Repository navigation
uv: let fastapi 0.142 resolve (prerelease if-necessary, web3<8) - #149
Merged
Merged
Conversation
…api 0.142 resolves
5 of 8 tasks
vvillait88
added a commit
to agentscore/python-sdk
that referenced
this pull request
Oct 3, 2026
## Summary Replaces `prerelease = "disallow"` with `prerelease = "if-necessary"`, matching python-commerce (agentscore/python-commerce#149). A blanket `disallow` also refuses packages that have never published a stable version, and uv then silently keeps an older version of whatever needs them; that held fastapi back in python-commerce and core's store and failed Dependabot outright. `if-necessary` admits a prerelease only where no stable release exists, and any package that reaches for a beta it does not need gets its own constraint (python-commerce pins `web3<8`; nothing in this tree needs one). This tree relocks with no changes and no prereleases. ## Type of change - [ ] Bug fix (no breaking change) - [ ] New feature (no breaking change) - [ ] Breaking change (existing callers must update) - [x] Docs, tests, or internal maintenance only ## Public API None. `[tool.uv]` is development-only, so no release. ## Test plan `uv lock --upgrade` reports no changes, no `a`/`b`/`rc` version in `uv.lock`, and `uv run pytest tests` passes (177 passed, 2 skipped). ## Checklist - [x] Tests cover the new behavior, and the suite passes locally - [x] Lint, format, and type checks pass - [x] Docs and README examples updated if the public surface changed (no public surface changed) - [x] No secrets, credentials, or personal data in the diff or the tests
vvillait88
added a commit
that referenced
this pull request
Oct 4, 2026
## Summary Releases 3.1.0, carrying everything merged since 3.0.0: - the quota denial message no longer tells an agent to retry, at all six adapters (#153) - `to_security_requirements` exported from `identity` and the package root (#151), which is the new public surface that makes this a minor - A2A signing docs and supported versions corrected, README notes on UCP `keys[]` (#150, #152) - fastapi 0.142 resolves under the `if-necessary` prerelease rule with the `web3<8` constraint (#149) Also in this PR: `agentscore-py` floor raised to 2.7.1 (released today), and the `web3<8` comment now states the real blocker. web3 8.0.0 is stable, but it needs eth-abi 6, which pympp's `tempo` extra excludes (`eth-abi<6`, pympp 0.11.0 is the latest), so an unconstrained re-lock lands on the 8.0.0b3 beta and pinning 8.0.0 downgrades pympp to 0.9.1. I tried the lift: the beta resolution passed the suite, but shipping a beta to merchants is the thing the constraint exists to prevent. Worked with: Varun. Out of scope: lifting `web3<8`, which waits on pympp admitting eth-abi 6. ## Type of change - [ ] Bug fix (no breaking change) - [x] New feature (no breaking change) - [ ] Breaking change (existing callers must update) - [ ] Docs, tests, or internal maintenance only ## Public API `to_security_requirements` is newly exported (merged in #151). Nothing removed or changed. ## Test plan `ruff check`, `ruff format --check`, `ty check` and `pytest` (1893 passed, 4 skipped, 95.41% coverage) pass locally on this branch. ## Checklist - [x] Tests cover the new behavior, and the suite passes locally - [x] Lint, format, and type checks pass - [x] Docs and README examples updated if the public surface changed - [x] No secrets, credentials, or personal data in the diff or the tests
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
prerelease = "disallow"silently held fastapi at 0.141.1. fastapi 0.142'sstandardextra (reached throughx402[fastapi]) requiresopentelemetry-sdk>=1.44, which pinsopentelemetry-semantic-conventions==0.66b0, and that package has only ever published beta-tagged versions. Underdisallow, uv resolved around it by keeping the older fastapi, and Dependabot failed outright on the same conflict in a consumer.The setting existed to keep
web3off its 8.0.0 beta: cdp-sdk, pytempo and x402 all take web3 unbounded, and solana 0.41 needs a websockets only the web3 8 beta allows. This replaces the blanket ban with the two things it was standing in for:prerelease = "if-necessary", which admits a prerelease only for a package with no stable release (the OpenTelemetry semantic-conventions family).constraint-dependencies = ["web3<8"], which keeps web3 on 7.16.0 and solana on 0.40.1, the same versionsdisallowheld.Lock result: fastapi 0.142.2, plus the OpenTelemetry packages it now requires. The only prereleases in the lock are the three semantic-conventions packages.
Type of change
Public API
None.
[tool.uv]anduv.lockare development-only; the published package's metadata is unchanged, so this needs no release.Test plan
uv run ruff check .,uv run ruff format --check .,uv run ty check agentscore_commerce/,uv run vulture . --min-confidence 80 --exclude .venvanduv run pytest tests(1891 passed, 4 skipped) all exit 0. OSV overuv.lock(164 packages) is clean. Also checked:if-necessaryalone pulls web3 8.0.0b3 back in, which is why the constraint is needed.Checklist