fix(deps): bump anyio from 4.13.0 to 4.14.2 - #1855
Conversation
Bumps [anyio](https://github.com/agronholm/anyio) from 4.13.0 to 4.14.2. - [Release notes](https://github.com/agronholm/anyio/releases) - [Commits](agronholm/anyio@4.13.0...4.14.2) --- updated-dependencies: - dependency-name: anyio dependency-version: 4.14.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Performance BenchmarksCompared Top regressions:
|
|
Carried the GitPython 3.1.60 lock remediation and guard from #1857 onto this AnyIO update in Validation: 21 dependency-lock tests, Ruff format/lint, Mypy (480 files), and strict Python 3.12 dependency audit passed. The required broad local run reached 6,040 passes before an unchanged cache-identity test failed; the relevant warm rerun and exact-main comparison each passed all three cases. Full current-head CI is pending. Two independent native Codex reviews plus a fresh verifier found no introduced issues. @codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
mldangelo-oai
left a comment
There was a problem hiding this comment.
Reviewed the complete dependency diff at 0f7c9aa against current main fafb9fb. AnyIO 4.14.2 and GitPython 3.1.60 preserve the existing Python compatibility/dependency edges and include deterministic lock regression guards. Exact-head CI has 36 successful checks and 5 expected skips; dependency audit and lock consistency passed. Current-head Codex code/security reviews are clean and there are no unresolved review threads. No introduced blocking issue found.
Bumps anyio from 4.13.0 to 4.14.2.
Release notes
Sourced from anyio's releases.
... (truncated)
Commits
c384f99Bumped up the versiondbba29dFixed 100% CPU spin on cancel scope misuse (#1217)6bbc6c3Fix CapacityLimiter over-granting tokens on asyncio (#1172)6f82b25Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flakybe24b04Relaxed timeouts to fix test flakiness8113506Fix test flakiness caused by slow callback duration logging1e988b6Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...44713f3Pin setup-uv to a commit sha across downstream jobs (#1213)f1b7301Fixed stderr writes in a worker subprocess causing a deadlock (#1207)212be93Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.