chore(deps-dev): bump pytest-asyncio from 1.3.0 to 1.4.0#597
chore(deps-dev): bump pytest-asyncio from 1.3.0 to 1.4.0#597dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio) from 1.3.0 to 1.4.0. - [Release notes](https://github.com/pytest-dev/pytest-asyncio/releases) - [Commits](pytest-dev/pytest-asyncio@v1.3.0...v1.4.0) --- updated-dependencies: - dependency-name: pytest-asyncio dependency-version: 1.4.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Completed Working on "Code Review"✅ Review publishing complete. Posted comments from all chunks and submitted final review: COMMENT. Total comments: 1 across 1 files. ✅ Workflow completed successfully. |
Dependency ReviewThe following issues were found:
License Issuesuv.lock
OpenSSF Scorecard
Scanned Files
|
There was a problem hiding this comment.
Review Summary
Findings by severity
- BLOCKER: 0
- CRITICAL: 0
- MAJOR: 1
- MINOR: 0
- SUGGESTION: 0
- PRAISE: 0
Key theme
- Dependency compatibility risk in test tooling:
pytest-asynciowas upgraded, but compatibility betweenpytest-asyncioandpytestconstraints needs to remain explicitly synchronized across dependency declaration surfaces to avoid async test failures in non-lockfile installs.
Recommended next steps
- Ensure
pytest/pytest-asyncioversion constraints are explicitly compatible in all relevant dependency surfaces (including extras/metadata). - Keep CI coverage that installs from declared constraints (not only lockfile resolution) to catch resolver drift early.
| dev = [ | ||
| "pytest~=9.0.3", | ||
| "pytest-asyncio~=1.3.0", | ||
| "pytest-asyncio~=1.4.0", |
There was a problem hiding this comment.
[major]: This bump upgrades pytest-asyncio to ~1.4.0, whose upstream minimum is pytest>=8.4.0, but the project currently pins pytest~=9.0.3. If environments resolve an older pytest from constraints drift outside this lockstep, async test collection/runtime can fail with incompatibility errors.
Keep pytest and pytest-asyncio constraints explicitly compatible in all dependency surfaces (pyproject extras + lock metadata), and add/retain CI coverage that installs from pyproject constraints (not only lockfile) to catch resolver mismatches.
Bumps pytest-asyncio from 1.3.0 to 1.4.0.
Release notes
Sourced from pytest-asyncio's releases.
... (truncated)
Commits
6e14cd2chore: Prepare release of v1.4.0.4b900fbBuild(deps): Bump codecov/codecov-action from 6.0.0 to 6.0.1ab9f632Build(deps): Bump zipp from 3.23.1 to 4.1.0a56fc77Build(deps): Bump hypothesis from 6.152.6 to 6.152.8e8bae9bBuild(deps): Bump requests from 2.34.0 to 2.34.2fc43340Build(deps): Bump idna from 3.14 to 3.15762eaf5Build(deps): Bump jaraco-functools from 4.4.0 to 4.5.0b62e222Build(deps): Bump click from 8.3.3 to 8.4.09190447Build(deps): Bump pydantic from 2.13.3 to 2.13.482a393cci: Remove unnecessary debug output.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)