보안(deps): Update openai requirement from <3,>=1.0.0 to >=1.0.0,<4 - #133
Merged
Merged
Conversation
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
eddmpython
added a commit
that referenced
this pull request
Sep 22, 2026
증상 - Dependabot PR #133(openai 상한 <3 -> <4)의 CI test-fast 에서 tests/dataHub/controlPlane/testRemote.py::testRemoteClientAndDistributedWorkerCompleteJob 하나가 httpx/_client.py:1016 `assert isinstance(response.stream, SyncByteStream)` 로 실패했다 (run 33454189248, 7954 passed / 1 failed). 원인 - openai 3.6.0 은 httpx 대신 httpx2 를 의존성으로 끌고 온다. - starlette 1.3.1 의 testclient 는 import 시 httpx2 가 있으면 그것을 우선 쓴다 (starlette/testclient.py:33 `import httpx2 as httpx`). - 테스트는 TestClient 의 사설 속성 `server._transport` 를 빌려 httpx 로 만든 DataHubClient 와 DataHubWorker 에 끼웠다. httpx2 가 깔리면 이 transport 가 httpx2 Response 를 돌려주고, httpx 클라이언트의 타입 단언이 깨진다. 제품 코드는 httpx 만 쓰므로 영향이 없고 테스트 배선만의 결함이다. 변경 - 테스트 안에 SyncAsgiTransport 를 두었다. httpx.ASGITransport 를 anyio 블로킹 포털로 감싸 sync 요청을 처리한다. starlette 가 어느 httpx 계열을 고르든 상관없이 dartlab 이 실제로 쓰는 httpx 만으로 앱에 붙는다. 응답 본문은 aiter_raw 로 받아 content-encoding 이중 해석을 피한다. - 같은 파일의 나머지 TestClient 사용처는 TestClient 를 클라이언트로 직접 쓰므로 그대로 둔다. 검증 - 현재 venv(httpx2 없음): testRemote.py 10 passed. - `uv run --with openai==3.6.0` 오버레이(httpx2 설치 확인): 10 passed. - 음성 대조: 수정 전 파일을 같은 오버레이에서 돌리면 CI 와 같은 AssertionError 로 1 failed. - openai 3.6.0 격리 환경에서 dartlab 이 쓰는 표면(OpenAI(api_key, base_url), chat.completions.create / responses.create 인자, RateLimitError.response.headers)이 유지됨을 확인했다. 이 커밋이 들어가면 #133 의 유일한 실패가 사라진다.
Owner
|
@dependabot rebase |
Owner
|
@dependabot recreate |
Updates the requirements on [openai](https://github.com/openai/openai-python) to permit the latest version. - [Release notes](https://github.com/openai/openai-python/releases) - [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md) - [Commits](openai/openai-python@v1.0.0...v3.6.0) --- updated-dependencies: - dependency-name: openai dependency-version: 3.6.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>
eddmpython
force-pushed
the
dependabot/pip/openai-gte-1.0.0-and-lt-4
branch
from
September 22, 2026 08:31
13c56fe to
47a3ff9
Compare
eddmpython
added a commit
that referenced
this pull request
Sep 22, 2026
증상 - Dependabot PR #132(mcp 상한 <2.0.1 -> <2.2.1)와 #133(openai 상한 <3 -> <4)은 pyproject.toml 만 바꿨다. master 에서 `uv lock --check` 가 "The lockfile at uv.lock needs to be updated" 로 실패했다. `uv sync --locked` 가 거부되고, 잠금 없이 `uv sync` 하는 곳에서는 lock 이 매번 다시 쓰인다. 변경 - uv.lock 의 프로젝트 requires-dist 두 줄만 pyproject 범위로 바꿨다(mcp <2.2.1, openai <4). 잠긴 패키지 버전은 새 범위를 그대로 만족하므로 바뀌지 않는다(mcp 1.28.1, openai 2.38.0 유지). - `uv lock` 로 다시 쓰면 로컬 uv 0.8.22 가 전이 의존성 수십 줄에 sys_platform 마커를 덧붙였다. 기존 lock 은 더 새 uv 가 만든 형식이라, 그대로 올리면 다음 Dependabot lock 갱신과 오가며 흔들린다. 그래서 범위 두 줄만 고친 최소 변경을 택했다. 검증 - 최소 변경 뒤 `uv lock --check` exit 0 (수정 전 exit 1). - 상한 완화 자체는 각 PR 의 CI 가 신선 해석으로 검증했다(#133 test-fast: openai 3.17.0 + httpx2 2.13.0 에서 7979 passed).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rebasing might not happen immediately, so don't worry if this takes some time.
Note: if you make any changes to this PR yourself, they will take precedence over the rebase.
Updates the requirements on openai to permit the latest version.
Release notes
Sourced from openai's releases.
Changelog
Sourced from openai's changelog.
... (truncated)
Commits
1cfa80arelease: 3.6.0 (#3752)9917c6echore(deps-dev): bump pyright from 1.1.399 to 1.1.413 (#3744)0b52c9echore(deps-dev): bump mypy from 1.17 to 2.3.1 (#3747)4f5598cchore(deps-dev): bump@stdy/clifrom 0.22.1 to 0.22.2 (#3719)95f0b43chore(deps-dev): bump pandas-stubs from 2.2.2.240807 to 2.3.3.260113 (#3659)a36010dchore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.7 (#3745)7a5484dchore(deps-dev): bump rich from 14.2.0 to 15.0.0 (#3717)d0a2550chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 (#3665)dacbb66build(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2 (#3666)d765db7build(deps): bump actions/setup-python from 5.6.0 to 7.0.0 (#3672)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)