Skip to content

Resolve Dependabot updates and release PyFly v26.10.05 - #188

Merged
ancongui merged 1 commit into
mainfrom
codex/dependabot-261005
Oct 14, 2026
Merged

ancongui merged 1 commit into
mainfrom
codex/dependabot-261005

Conversation

@ancongui

@ancongui ancongui commented Oct 14, 2026 •

Copy link
Copy Markdown
Contributor

Refresh the runtime, development, site, and book dependencies from Dependabot #171 and upgrade all 14 setup-python uses from #157 to the immutable v7.0.0 commit. Bump PyFly to v26.10.05 (package 26.10.5), synchronize active download links and badges, and retain the qualified SQLAlchemy 2.0.50 and asyncmy 0.2.11 minimums while updating their locked versions.

Redis 8's five-second default socket timeout disconnects valid long-polling consumers. Preserve blocking reads and legacy response shapes, with a real-server regression covering finite and indefinite waits, delivery after idling, and cancellation. Adapt the affected strict typing and tooling tests to the updated libraries.

The published Presidio anonymizer caps cryptography below 49. The optional PII extra uses its official merged source fix at commit 5e2fcea990aa3b99660d2aea9121d0ba74a8940b, allowing patched cryptography 50.0.2 without overriding dependency metadata. PII installs require Git/GitHub access; existing pip PII installs must explicitly reinstall the same-version source dependency before upgrading. The README, installation guide, logging guide, and dependency ledger document the tested migration.

Validation on the candidate:

  • Full Python 3.12 suite: 9,190 passed, 7 expected skips, 86% coverage; Ruff, formatting, strict mypy and installed dependency consistency passed.
  • Real Redis blocking regression: both cases failed before the fix and passed after it. PII workflow: 15 passed; full logging suite: 96 passed; upstream encryption/engine subset: 68 passed. Fresh wheel/sdist PII installs and documented pip/uv migrations verified.
  • Six installed-extras tests, three browser tests, and the web sample passed. Strict docs, 83 book tests and both manuscript listing checks passed; EN/ES PDF/EPUB builds and sampled visual review completed, including the final edited PII pages.
  • Independent review: no actionable blocking findings. Version-specific PyPI metadata checks for 198 package/version pairs reported no active advisories.

Exact-head CI passed: regular PR CI, real Presidio redaction, and all 14 jobs of the manually dispatched native-backend workflow, including Python 3.12/3.13, SQLAlchemy 2.0, PostgreSQL, MySQL, MariaDB, MongoDB replica set, Docker services, and browser/installed distributions. PII installed-package qualification also passed on both supported Python versions. Final books and package assets will be rebuilt from the release tag and independently downloaded/verified.

@ancongui
ancongui merged commit b9bc9d0 into main Oct 14, 2026
26 checks passed
@ancongui
ancongui deleted the codex/dependabot-261005 branch October 14, 2026 20:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant