0.115.5→0.139.2, uvicorn 0.32.1→0.51.0, jinja2 3.1.4→3.1.6, python-multipart 0.0.12→0.0.32, starlette 0.41.3→0.52.1, sqlalchemy 2.0.36→2.0.51, asyncpg 0.30.0→0.31.0, alembic 1.14.0→1.18.5, authlib 1.3.2→1.7.2, httpx 0.28.0→0.28.1, **cryptography 44.0.3→49.0.0**, apscheduler 3.10.4→3.11.3, discord.py 2.4.0→2.7.1, matrix-nio 0.25.2→0.26.0, **Pillow 11.0.0→12.3.0**, twilio 9.3.7→9.10.9, pydantic-settings 2.6.1→2.14.2, python-dotenv 1.0.1→1.2.2, **timezonefinder 6.5.3→8.2.5**. `requirements-test.txt`: ruff 0.15.22→0.16.0. ### Verification Reproduced CI faithfully in a clean `python:3.12-slim` container against `postgres:16-alpine`: | Step | Result | |---|---| | `pip install -r requirements-test.txt` | resolves cleanly, no added transitive pin | | `ruff check .` | All checks passed | | `python -m compileall app` | ok | | `alembic upgrade head` | 0001→0030 ok | | `pytest -q` (SQLite bulk tier) | **779 passed** | | `pytest -q -m postgres` (Postgres tier) | **4 passed** | ### Supersedes Closes #31, closes #35, closes #36, closes #37. (Handled separately: **#30** Python 3.14 — deferred pending 3.13/ecosystem; **#34** starlette v1 — closed, no compatible FastAPI.) 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit

2026-07-24 20:26:09 +00:00

chore(deps): consolidated dependency refresh

CI / test (pull_request) Successful in 4m47s

Details

fa4389a70d

Bumps the full runtime + test dependency stack in one coherent change,
superseding the entangled Renovate PRs #31, #35, #36, #37.

These had to land together: authlib 1.7.2 pulls in joserfc (needs
cryptography >=45), and cryptography 49 needs cffi >=2, which requires
timezonefinder 8 (6.x caps cffi <2). Pillow 12 (radar GIF) folded in too.

Verified green on Python 3.12 against Postgres 16: ruff, compileall,
alembic upgrade head, 779 bulk tests, 4 postgres-tier tests. No app
code changes required.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

claude-bot referenced this pull request

2026-07-24 20:34:32 +00:00

chore(deps): update python minor/patch #31

claude-bot referenced this pull request

2026-07-24 20:34:34 +00:00

chore(deps): update dependency cryptography to v49 #35

claude-bot referenced this pull request

2026-07-24 20:34:36 +00:00

chore(deps): update dependency pillow to v12 #36

claude-bot referenced this pull request

2026-07-24 20:34:38 +00:00

chore(deps): update dependency timezonefinder to v8 #37