chore(deps): bump openai from 2.54.0 to 3.6.0 - #1516
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
Bumps [openai](https://github.com/openai/openai-python) from 2.54.0 to 3.6.0. - [Release notes](https://github.com/openai/openai-python/releases) - [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md) - [Commits](openai/openai-python@v2.54.0...v3.6.0) --- updated-dependencies: - dependency-name: openai dependency-version: 3.5.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
3cba9dd to
0f67a80
Compare
|
Triage: confirmed this bump is not currently mergeable-safe; not pushing a code change. Devin's review (thread on
So There isn't a safe, honest fix I can push here that keeps this PR's intent (bumping to 3.6.0): the only way to make it resolve is either (a) also bumping Recommendation: hold/close this PR until Generated by Claude Code |
built and CI-green, genuinely unreachable pending the sandbox Corrected an initial wrong instinct first: naruon's own "noema_agent.py" looked like a DDD naming collision with the CI review agent's Noema, but docs/CWL-MASTER-CONTEXT.md explicitly defines Noema as one shared agent runtime across three consumers (CI review agent, naruon's do-anything agent, wardnet's AI SOC quarantine sandbox) -- owner-confirmed per naruon#1527. Checked the master context before concluding two same-named components were separate, per this session's own established lesson from an earlier mistake of exactly that kind. Found: naruon already has a real, tested, CI-green agent + plugin- registry system (services/noema_agent.py, services/agent_registry.py, four open PRs #1527/#1486/#1516/#1537, none authored by either active peer session) matching the platform plan's own documented registry architecture almost exactly. The confirmed gap: nothing in the API or frontend layer ever calls it -- the agent, registry, and manifests are mutually consistent and fully tested but completely unreachable, and have been since the agent's original commit two months ago. This connects directly to item 6: the master context has this agent running inside quarantine-sandbox-runtime, which a peer session is separately, actively building (still early-stage, confirmed via direct coordination) -- wiring the agent to a real trigger before that sandbox exists would ship an unsandboxed, writeback-capable LLM agent against the documented design, not merely ship an incomplete feature. Not implemented this tick pending that dependency. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
![cwl-noema-review[bot]](https://avatars.githubusercontent.com/u/295022177?s=60&v=4){kind=small}
There was a problem hiding this comment.
Noema LLM review
Bumping openai from 2.54.0 to 3.6.0 in requirements-strix-ci-hashes.txt breaks Strix CI. openai 3.6.0 requires httpx2, which is not present in the locked dependencies, and both Strix dependencies (litellm and openai-agents) constrain openai to <3. This causes every Strix invocation to fail at startup. Revert to openai 2.54.0 or update all dependent packages and regenerate the lock file.
Reviewed changed lines
requirements-strix-ci-hashes.txt:1384 (RIGHT): openai==3.6.0 on the right side is incompatible with the existing lock file. Upstream dependencies litellm and openai-agents require openai <3, and openai 3.6.0 introduces a dependency on httpx2, which is absent from the locked requirements. This will cause Strix CI startup failures.requirements-strix-ci-hashes.txt:1385 (RIGHT): The new hash for openai 3.6.0 cannot resolve the missing httpx2 dependency or satisfy the <3 constraints from litellm and openai-agents. The lock file is not internally consistent.requirements-strix-ci-hashes.txt:1386 (RIGHT): The second hash for openai 3.6.0 also corresponds to the incompatible version. Dependency resolution will fail when Strix tries to install or import openai, resulting in broken CI scans.
Adversarial validation
requirements-strix-ci-hashes.txt:1384 (RIGHT)confirmed: If openai is bumped to 3.6.0, all dependent packages will resolve cleanly and Strix will start successfully. — openai 3.6.0 requires httpx2, which is absent from requirements-strix-ci-hashes.txt; litellm and openai-agents both constrain openai to <3. The lock file lacks the necessary transitive dependency and violates the upstream version bounds, so resolution and startup fail.requirements-strix-ci-hashes.txt:1385 (RIGHT)confirmed: The lock file can be installed successfully by pip or uv with the updated openai pin. — The missing httpx2 requirement and the openai<3 constraints from litellm/openai-agents make the lock file unsatisfiable. Installation and every Strix invocation fail during startup.- Residual risk: The primary confirmed risk is that the dependency set is inconsistent: openai 3.6.0 pulls httpx2 while the existing lock file has no httpx2 entry, and both Strix dependencies pin openai below 3. Residual risk remains only if the repository unexpectedly uses a different resolution path, but no such evidence exists in this PR.
Findings
- [high] requirements-strix-ci-hashes.txt:1384 (RIGHT): The change updates openai to 3.6.0 (lines 1384-1386). This version is incompatible with the existing dependency set: it requires httpx2, which is not present in the locked requirements, and the upstream dependencies litellm and openai-agents both constrain openai to <3. All Strix CI invocations will fail at startup. Revert to openai 2.54.0 or update all dependent packages and regenerate the lock file to resolve the dependency conflict.
- Result: REQUEST_CHANGES
- Head SHA:
61cbea44a3b77150e892ac52d67090d794e41b9d - Reviewer credential:
noema-review-github-app-refresh - Actor:
cwl-noema-review[bot]
1 participant
Bumps openai from 2.54.0 to 3.6.0.
Release notes
Sourced from openai's releases.
... (truncated)
Changelog
Sourced from openai's changelog.
... (truncated)
Commits
1cfa80arelease: 3.6.0 (#3752)9917c6echore(deps-dev): bump pyright from 1.1.399 to 1.1.413 (#3744)0b52c9echore(deps-dev): bump mypy from 1.17 to 2.3.1 (#3747)4f5598cchore(deps-dev): bump@stdy/clifrom 0.22.1 to 0.22.2 (#3719)95f0b43chore(deps-dev): bump pandas-stubs from 2.2.2.240807 to 2.3.3.260113 (#3659)a36010dchore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.7 (#3745)7a5484dchore(deps-dev): bump rich from 14.2.0 to 15.0.0 (#3717)d0a2550chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 (#3665)dacbb66build(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2 (#3666)d765db7build(deps): bump actions/setup-python from 5.6.0 to 7.0.0 (#3672)