Repository navigation
chore(deps): weekly dependency update - #911
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e7176296d4
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "Codex (@codex) review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "Codex (@codex) address that feedback".
|
|
||
| [tool.braintrust.matrix.openai] | ||
| latest = "openai==3.24.0" | ||
| latest = "openai==3.29.0" |
There was a problem hiding this comment.
The latest provider versions now advance across several minor releases, but this commit changes only pyproject.toml and uv.lock; the checked-in recordings still identify the previous clients—for example, OpenAI cassettes contain 3.24.0, Anthropic 1.11.0, Google GenAI 2.28.0, and Mistral 3.0.0. Because CI uses replay-only VCR, the new clients receive old response payloads, so passing integration sessions cannot detect response-shape or wire-format changes in the versions introduced here. Re-record the affected cassettes/latest directories, including integrations that consume these providers as auxiliary dependencies, and validate playback before merging.
AGENTS.md reference: AGENTS.md:L201-L205
Useful? React with 👍 / 👎.
pydantic-ai 2.55.0 dropped Python 3.10 (requires_python >=3.11), so the latest pin can't install on 3.10. Gate the integration, logfire and wrap_openai latest sessions, and skip installing it in pylint on 3.10. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Re-record latest cassettes for openai (incl. btx), anthropic, litellm, dspy, google_genai, pydantic_ai and strands. Update dspy's expected token counts to match the new recording. Kept existing cassettes where re-recording isn't possible: mistral (rate limited), huggingface_hub (providers no longer serve the pinned models), anthropic server tool spans (live web search drift) and litellm text completion (model retired). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ef05c5aac8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "Codex (@codex) review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".
| # provider use, while still keeping the same chat_completion / | ||
| # text_generation / feature_extraction / sentence_similarity method names. | ||
| latest = "huggingface-hub==2.1.1" | ||
| latest = "huggingface-hub==2.2.0" |
There was a problem hiding this comment.
The fresh evidence after the prior cassette comment is that this revision adds many cassette updates but none under integrations/huggingface_hub/cassettes/latest; those fixtures still advertise hf_hub/1.15.0 even though this pin advances from 2.1.1 to 2.2.0. Consequently, test_huggingface_hub(latest) in replay-only CI continues exercising old HTTP payloads rather than the newly selected client/server behavior, so this provider bump remains unvalidated until that latest directory is re-recorded and replayed.
AGENTS.md reference: AGENTS.md:L201-L205
Useful? React with 👍 / 👎.
|
|
||
| [tool.braintrust.matrix.anthropic] | ||
| latest = "anthropic==1.11.0" | ||
| latest = "anthropic==1.13.0" |
There was a problem hiding this comment.
Although most Anthropic recordings were refreshed, cassettes/latest/test_anthropic_messages_sync_server_tool_spans.yaml is unchanged and still records Anthropic/Python 1.11.0 and x-stainless-package-version: 1.11.0. When CI runs this server-tool test against the new 1.13.0 pin, VCR therefore returns the old payload and cannot detect request or response-shape changes for this path; re-record this remaining fixture with 1.13.0.
AGENTS.md reference: AGENTS.md:L201-L205
Useful? React with 👍 / 👎.
| # 1.92.0 only publishes Linux wheels through CPython 3.13, but the test | ||
| # matrix also covers Windows and CPython 3.14. | ||
| latest = "litellm==1.104.0" | ||
| latest = "litellm==1.105.0" |
There was a problem hiding this comment.
The refreshed set omits both test_litellm_text_completion_metrics[async].yaml and [sync].yaml, whose request headers still identify litellm/1.104.0. Under the 1.105.0 latest session, replay-only CI will run these text-completion paths against the prior release's recordings, leaving this API surface unvalidated; re-record both remaining fixtures with the new pin.
AGENTS.md reference: AGENTS.md:L201-L205
Useful? React with 👍 / 👎.
pylint skips the pydantic-ai matrix latest pin on 3.10 (it requires 3.11+), which left pydantic_ai imports unresolved. Add pydantic-ai to the lint dependency group so 3.10 gets a lock-resolved compatible version; 3.11+ still installs the matrix latest pin over it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 26187e590c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "Codex (@codex) review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".
|
|
||
| [tool.braintrust.matrix.anthropic] | ||
| latest = "anthropic==1.11.0" | ||
| latest = "anthropic==1.13.0" |
There was a problem hiding this comment.
Beyond the previously identified server-tool fixture, test_anthropic_beta_sessions_events_send_and_stream.yaml is also unchanged and all seven requests still identify Anthropic/Python 1.4.0. Since test_anthropic(latest) runs this VCR-marked managed-agent events path whenever the 1.13.0 client exposes it, replay-only CI will continue validating old request/response shapes rather than the newly pinned client; re-record this cassette with the rest of the latest set.
AGENTS.md reference: AGENTS.md:L196-L204
Useful? React with 👍 / 👎.
## AI Summary Adds Python 3.15 to the `static_checks`, `smoke`, and sharded `nox` matrices in `checks.yaml`, and fixes two SDK behavior changes that only show up on 3.15. ### SDK fixes (3.15 only) - **PEP 810 lazy imports broke auto-instrumentation.** `_resolve_attr_path` uses `inspect.getattr_static`, which on 3.15 returns the unreified `types.LazyImportType` proxy for names bound through `__lazy_modules__`. google-cloud-discoveryengine's GAPIC `__init__` already ships this way, so `auto_instrument()` silently returned `False` for it. We now reify the proxy with a plain `getattr` on the module; unresolvable proxies resolve to `None`. On 3.10–3.14 `types.LazyImportType` doesn't exist, so the new branch never runs. - **`importlib.metadata` raises `MetadataNotFound` (a `FileNotFoundError`)** for a lone `.dist-info` without METADATA (e.g. an interrupted install). Before 3.15, `version()` returned `None`. `span_origin._sdk_version()` (runs on every span), `detect_module_version()`, and `BaseIntegration.detect_version()` only caught `PackageNotFoundError`. They now also catch `FileNotFoundError`. Both fixes went red → green, with tests skipped below 3.15. The lazy-import tests use a real PEP 810 package written to `tmp_path`, not mocks. ### Sessions skipped on 3.15 (upstream packaging gaps) These dependencies have no cp315 wheels, and their sdists fail to build (mostly PyO3 < 0.27, which refuses 3.15), or they declare `Requires-Python < 3.15`. Caps live in `nox_session_constraints.py` with the blocking package noted, so they can be dropped as wheels land: | Session | Blocker | |---|---| | `test_litellm(latest)`, `test_dspy(latest)`, `test_harbor` | fastuuid (via litellm) | | `test_langchain`, `test_deepagents` | ormsgpack (via langgraph-checkpoint) | | `test_instructor` | jiter<0.11 | | `test_openrouter(latest)` | pydantic-core 2.41 | | `test_transformers(latest)` | sentencepiece | | `test_openai_ddtrace` | ddtrace requires Python < 3.15 | `test_langchain`, `test_openrouter`, and `test_openai_ddtrace` now call `_skip_if_incompatible`, so local `nox -s` also skips them on 3.15. Before this, only the CI sharder filtered them out. ### pylint on 3.15 - The lint group gates dspy, instructor, litellm, and livekit-agents behind `python_version<'3.15'` (livekit-blingfire has no cp315 dist at all). It adds `jiter>=0.11; python_version>='3.15'` so 3.15 isn't stuck on instructor's `jiter<0.11`. - The pylint session's pipecat special case is generalized into a max-Python table. Integrations whose package couldn't be installed are excluded from the lint file list. - Bumps pylint 4.0.5 → 4.1.2 (astroid 4.0.4 → 4.3.4). astroid 4.0.4 reports `E1120` for every `dataclasses.KW_ONLY` constructor call on 3.15. The bump surfaced one false positive (`E1121` on an explicit `classmethod.__func__` call in `pydantic_ai/patchers.py`), now silenced with an inline disable. ### `uv.lock` The jiter marker makes uv fork the resolution by Python version, hence the large diff. No package versions were added or removed. Before the pylint bump, I compared the effective pins for all 30 dependency groups × Python 3.10–3.14 × Linux/Windows against `main`: 300/300 identical. The pylint bump then changes only pylint and astroid. `test-litellm` also pins `orjson==3.12.0` on 3.15 only. 3.11.8 has no cp315 wheels, and its sdist fails on the runners' stable Rust (`#![feature]` on the stable channel). ## Validation (local, Linux) - 3.15.0: smoke install/import ✅, `pylint` ✅, `test_types` ✅, `test_core` ✅ (1022 passed). - 3.15.0: all nox sessions the sharder assigns ✅ (70 after merging the #911 dependency update). Before this change, 15 of 83 failed: the 14 install-blocked sessions, plus `test_google_discoveryengine` from the lazy-import bug. With #911's newer cutoff, `test_dspy(2.6.0)` installs and passes on 3.15, so 13 remain skipped. I re-probed all 13 with the caps lifted after the merge; they still fail to install. - 3.10.22 and 3.14.6: `pylint` ✅ and `test_core` ✅ (1012 and 1017 passed). - Windows + 3.15 was not tested locally; this PR's CI is the first run. Note: some packages (pydantic-core 2.46.5, pyyaml, aiohttp, polyleven, …) build from sdist on 3.15, so the first 3.15 jobs will be slower until wheels land. ## Follow-up (not in this PR) `__lazy_modules__` is a no-op before 3.15. Deferring `jsonschema`, `tqdm`, `asyncio`, `slugify`, and `gzip` measured roughly 25% off `import braintrust` on 3.15 (about 298 ms → 224 ms). That's worth a separate PR with benchmarks. 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- sfk:bot-coauthor --> Co-authored by @starfolkai[bot] --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
1 participant
Automated weekly dependency update via
python scripts/update-matrix-latest.py, advancing theuvexclude-newercutoff, anduv lock --upgrade.