You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
➖ Vendor Click and streamline Typer's functionality and code base. PR #1774 by @svlandeg.
Typer no longer depends on Click as a third party dependency, it vendors (includes the source code of) Click.
This simplifies the work done by both Click and Typer teams.
It allows Typer to evolve independently, and enables several new planned features.
It will solve several dependency conflict situations for projects that use some packages that depend on Click and some that depend on Typer.
This also means that Click-specific functionality is no longer supported, like extracting the Click app and adding Click-specific plug-ins, or customizing the field types with Click-specific types.
You can read more about it in the docs for Vendored Click.
This is the Click 8.4.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.
[orm] [bug] Fixed issue where using _orm.joinedload() with
PropComparator.of_type() targeting a joined-table subclass combined
with PropComparator.and_() referencing a column on that subclass
would generate invalid SQL, where the subclass column was not adapted to
the subquery alias. Pull request courtesy Joaquin Hui Gomez.
[orm] [bug] Fixed issue where the presence of a SessionEvents.do_orm_execute()
event hook would cause internal execution options such as yield_per and
loader-specific state from the first orm_pre_session_exec pass to leak
into the second pass, leading to errors when using relationship loaders
such as selectinload() and immediateload(). The execution
options passed to the second compilation pass are now based on the original
options plus only the explicit updates made via
ORMExecuteState.update_execution_options() within the event hook.
[orm] [bug] Fixed issue where using _orm.with_polymorphic() on a leaf class (a
subclass with no further descendants) or a non-inherited class would fail
with an AttributeError when used in an ORM statement, due to
_orm.configure_mappers() not being triggered implicitly. The fix
ensures that AliasedInsp participates in the _post_inspect
hook, triggering mapper configuration during ORM statement compilation.
[sql] [bug] Fixed issue where floor division (//) between a Float or
Numeric numerator and an Integer denominator would omit
the FLOOR() SQL wrapper on dialects where
Dialect.div_is_floordiv is True (the default, including
PostgreSQL and SQLite). FLOOR() is now applied if either the
denominator or the numerator is a non-integer, so that expressions such as
float_col // int_col render as FLOOR(float_col / int_col) instead
of the incorrect float_col / int_col. Pull request courtesy r266-tech.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
PR risk assessment (automation)
Risk level: Medium Code review: Required Automation action: Requested reviewer (madara88645); not approved
Evidence (diff-only)
Area
Finding
Files touched
Only pyproject.toml and requirements.txt (version pins; no application source changes).
Blast radius
Eight runtime/dev dependencies on the core stack: FastAPI, Uvicorn, Typer, Click, OpenAI client, cachetools, SQLAlchemy, and Ruff (dev).
Notable upstream behavior
Typer 0.26.x vendors Click (breaking change in 0.26.0; this repo uses Typer heavily in cli/). FastAPI 0.136.3 changes default underscore-header handling. SQLAlchemy 2.0.50 includes ORM/SQL bug fixes that can change query results. Uvicorn 0.48.0 adjusts SSL cipher defaults and proxy header handling.
CI
Smoke, extension build, Snyk, CodeQL, and Vercel checks reported success at assessment time.
Why Medium (not Low / Very Low)
The change set is small on disk, but it upgrades multiple production-critical libraries in one grouped bump, including at least one upstream breaking change (Typer) and several behavior-affecting fixes (FastAPI headers, SQLAlchemy ORM). Regression risk is real even with green CI; human review of release notes and CLI/API smoke paths is appropriate.
Why not High
No auth model, schema migration, infrastructure, or application logic edits—only dependency manifests.
dependabotBot
changed the title
chore(deps): bump the python-deps group with 8 updates
chore(deps): bump the python-deps group across 1 directory with 8 updates
May 31, 2026
The reason will be displayed to describe this comment to others. Learn more.
PR risk assessment (automation)
Risk level: Medium Code review: Required Automation action: No approval; existing reviewer retained
Re-evaluation (synchronize)
This run reassessed commit 3059df8 against base 58e959f after the PR was updated. Compared to the prior automation head (14096bb), the dependency delta is minor: Typer 0.26.2 → 0.26.4 (patch within the already-breaking 0.26 line), plus manifest parity tweaks (httpx pin restored, jinja2 casing). Risk level unchanged (Medium). No prior approval to revoke.
Evidence (diff-only)
Area
Finding
Files touched
Only pyproject.toml and requirements.txt — version pins; no application source changes.
Blast radius
Eight runtime/dev dependencies on the core stack: FastAPI, Uvicorn, Typer, Click, OpenAI client, cachetools, SQLAlchemy, and Ruff (dev).
Notable upstream behavior
Typer 0.26.x vendors Click (breaking change in 0.26.0; repo uses Typer in cli/). FastAPI 0.136.3 tightens underscore-header handling. SQLAlchemy 2.0.50 ships ORM/SQL bug fixes that can change query results. Uvicorn 0.48.0 changes SSL cipher defaults and proxy forwarding-header handling.
CI
Snyk, GitGuardian, and Vercel checks passing at assessment time; Smoke/Analyze/Extension jobs still pending.
Why Medium (not Low / Very Low)
The on-disk change is small, but it upgrades multiple production-critical libraries in one grouped bump, including an upstream breaking Typer release line and several behavior-affecting fixes. Regression risk warrants human review of release notes and CLI/API smoke paths even when CI is green.
Why not High
No auth model, schema migration, infrastructure, or application logic edits — only dependency manifests.
Reviewers
Already requested:madara88645 (1 reviewer). Not adding more (under the max-2 cap and review already requested).
No CODEOWNERS file in repo.
Slack
Slack notification was not sent: no SLACK_BOT_TOKEN / webhook configured in this agent environment.
Assessment derived from diff 58e959f…3059df8 only; PR description claims ignored per security policy.
Sent by Cursor Automation: Assign PR reviewers
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency filepythonPull requests that update python code
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Updates the requirements on fastapi, uvicorn, typer, click, openai, cachetools, sqlalchemy and ruff to permit the latest version.
Updates
fastapifrom 0.136.1 to 0.136.3Release notes
Sourced from fastapi's releases.
... (truncated)
Commits
8206485🔖 Release version 0.136.3c910e01📝 Update release notes063b5bf♻️ Do not accept underscore headers when usingconvert_underscores=True(th...22b02e2🔖 Release version 0.136.23b252a2📝 Update release notesc7fb785♻️ Validate Server Sent Event fields to avoid applications from sending broke...cb83b83📝 Update release notes00f805c✅ Update tests, don't double dispose the engine (#15587)3675137📝 Update release notes7b57e42📝 Document--entrypointCLI option (#15464)Updates
uvicornfrom 0.47.0 to 0.48.0Release notes
Sourced from uvicorn's releases.
Changelog
Sourced from uvicorn's changelog.
Commits
73e84e5Version 0.48.0 (#2951)45ea116Ignore duplicate forwarding headers inProxyHeadersMiddleware(#2944)dd4394cchore(deps): bump idna from 3.11 to 3.15 (#2941)abe0781Defaultssl_cipherstoNoneand use OpenSSL defaults (#2940)Updates
typerfrom 0.25.1 to 0.26.4Release notes
Sourced from typer's releases.
... (truncated)
Changelog
Sourced from typer's changelog.
... (truncated)
Commits
b1310f8🔖 Release version 0.26.4 (#1809)e4bb679📝 Update release notes361221d📝 Update AI Library Skill to avoid verbose code for CLI Options (#1808)e9efaab📝 Update release notes90f087a👷 Add CI to create draft release after merging areleasePR (#1807)2f54c22📝 Update release notes1a71c8d👷 Update labeler to accept labelrelease(#1806)b8d870f📝 Update release notese3126b9👷 Update GitHub Action permissions for prepare-release (#1804)66af4fd📝 Update release notesUpdates
clickfrom 8.4.0 to 8.4.1Release notes
Sourced from click's releases.
Changelog
Sourced from click's changelog.
Commits
6eeb50erelease version 8.4.167921d5change log and doc fixes (#3495)9c41f46Fix changelog and version admonitions6cb3477fix skip condition5ee8e31fix I/O operation on closed file error with CliRunner and echo_via_pager (#3482)becbde5pager doesn't close std streamsa5f5aa6Handle empty bytes in echo (#3493)4d3db84handle empty bytes in echod42f15bFixget_parameter_source()during type conversion and eager callbacks (#3484)0baa8dbDocument ctx.params bypass with test and docUpdates
openaito 2.38.0Release notes
Sourced from openai's releases.
Changelog
Sourced from openai's changelog.
... (truncated)
Commits
e757667release: 2.38.0b85b647feat(api): api updated881c67Revert "chore: check release PR custom code sync"d4a3228chore: check release PR custom code sync4888838chore: remove release automation trigger74978f0chore: trigger release automationbab18afchore(api): docs updatesa6f899afeat(api): manual updates2897485feat(api): update OpenAPI spec or Stainless configa2f1d6ccodegen metadataUpdates
cachetoolsto 7.1.4Changelog
Sourced from cachetools's changelog.
... (truncated)
Commits
48284d7Release v7.1.4.55ea96bUpdate build environment.c5439feAdd threading tests for lock-only decorators.91828fcRun threading tests unconditionally with timeout.Updates
sqlalchemyto 2.0.50Release notes
Sourced from sqlalchemy's releases.
... (truncated)
Commits
Updates
rufffrom 0.15.14 to 0.15.15Release notes
Sourced from ruff's releases.
... (truncated)
Changelog
Sourced from ruff's changelog.
Commits
db5aa0aBump 0.15.15 (#25431)366fe21[ty] Improve diagnostics for syntax errors in forward annotations (#25158)e2e1e64[ty] Remove excess capacity from more Salsa cached collections (#25411)1bd77e1[ty] Use diagnostic message as tie breaker when sorting (#25424)7e1bc1eAdd agent skills for working on ty (#25422)574e107Expand semantic syntax errors for invalid walruses (#25415)4a7ca06[ty] Display docs for matching parameter when hovering over the name of an ar...5432709Refine a few agents instructions (#25423)3cb09eb[ty] Supporttyping.TypeForm(#25334)c8cd59f[ty] Infer class attributes assigned by metaclass initialization (#25342)