Chore(deps): update openai requirement from <3,>=2.38.0 to >=2.41.0,<3 - #1914
Conversation
Updates the requirements on [openai](https://github.com/openai/openai-python) to permit the latest version. - [Release notes](https://github.com/openai/openai-python/releases) - [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md) - [Commits](openai/openai-python@v2.38.0...v2.41.0) --- updated-dependencies: - dependency-name: openai dependency-version: 2.41.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Code ReviewOverviewThis is a Dependabot-generated dependency bump for the Changes Between 2.38.0 and 2.41.0
All changes are additive — no breaking changes are listed in any of the three release changelogs. AssessmentRisk: Low
No issues found. Safe to merge. Minor NoteThe inline comment in |
aiohttp 3.14.0 removed aiohttp.streams.AsyncStreamReaderMixin, which vcrpy==8.1.1's aiohttp stub imports at module load. A fresh CI install picked up 3.14.0 and every pytest collection aborted with AttributeError. Pin below 3.14 until vcrpy supports the new aiohttp API.
…-gte-2.41.0-and-lt-3
Code ReviewOverviewThis PR bundles two distinct changes:
What looks good
Concerns1. Rebasing will silently drop the aiohttp fix
Recommendation: merge this quickly as-is, or cherry-pick the aiohttp cap + fragment to 2.
|
|
@dependabot rebase |
|
Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry! If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request |
aiohttp is an unpinned transitive dep (via llama-index-core); Open-Source-Legal#1914 capped it <3.14 because aiohttp 3.14 removed aiohttp.streams.AsyncStreamReaderMixin, which vcrpy 8.1.1's aiohttp stub (vcr/stubs/aiohttp_stubs.py) subclasses when vcrpy lazily loads it on cassette entry — making every VCR-using test raise AttributeError. vcrpy 8.1.1 is the latest release and has no fix released yet (kevin1024/vcrpy#995; unreleased PR Open-Source-Legal#996), so the issue's "bump vcrpy" step is not yet possible. Since this codebase only records/replays httpx (LLM) cassettes, the aiohttp MockStream is never instantiated. Add a small, idempotent import-time shim, ensure_aiohttp_vcr_compat(), that restores the removed symbol as an empty mixin so cassette entry works under aiohttp >=3.14; it is a no-op under aiohttp <3.14 (the real mixin is left untouched). The shim is applied from the root conftest.py (before any test runs) and from maybe_vcr_cassette() (for the non-pytest E2E harness). Remove the cap so aiohttp floats back to 3.14+. Verified against aiohttp 3.14.0 + vcrpy 8.1.1 (bug reproduced without the shim; cassette entry succeeds with it) and aiohttp 3.13.5 (no-op path). Drop the shim and bump vcrpy once a release ships the vcrpy#996 fix. Closes Open-Source-Legal#1920
aiohttp 3.14 removed `aiohttp.streams.AsyncStreamReaderMixin`, which vcrpy 8.1.1's `vcr/stubs/aiohttp_stubs.py` subclassed at import time. vcrpy loads that stub lazily when a cassette is entered, so every VCR cassette entry raised AttributeError (issue #1920). The workaround was `ensure_aiohttp_vcr_compat()`, which re-injected the removed name as an empty class. vcrpy 8.2.0 fixed the stub upstream (kevin1024/vcrpy#996): `MockStream` now inherits only from `asyncio.StreamReader` and handles the 3.14 `stream_writer` argument itself. The pin has been at 8.2.1 or later since then, so the shim has been redundant — and not merely inert. Under aiohttp 3.14 the `hasattr` guard fell through, so conftest import was still writing a fake `AsyncStreamReaderMixin` into the real `aiohttp.streams` namespace on every test run. Verified in two environments, in both cases entering a cassette with no shim applied and confirming `MockStream.__bases__ == (asyncio.StreamReader,)`: - the local django image: vcrpy 8.2.1 + aiohttp 3.14.1 (the exact pre-bump pairing the issue asks about) - a clean venv: vcrpy 8.3.0 + aiohttp 3.14.1 (the current pin) Removed: - `ensure_aiohttp_vcr_compat()` in `opencontractserver/utils/vcr_replay.py` and its call in `maybe_vcr_cassette()` - the import and module-level call in `conftest.py` - `EnsureAiohttpVcrCompatTests` in `opencontractserver/tests/test_vcr_replay.py` - the `requirements/local.txt` comment, which still described vcrpy 8.1.1 as the pinned version and #996 as unreleased; replaced with a short note on why the floor is 8.2.0 The `aiohttp>=3.13,<3.14` cap this was paired with (issue #1914) was already lifted on main. `EnsureAiohttpVcrCompatTests` is replaced by `VcrCassetteEntryTests`, which keeps the part of the guard that survives the shim: entering a cassette forces the lazy import of `vcr/stubs/aiohttp_stubs.py`, so the test fails if a future vcrpy/aiohttp pairing reintroduces an import-time incompatibility. 72 tests pass across `test_vcr_replay.py`, `test_structured_response_simple.py`, `test_structured_response_api.py`, and `test_individual_extract_tasks.py`.
1 participant
Updates the requirements on openai to permit the latest version.
Release notes
Sourced from openai's releases.
Changelog
Sourced from openai's changelog.
... (truncated)
Commits
2d955a1Merge pull request #3359 from openai/release-please--branches--main--changes-...519cd02release: 2.41.087e46c2feat(api): responses.moderation and chat_completions.moderationa28a3f6Merge pull request #3352 from openai/release-please--branches--main--changes-...db6ccafUpdate CHANGELOG.md2264f70release: 2.40.04d5bfdefix(api): allow setting bedrock api keys on the client directlyccef143Merge pull request #3326 from openai/codex/bedrock-responses-reviewa50ff0aFix Bedrock with_options overridesfdf4901codegen metadataDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)