chore(deps): bring the pinned AI stack up to what a fresh install gets - #3208
Conversation
uv.lock had drifted a long way behind the versions CI (and any pip/docker install) actually resolves: langchain 1.3.6 -> 1.3.18 langchain-core 1.5.3 -> 1.6.1 langchain-openai 1.3.0 -> 1.6.0 langchain-anthropic 1.5.4 -> 1.7.0 langgraph 1.2.4 -> 1.2.11 openai 2.41.0 -> 3.5.0 (major) anthropic 0.121.0 -> 1.2.0 (major) Local development ran the lock while CI installed unpinned, so the two were exercising different code. That is not theoretical: it hid a real defect this week — a guard that was inoperative on exactly the version CI uses passed the local suite and then failed a PR that had not caused it. Scoped deliberately to the AI stack rather than a blanket , so the diff stays reviewable. Verified on a venv synced from the new lock (Python 3.13): full suite 6690 passed / 16 skipped, ruff clean, import contracts 3/3, A2A live smoke passed. Pinning the PR gates to this lock, plus a nightly canary against latest, is the follow-up — that is what stops the gap reopening. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Warning Review limit reachedNext included review available in 25 seconds. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![protoreview[bot]](https://avatars.githubusercontent.com/in/4233969?s=60&v=4){kind=small}
There was a problem hiding this comment.
QA panel review — PASS
code-review-structural · head 8a7c626a4f8f · formal
Low-risk lockfile update: anthropic 0.121.0→1.2.0 (major bump), removal of distro, httpx→httpx2 rename, plus a changelog fragment. All five finders returned zero findings and the structural verifier confirmed the diff matches the brief's characterization with nothing to annotate. No panel disagreement, no prior requests to disposition, and no coverage gaps — the structural pass ran and cleared. Nothing to fix before merge.
No findings — the review came back clean.
findings JSON (machine-readable)
[]Two gate failures the first push missed, both mechanical: - The lock was written by uv 0.11.13; CI pins 0.11.29 because uv's lock OUTPUT is version-dependent (checks.yml says so explicitly — the two disagree about dependency markers, so an unpinned uv thrashes the file). Re-locked with 0.11.29; `uv lock --check` now passes. - THIRD_PARTY_LICENSES.md is generated FROM the lockfiles, so any dependency change makes it stale. Regenerated: 123 Python + 689 npm packages. `scripts/gate.py --lint-only` — the same gate CI runs — passes all four checks. Suite re-verified on the re-locked venv: 6690 passed / 16 skipped, live smoke passed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
QA panel review — PASS
code-review-structural · head 172860a47917 · formal
PR #3208 is a dependency/license update (bumping anthropic, openai, langchain*, langgraph*; adding httpcore2, httpx2, httpx2-jsfetch; removing distro, tqdm). No findings survived to this final pass: the structural verification pass was skipped entirely — the verifier never received a findings array to annotate and reported a 404 on graph/llm.py (a path not present in this PR). The panel therefore produced zero findings, and with no prior requests there is nothing to disposition. Overall risk is low for a dependency bump, but the absence of any structural or LLM review coverage on the lock-file changes is a gap: if this PR touches production import paths or pins, a targeted re-review of the requirements/lock diff is advisable before merge.
No findings — the review came back clean.
findings JSON (machine-readable)
[]
1 participant
uv.lockhad drifted a long way behind the versions CI — and anypip/docker install — actually resolves:Local development ran the lock while CI installed unpinned, so the two were exercising different code. That isn't theoretical — it hid a real defect this week: a guard that was inoperative on exactly the version CI uses passed the local suite, then failed a PR that hadn't caused it. langchain-openai 1.6.0 also added the reasoning
output_item.donehandling that #3207 works around, so the gap was hiding upstream progress too, not just risk.Scoped deliberately to the AI stack rather than a blanket
uv lock --upgrade, so the diff stays reviewable — everything else (fastapi, starlette, cryptography, sqlalchemy…) is untouched.Verification
Against a venv synced from the new lock (which resolves Python 3.13, so this is also a free 3.13 pass):
ruff check .clean ·lint-imports3/3 keptscripts/live_smoke.pyPASSEDNo source changes were needed for either major SDK bump.
Follow-up
Pinning the PR gates to this lock, plus a nightly canary against latest and a seam-contract test suite, is the next PR — that's what stops the gap silently reopening.
🤖 Generated with Claude Code