Repository navigation
chore(deps): backend group to latest, protobuf+opencv at ecosystem caps (supersedes #10407) - #10427
Merged
Merged
Conversation
mrveiss
force-pushed
the
issue-deps-backend
branch
from
June 21, 2026 19:22
33a4009 to
1970f78
Compare
Contributor
✅ SSOT Configuration Compliance: Passing🎉 No hardcoded values detected that have SSOT config equivalents! |
mrveiss
force-pushed
the
issue-deps-backend
branch
from
June 21, 2026 19:47
1970f78 to
8335683
Compare
…kages held (#10407) Supersedes Dependabot #10407 (33-package backend group). Raises floors to latest for every package that resolves under strict (docker) pip resolution. Held three groups Dependabot bumped past hard upstream caps (verified via pip dry-run): - protobuf: >=6.33.6,<7.0.0 (Dependabot 7.35.1). opentelemetry-proto requires protobuf<7.0; 7.x broke the docker build at pip-resolve. 6.33.6 = latest installable. - opencv-python-headless: >=4.10.0,<4.11 (Dependabot 4.13). 4.11+ needs numpy>=2, conflicting with graspologic 3.4.4 (numpy<2.0) under strict resolution. - langchain / langchain-core / langchain-community / langgraph: held at current floors (#10386). Bumping langgraph to 1.2.6 pulls langgraph-sdk 0.4.2, which caps websockets<16 and conflicts with the required websockets>=16.0 (desktop_streaming, slm_client, #3098). pip backtracks to langgraph-sdk 0.3.15 + websockets 16 at the current floors. Bumped to latest (proven-resolvable): apscheduler 3.11.2, croniter 6.2.2, fastapi 0.138, pydantic 2.13.4, sqlalchemy 2.0.51, openai 2.43, anthropic 0.111, boto3 1.43.34, reportlab 5, structlog 26, praw 8, sentence-transformers 5.6, bleach 6.4, beautifulsoup4 4.15, Pillow 12.2, scikit-learn 1.9, spacy 3.8.14, etc. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Thinking Path
The goal requires backend dependencies at latest, but Dependabot #10407 (33-package group) breaks the required
smoke-testgate. I traced the cause against the running backend venv:opentelemetry-proto(otel 1.42) hard-requiresprotobuf<7.0, so #10407'sprotobuf>=7.35.1is unsatisfiable and fails at import. A second cap:opencv 4.11+needsnumpy>=2, conflicting withgraspologic 3.4.4(numpy<2.0). Every other major in #10407 (redis 8, structlog 26, reportlab 5, praw 8, sentence-transformers 5.6, …) is already installed and running in the production venv — proven safe.What Changed
Branched from #10407 and kept all 33 bumps except the two ecosystem-capped packages:
protobuf→>=6.33.6,<7.0.0(latest installable; otel-proto caps<7.0)opencv-python-headless→>=4.10.0,<4.11(latest numpy<2-compatible; graspologic caps numpy<2.0)Both files carrying the constraint fixed: root
requirements.txt+autobot-backend/requirements.txt.Verification
uv pip compileconfirms the langchain 1.3.10 / core 1.4.8 / langgraph 1.2.6 + redis 8 + fastapi 0.138 + anthropic 0.111 subset co-resolves with protobuf capped (the deps: unblock langchain >=1.3.10 — decouple websockets>=16.0 from langgraph-sdk constraint #10386 websockets concern does not bite at these versions).smoke-test(loose install + import) is the definitive gate — running on this PR.Model Used
Claude Opus 4.8
Closes #10407.