From 7598cc128cc9da833eb53116054eb25fcd4b4601 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 1 Sep 2026 22:18:59 +0000 Subject: [PATCH 1/2] chore(deps-dev): update starlette requirement Updates the requirements on [starlette](https://github.com/Kludex/starlette) to permit the latest version. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](https://github.com/Kludex/starlette/compare/0.49.3...1.6.0) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.6.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] --- requirements/adapter_dev.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements/adapter_dev.txt b/requirements/adapter_dev.txt index 34a96a911..afa0cedd5 100644 --- a/requirements/adapter_dev.txt +++ b/requirements/adapter_dev.txt @@ -66,7 +66,7 @@ sanic>=25.12.1,<26; python_version >= "3.10" # starlette # Note: starlette 0.49.3 requires Python >=3.9; 3.7/3.8 stay on the older pinned release. starlette>=0.19.1,<0.45; python_version < "3.9" -starlette>=0.49.3,<1; python_version >= "3.9" +starlette>=1.6.0,<2; python_version >= "3.9" # tornado # Note: tornado 6.5.6 requires Python >=3.9; 3.7/3.8 stay on the older pinned release. From ae6ecbaf10eadecbde001f08a70349e6e8f88a76 Mon Sep 17 00:00:00 2001 From: William Bergamin Date: Fri, 4 Sep 2026 11:49:34 -0400 Subject: [PATCH 2/2] fix(deps): split starlette pin so Python 3.9 stays installable starlette 1.6.0 requires Python >=3.10 (floor jumped to >=3.9 at 0.45.0 and to >=3.10 at 0.50.0), so the Dependabot two-way replacement stranded Python 3.9 on a release it can't install and broke "Unit tests (3.9)". Split the requirement three ways to partition the matrix: 3.7/3.8 keep <0.45, 3.9 takes the last compatible 0.49.x line (<0.50), and 3.10+ takes the >=1.6.0,<2 bump. Drop the redundant note to match chalice/fastapi. Also codify in the managing-dependencies skill that the # Note: comment is extremely optional and must not restate what the requirement lines already make explicit. Co-Authored-By: Claude --- .claude/skills/managing-dependencies/SKILL.md | 4 +++- requirements/adapter_dev.txt | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.claude/skills/managing-dependencies/SKILL.md b/.claude/skills/managing-dependencies/SKILL.md index 8f67fccd8..fba850832 100644 --- a/.claude/skills/managing-dependencies/SKILL.md +++ b/.claude/skills/managing-dependencies/SKILL.md @@ -19,7 +19,7 @@ The convention resolves this without dropping old-Python support: pin each inter ## File-layout convention -Each file starts with a `# pip install -r requirements/.txt` header, then lists **one dependency per section**: the name of the dependency (as a `# name` header), an optional rationale note (starting with `# Note:`, explaining why a version is pinned or split), then the requirement line(s), separated from the next section by a blank line. This makes every pin self-documenting. +Each file starts with a `# pip install -r requirements/.txt` header, then lists **one dependency per section**: the name of the dependency (as a `# name` header), an **extremely optional** rationale note (starting with `# Note:` — see below), then the requirement line(s), separated from the next section by a blank line. This makes every pin self-documenting. ``` # pip install -r requirements/test.txt @@ -34,6 +34,8 @@ pytest-cov>=7.1.0,<8; python_version >= "3.14" Keep this layout when adding or editing dependencies. Never leave an empty trailing `;` (a fossil of a collapsed split; delete it — the old `pytest-asyncio<2;` line was exactly this). +**On the `# Note:` — omit it by default.** The requirement lines and their `python_version` markers already state *what* is pinned and *which interpreter gets which release*, and this skill already establishes that an old-side ceiling marks a floor jump. A note must never restate any of that. Write one only to record rationale the lines cannot express on their own — a non-obvious cap, or a coupling invisible from the specifier. The archetype is the `tracerite` pin (see "a coupled companion dependency" below): a companion dependency that breaks with no `requires_python` metadata, which no reader could infer from the line itself. A routine floor-jump split (like `chalice`, `fastapi`, or `starlette`) needs no note at all. Several older sections still carry notes that merely restate their lines; treat those as legacy, not a template to copy. + ## Which files need Python-version markers A marker split is only needed for requirements files installed across the **full** Python matrix. Which file you are editing decides this. To see where a file is installed, read `.github/workflows/ci-build.yml`. It is the source of truth for which Python versions install which requirements files. Everything except `dev_tools.txt` is installed by the `unittest` matrix job across 3.7–3.14. diff --git a/requirements/adapter_dev.txt b/requirements/adapter_dev.txt index 7f514dbe2..beb6b1ace 100644 --- a/requirements/adapter_dev.txt +++ b/requirements/adapter_dev.txt @@ -64,9 +64,9 @@ sanic>=25.3.0,<25.12.0; python_version >= "3.9" and python_version < "3.10" sanic>=25.12.1,<26; python_version >= "3.10" # starlette -# Note: starlette 0.49.3 requires Python >=3.9; 3.7/3.8 stay on the older pinned release. starlette>=0.19.1,<0.45; python_version < "3.9" -starlette>=1.6.0,<2; python_version >= "3.9" +starlette>=0.49.3,<0.50; python_version >= "3.9" and python_version < "3.10" +starlette>=1.6.0,<2; python_version >= "3.10" # tornado # Note: tornado 6.5.6 requires Python >=3.9; 3.7/3.8 stay on the older pinned release.