chore(deps): update pydantic requirement from >=2.6.0 to >=2.13.5 - #74
chore(deps): update pydantic requirement from >=2.6.0 to >=2.13.5#74dependabot[bot] wants to merge 1 commit into
Conversation
Updates the requirements on [pydantic](https://github.com/pydantic/pydantic) to permit the latest version. - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md) - [Commits](pydantic/pydantic@v2.6.0...v2.13.5) --- updated-dependencies: - dependency-name: pydantic dependency-version: 2.13.5 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
srpatcha
left a comment
srpatcha
left a comment
There was a problem hiding this comment.
Review — eDB#74 "chore(deps): update pydantic requirement from >=2.6.0 to >=2.13.5"
head: 352deb9 author: app/dependabot ci: green but hollow — the test matrix never ran on this PR (finding #1)
Verdict: The bump itself is safe — I installed pydantic 2.13.5 against this repo and the full unit and functional suites pass. The problem is that nothing in this PR's own CI demonstrates that, because the jobs that could have are not triggered on this branch at all.
Findings
| # | Severity | File:line | Finding | Recommended fix |
|---|---|---|---|---|
| 1 | Medium | .github/workflows/ci.yml:3-8 at this head |
The Test (Python …) matrix and Build Python Package never ran on this PR, so its green check list is not evidence. This branch forks from 5e436bd (2026-08-25), where ci.yml triggers on pull_request: branches: [main] — and this PR targets master. master was added to the trigger later, in f3b1ab0 ("ci: run the build-and-test workflow on master"), which is not in this branch. checks.txt reflects exactly that: Analyze (Python), CodeQL and assign ran (their own workflows have their own triggers); nothing that executes the package did. |
Rebase onto current master so the trigger applies and the matrix actually runs. Do this after eDB#82, otherwise the matrix fails at pip install -r requirements.txt for a file that does not exist and tells you nothing about pydantic. |
| 2 | Low | pyproject.toml:29 |
This raises the floor on a runtime dependency, not a dev tool, so it narrows the supported range for anything installing edb. No CVE, no API requirement and no changelog entry justifies 2.13.5 specifically over the 2.6.0 that was there. Master design §23.2 makes the package-metadata schema a versioned compatibility contract; moving a runtime floor by seven minor versions with no recorded reason is a compatibility decision being made by a bot. |
Either record the reason (a needed API, a CVE) in the PR, or keep the floor at the oldest version actually supported and constrain the tested version through the CI matrix instead. If the intent is "we only support current pydantic", say so once in pyproject.toml rather than per-bump. |
Dependabot's own comment about the missing npm/github-actions labels does not apply to this PR and is not repeated here.
Architecture conformance
Conforms. Dependency-metadata change confined to Tier 3 eDB (master design §21). One line in [project].dependencies; no source file, import or manifest entry, so §5.1 dependency direction is untouched and no lower tier gains a dependency on a higher one. .github/STANDARDS.md is unaffected — no tag, release-branch or compliance-assertion change.
Proposed changes
No change to the diff itself. Sequence: land eDB#82 (CI install fix) → rebase this branch onto master → let the matrix run → merge on real evidence rather than on an empty check list.
Verification I ran
In a clean venv on Python 3.12.14, Linux, built from pyproject.toml's dev extra (uv pip install -e ".[dev]", rc 0), the resolver selected pydantic 2.13.5 — the exact floor this PR proposes:
python -m pytest tests/unit/ -q --tb=short→ 23 passedpython -m pytest tests/functional/ -q --tb=short→ 1 passed
So the repo's own tests pass on the proposed floor. (The unit command exits 1 under --cov=. because of the unrelated fail_under = 100 gate in .coveragerc:14; the 23 tests themselves pass. See eDB#82.)
fastapi 0.141.1 and pydantic-settings resolved alongside it without conflict.
Not checked
- This PR's head was never built or tested. Everything above was run against eDB#82's head, which shares
master's source tree; it is evidence about pydantic 2.13.5 and this codebase, not about this branch as it stands. - Python 3.10 and 3.11 were not exercised, nor macOS or Windows. Only 3.12 on Linux.
- No downstream consumer of
edbwas checked for whether the raised floor breaks its own resolution — finding #2 is a compatibility observation, not a measured break. - I did not read the pydantic 2.6→2.13 changelog for behavioural changes affecting
src/edb; the passing suite is the only evidence offered, and its coverage is 46.93%.
Automated architecture review of 352deb9ddfaa — scheduled, model claude-opus-5, checked against the EmbeddedOS Master Design v2.0. Advisory only: this reviewer never approves, requests changes, or merges. Reply here to discuss or push back — a wrong finding is a bug worth reporting.
1 participant
Updates the requirements on pydantic to permit the latest version.
Release notes
Sourced from pydantic's releases.
Changelog
Sourced from pydantic's changelog.
... (truncated)
Commits
001dea0Bumppypa/gh-action-pypi-publishaction to v1.14.2558379fBump twine to v7.0.02cfd5d3Do not check for docs builda735beeFix more Clippy lints7eed4a1Fix Clippy 0.1.95 warningsb353bbbPrepare release v2.13.563d2cccCount validated model fields once in smart unionsa53ec2eSpeed up PyPy CI testsd65e0f9Workaround circular import error in Mypy47a6dbfFix missing GC traversal inpydantic-coreforGeneralFieldsSerializerDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)