deps: bump caio from 0.9.25 to 0.10.2 - #322
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
Bumps [caio](https://github.com/mosquito/caio) from 0.9.25 to 0.10.2. - [Release notes](https://github.com/mosquito/caio/releases) - [Commits](mosquito/caio@0.9.25...0.10.2) --- updated-dependencies: - dependency-name: caio dependency-version: 0.10.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Owner
|
Closing: this bump is unresolvable against the current dependency graph, not a CI flake.
Every published version of
Staying on 0.9.25 carries no known risk: A |
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
cdeust
added a commit
that referenced
this pull request
Aug 1, 2026
caio is transitive (hypermnesia-mcp -> fastmcp -> fastmcp-slim -> py-key-value-aio -> aiofile -> caio). Every published aiofile pins caio below 0.10 — 3.9.0 `caio<0.10.0,>=0.9.0`, 3.10.0 through 3.11.1 (latest, 2026-05-16) `caio~=0.9.0` — while caio 0.10.2 shipped 2026-07-05, after it. PR #322 was therefore not a resync failure but an unresolvable one: every job failed, pip reporting ResolutionImpossible. Closed and ignored until aiofile widens its bound. No advisory affects caio (GitHub advisories API, 2026-08-01), so 0.9.25 is not a security hold. The comment above the pip entry records the other half of the story: the `deps` PRs that ARE resolvable still arrive red, because Dependabot never runs `uv lock` or generate_pip_constraints.py, and Lint guards exactly that chain. Writing the two-command fix next to the config saves the next maintainer the log archaeology this cycle cost. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This was referenced Aug 10, 2026
cdeust
added a commit
that referenced
this pull request
Aug 10, 2026
…xact version (#416) * ci(dependabot): ignore pydantic-core bumps past the pydantic-pinned exact version pydantic-core is transitive (hypermnesia-mcp -> pydantic -> pydantic-core) and pydantic pins it EXACTLY per release rather than by range: pydantic 2.13.4 (latest stable) declares `pydantic-core==2.46.4`. Verified against PyPI's own metadata that no pydantic release accepts 2.47.0 at any maturity — the only releases past 2.13.4 are pre-releases 2.14.0a1/b1, and both already require `pydantic-core==2.48.0`. 2.47.0 sits in a gap between the two pydantic pin generations with no compatible pydantic release, so the bump PR #333 proposed is unresolvable, not merely unresynced (same class of failure as the existing caio ignore entry above it, PR #322). No advisory affects pydantic-core, so this is not a security hold. PR #333 is closed with this same reasoning in its body. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(deps): correct the pydantic-core exclusion's stated reason and bound it Review finding on PR #416: the prior comment claimed no pydantic release at any maturity accepts pydantic-core 2.47.0. That was checked against only one of the two pre-releases past 2.13.4 (2.14.0b1, which requires pydantic-core==2.48.0) and wrongly generalized to the other. PyPI's own metadata for 2.14.0a1 (not previously queried) shows it requires pydantic-core==2.47.0 exactly -- a real match exists, just on an alpha this repo does not track. The practical conclusion is unchanged (2.13.4, the latest STABLE pydantic, pins pydantic-core==2.46.4 exactly, so the bump to 2.47.0 does not resolve against what this repo actually installs) but the comment now states that reason instead of the false "no match at any maturity" one -- a wrong # source: comment is worse than no comment, since the next person to read it takes it as fact. Also narrows the exclusion from the open `>2.46.4` to `>2.46.4,<2.48.0` (PEP 440 comma-AND syntax, verified against `packaging.specifiers .SpecifierSet`): the open form would also have silently blocked the legitimate 2.48.0 bump the day pydantic's stable line reaches 2.14.0 (matching the beta's pin) -- an exclusion should be no wider than the problem it routes around. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps caio from 0.9.25 to 0.10.2.
Release notes
Sourced from caio's releases.
Commits
6e016ffMerge pull request #65 from mosquito/version-from-tag2b5ecd8Fix mypy errors on class-level backend attributesb8702fcDerive package version from release tag (fixes #60)3faa5c7Merge pull request #47 from nE0sIghT/pytest-asyncio353fd67Merge pull request #56 from mosquito/dependabot/uv/requests-2.33.022a8b88Merge pull request #57 from mosquito/dependabot/uv/pygments-2.20.0f2765fbMerge pull request #58 from mosquito/dependabot/uv/benchmark/pygments-2.20.09b6fec9Merge pull request #59 from mosquito/dependabot/uv/benchmark/pillow-12.2.0f3f277cMerge pull request #54 from jmcarcell/make-inlinef2a4d67Add missing intDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)