chore(deps): bump starlette from 0.52.1 to 1.3.1 in /envs/qed_math_env#914
chore(deps): bump starlette from 0.52.1 to 1.3.1 in /envs/qed_math_env#914dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [starlette](https://github.com/Kludex/starlette) from 0.52.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.52.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Scope: lockfile-only change — envs/qed_math_env/uv.lock (+23 / −29). No Python source is touched. Reviewed against git diff d9ed15d...3f13a74.
Automated Checks
- Lint (
.claude/hooks/lint.sh): PASS for this PR. No.pyfiles are modified, so nothing here is attributable to the change. (The hook does report pre-existing format drift in unrelated envs —chat_env,opencode_env,coding_tools_env, etc. — but none inqed_math_envand none in this diff.) - Debug code (
.claude/hooks/check-debug.sh): CLEAN for this PR. All findings are pre-existing insrc/(docstring examples, CLI console output, a manual test script) and unrelated to a lockfile bump.
Open RFCs Context
Open: 000, 001, 002, 003, 005 (In Review), 010 (Draft), 004 (Rubrics). qed_math_env is a rubric / LLM-judge env, so RFC 004 governs its domain — but a dependency-lock bump doesn't touch reward/rubric logic. No open RFC governs dependency versions, so there is nothing to reconcile.
Tier 1: Fixes Required
None. A uv-resolved lockfile bump can't introduce syntax/import/type errors, and the resolution is internally consistent:
fastapi 0.135.1is locked, satisfying the repo'sfastapi>=0.116.0floor from #810 (the pin that guards against the earlierstarlette 0.46+incompatibility).starlette 1.xis already the norm across the monorepo (multiple envs pin1.0.1/1.3.1), so1.3.1is well-precedented — not a first crossing into 1.x.
Tier 2: Alignment Discussion
Principle Conflicts: None identified. The change doesn't touch any architectural boundary (rewards-in-environment, client/server separation, Gym-like vs. MCP APIs).
RFC Conflicts: None identified.
Advisory Notes (non-blocking)
- Title vs. actual scope. The title says "bump starlette 0.52.1 → 1.3.1", but the re-resolve also bumps
gradio 6.9.0 → 6.19.0andgradio-client 2.3.0 → 2.5.0, addshf-gradio 0.4.1, and dropsaiofiles+ffmpy.gradiois a transitive dep ofopenenv-coreused only for the optional debug web UI (ENABLE_WEB_INTERFACE), so blast radius is small — but a merger reading only the title should know gradio moved ~10 minor versions. - Optional smoke test.
starletteis the ASGI layer under both the HTTP and the WebSocket (Gym-like orchestration) interfaces, and this repo has prior starlette-compat history (#810). A quickqed_math_envserver smoke test (/health,reset,step, WebSocket) before merge would fully de-risk it. Suggested reviewers: @sergiopaniego / @burtenshaw (authored the #810 fastapi/starlette compat pin) and @Darktex (owns the "cutting-edge for stability" principle and the WebSocket communication invariant).
Summary
- 0 mechanical issues to fix
- 0 principle/alignment violations
- 0 RFC conflicts
- 2 advisory notes for the merger (gradio scope creep; optional smoke test)
Overall: a routine, low-risk transitive dependency bump — safe to merge once CI is green.
Sent by Cursor Automation: Pre-review
| [[package]] | ||
| name = "starlette" | ||
| version = "0.52.1" | ||
| version = "1.3.1" |
There was a problem hiding this comment.
starlette 0.52.1 → 1.3.1 (major bump). This is internally consistent and well-precedented: the locked fastapi 0.135.1 satisfies the fastapi>=0.116.0 floor from #810 (which guarded against the earlier starlette 0.46+ break), and other envs in this repo already pin starlette 1.x. Since starlette is the ASGI layer under both the HTTP and WebSocket interfaces, a quick server smoke test is the only real residual risk before merge.
| [[package]] | ||
| name = "gradio" | ||
| version = "6.9.0" | ||
| version = "6.19.0" |
There was a problem hiding this comment.
Heads-up: this is where the re-resolution pulls gradio 6.9.0 → 6.19.0 (~10 minor versions) as a side effect of the starlette bump — the PR title only mentions starlette. In the same update, gradio-client goes 2.3.0 → 2.5.0, hf-gradio 0.4.1 is added, and aiofiles + ffmpy are dropped. gradio is only used for the optional debug web UI, so low blast radius, but worth calling out since it's not reflected in the title.
|
Closed in favor of aggregate Dependabot PR #921. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps starlette from 0.52.1 to 1.3.1.
Release notes
Sourced from starlette's releases.
... (truncated)
Changelog
Sourced from starlette's changelog.
... (truncated)
Commits
8ebffd0Version 1.3.1 (#3330)25b8e17EnforceFormParserlimits in parser callbacks (#3331)dba1c4bEnforcemax_fieldsandmax_part_sizeinFormParser(#3329)45e51dcUseStarletteDeprecationWarninginstead ofDeprecationWarning(#3119)5f8610cVersion 1.3.0 (#3327)167b585Buildrequest.urlfrom structured components (#3326)3730925Useremoveprefixto strip weak ETag indicator inis_not_modified(#3193)e6f7ad1avoid collapsing exception groups from user code (#2830)115228fAnnotate URLPath protocol parameter with Literal (#3285)113f193docs: replace inline ASGI server list with link to canonical implemen… (#3204)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
High Risk
Starlette 1.x is a major upgrade on the FastAPI/Gradio request path (URL construction, multipart/form limits, static file handling), so regressions or stricter parsing could affect the env server and any Gradio UI without code changes.
Overview
Updates
envs/qed_math_env/uv.lockso transitive HTTP stack versions move forward, chieflystarlette0.52.1 → 1.3.1 (major). That version is pulled in byfastapi(OpenEnv server runtime) andgradio.The lock refresh also bumps
gradio6.9.0 → 6.19.0 andgradio-client2.3.0 → 2.5.0, with Gradio’s dependency list droppingaiofiles/ffmpyand addinghf-gradio. Standalone lock entries foraiofilesandffmpyare removed as they’re no longer in the resolved graph.No application source or
pyproject.tomlchanges—only the resolved dependency snapshot.Reviewed by Cursor Bugbot for commit 3f13a74. Bugbot is set up for automated code reviews on this repo. Configure here.