chore(deps-dev): bump python group (8 updates) + fix mypy fallout - #3238
Merged
vpetersson merged 3 commits intoAug 3, 2026
Merged
Conversation
Bumps the python group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [djangorestframework-stubs](https://github.com/typeddjango/djangorestframework-stubs) | `3.17.0` | `3.17.1` | | [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.1` | | [types-gunicorn](https://github.com/python/typeshed) | `26.0.0.20260518` | `26.0.0.20260728` | | [types-pytz](https://github.com/python/typeshed) | `2026.2.0.20260518` | `2026.3.1.20260727` | | [pytz](https://github.com/stub42/pytz) | `2026.2` | `2026.3.post1` | | [redis](https://github.com/redis/redis-py) | `8.0.1` | `8.1.0` | | [sh](https://github.com/amoffat/sh) | `2.3.0` | `2.4.0` | | [uvicorn[standard]](https://github.com/Kludex/uvicorn) | `0.51.0` | `0.52.0` | Updates `djangorestframework-stubs` from 3.17.0 to 3.17.1 - [Release notes](https://github.com/typeddjango/djangorestframework-stubs/releases) - [Commits](typeddjango/djangorestframework-stubs@3.17.0...3.17.1) Updates `ruff` from 0.16.0 to 0.16.1 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.16.0...0.16.1) Updates `types-gunicorn` from 26.0.0.20260518 to 26.0.0.20260728 - [Commits](https://github.com/python/typeshed/commits) Updates `types-pytz` from 2026.2.0.20260518 to 2026.3.1.20260727 - [Commits](https://github.com/python/typeshed/commits) Updates `pytz` from 2026.2 to 2026.3.post1 - [Release notes](https://github.com/stub42/pytz/releases) - [Commits](stub42/pytz@release_2026.2...release_2026.3.post1) Updates `redis` from 8.0.1 to 8.1.0 - [Release notes](https://github.com/redis/redis-py/releases) - [Changelog](https://github.com/redis/redis-py/blob/master/CHANGES) - [Commits](redis/redis-py@v8.0.1...v8.1.0) Updates `sh` from 2.3.0 to 2.4.0 - [Release notes](https://github.com/amoffat/sh/releases) - [Changelog](https://github.com/amoffat/sh/blob/develop/CHANGELOG.md) - [Commits](amoffat/sh@2.3.0...2.4.0) Updates `uvicorn[standard]` from 0.51.0 to 0.52.0 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.51.0...0.52.0) --- updated-dependencies: - dependency-name: djangorestframework-stubs dependency-version: 3.17.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python - dependency-name: ruff dependency-version: 0.16.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python - dependency-name: types-gunicorn dependency-version: 26.0.0.20260728 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python - dependency-name: types-pytz dependency-version: 2026.3.1.20260727 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python - dependency-name: pytz dependency-version: 2026.3.post1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python - dependency-name: redis dependency-version: 8.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python - dependency-name: sh dependency-version: 2.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python - dependency-name: uvicorn[standard] dependency-version: 0.52.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python ... Signed-off-by: dependabot[bot] <[email protected]>
…s 3.17.1
The djangorestframework-stubs 3.17.0 → 3.17.1 bump in this PR broke mypy
two ways:
1. It dropped its transitive types-psutil, so the psutil imports in
page_context.py / api/views/v2.py lost their stubs
("Library stubs not installed for psutil"). Pin types-psutil as a
direct dev dependency instead of relying on the transitive edge.
2. Its Request.data is now typed dict[str, Any] | list[Any], so
request.data.get(...) fails union-attr in three upload/order
endpoints. These endpoints always receive a form/dict body, so
narrow with cast(dict[str, Any], request.data) — the sanctioned
narrowing, not a blanket ignore.
mypy clean on the three files; 464 api/template tests pass.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01HJ3ucEkn62cbgPoisAZ5LQ
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #3238 +/- ##
=========================================
Coverage ? 90.82%
=========================================
Files ? 76
Lines ? 8361
Branches ? 885
=========================================
Hits ? 7594
Misses ? 549
Partials ? 218 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
This PR updates the Python dev dependency set (matching the superseded Dependabot bump) and adjusts server code to keep mypy passing after upstream typing changes in djangorestframework-stubs.
Changes:
- Bump 8 Python (dev and runtime) dependencies, including
djangorestframework-stubs,ruff,redis,sh, anduvicorn. - Add
types-psutilas an explicit dev dependency to restore psutil stubs after it stopped arriving transitively. - Adjust a few API endpoints to satisfy the updated DRF typing for
Request.data(nowdict | list).
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
uv.lock |
Regenerates the lockfile for the dev dependency bumps and adds types-psutil to the resolved sets. |
src/anthias_server/api/views/mixins.py |
Adds cast(...)-based narrowing for request.data at three endpoints to address new DRF stub unions. |
pyproject.toml |
Updates pinned versions and adds types-psutil to the dev-host group (pulled into the CI mypy group via include-group). |
Suppressed comments (2)
src/anthias_server/api/views/mixins.py:293
- This endpoint relies on
request.data.get(...), butrequest.datacan be a list for JSON bulk payloads per DRF stubs. The currentcast(dict[str, Any], request.data)won’t stop a runtimeAttributeErrorin that case. Explicitly reject list payloads before calling.get()to return a 400 rather than a 500.
try:
data = cast(dict[str, Any], request.data)
file_upload = data.get('file_upload')
src/anthias_server/api/views/mixins.py:502
request.datais typed asdict | list; casting it todictdoesn’t prevent a runtime failure if a client sends a list payload. Reject list payloads up-front so.get('ids', ...)is safe and the API responds with a 400 on invalid body types.
data = cast(dict[str, Any], request.data)
asset_ids = data.get('ids', '').split(',')
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Copilot review on the deps-bump PR: cast(dict, request.data) only satisfied mypy — a JSON list body (DRF sets request.data to a list) would still hit .get() and raise AttributeError, i.e. a 500. Replace the cast with an isinstance(data, dict) guard at all three upload/order endpoints so a non-dict body falls through to the existing 400 (and mypy still narrows via the local). Add a regression test that a list body to the file-asset endpoint returns 400, not 500. Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01HJ3ucEkn62cbgPoisAZ5LQ
|
vpetersson
approved these changes
Aug 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #3236 — same 8 dev-dependency bumps from the dependabot PR, plus the two mypy fixes that bump needs. Opened from a fork branch because
vpetersson-botonly has pull access to this repo, so I could not push the fix onto the dependabot branch directly. Close #3236 in favour of this once merged (or cherry-pick the fix commit onto that branch — whichever you prefer).The mypy failure on #3236
run-mypyfailed with 5 errors, both caused by thedjangorestframework-stubs 3.17.0 → 3.17.1bump:types-psutilvanished. It was arriving transitively viadjangorestframework-stubs, which dropped that edge in 3.17.1 — so thepsutilimports inapp/page_context.pyandapi/views/v2.pylost their stubs (Library stubs not installed for "psutil").request.data.get(...)union-attr (×3). The new stubs typeRequest.dataasdict[str, Any] | list[Any], so.get()is rejected on the list branch in three upload/order endpoints inapi/views/mixins.py.Fix
types-psutil==7.2.2.20260408as a direct dev dependency (in thedev-hostgroup, alongside the othertypes-*), instead of relying on the transitive edge.cast(dict[str, Any], request.data)at the three sites — these endpoints always receive a form/dict body. Using the sanctioned narrowing rather than a blanket# type: ignore.Verified
mypyclean on all three previously-failing files (2.3.0 + django-stubs 6.0.7 + drf-stubs 3.17.1 + types-psutil).uv lockregenerated (types-psutil restored to the lockfile).🤖 Generated with Claude Code
https://claude.ai/code/session_01HJ3ucEkn62cbgPoisAZ5LQ