Skip to content

Chore(deps): update openai requirement from <3,>=2.38.0 to >=2.41.0,<3 #1914

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JSv4 merged 4 commits into from
Jun 4, 2026
Merged

Chore(deps): update openai requirement from <3,>=2.38.0 to >=2.41.0,<3 #1914

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
550b1c2
Chore(deps): update openai requirement from <3,>=2.38.0 to >=2.41.0,<3
dependabot[bot] Jun 4, 2026
7948dcd
Cap aiohttp <3.14 to keep vcrpy 8.1.1 aiohttp stub importable
JSv4 Jun 4, 2026
ee50bdb
Merge remote-tracking branch 'origin/main' into dependabot/pip/openai…
JSv4 Jun 4, 2026
12227ea
Add changelog fragment for aiohttp cap
JSv4 Jun 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog.d/1914-aiohttp.fixed.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
- Pinned `aiohttp>=3.13,<3.14` in `requirements/base.txt`. aiohttp 3.14.0 removed `aiohttp.streams.AsyncStreamReaderMixin`, which the pinned `vcrpy==8.1.1` aiohttp stub imports at module load — a fresh dependency resolution in CI picked up 3.14.0 and aborted the entire pytest collection with `AttributeError`. The cap should be lifted alongside a `vcrpy` bump that supports the aiohttp 3.14 stream API.
3 changes: 2 additions & 1 deletion requirements/base.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ typing-extensions==4.* # https://github.com/python/typing_extensions
requests>=2.34.2,<3 # https://requests.readthedocs.io/en/latest/
httpx>=0.28.1,<1 # https://github.com/encode/httpx - async HTTP for agent tools
brotli>=1.2.0 # decoder for httpx Content-Encoding: br responses (e.g. OpenAI API, VCR cassettes). Floor raised to 1.2.0 to pick up the upstream security fix that bounds decompressor output via Decompressor.output_buffer_limit, preventing memory exhaustion from crafted br-encoded payloads.
aiohttp>=3.13,<3.14 # transitive via llama-index-core; cap below 3.14 because aiohttp 3.14.0 removed aiohttp.streams.AsyncStreamReaderMixin, which the pinned vcrpy==8.1.1 aiohttp stub imports at module load (AttributeError on import → whole pytest suite fails). Lift this cap together with a vcrpy bump that supports aiohttp 3.14+.


# Django
Expand Down Expand Up @@ -41,7 +42,7 @@ drf-extra-fields==3.7.0 # https://github.com/Hipo/drf-extra-fields
pypdf>=6.12.2,<7 # https://github.com/py-pdf/pypdf
plasmapdf==0.1.3 # https://github.com/Jsv4/plasmapdf
pdf2image>=1.17.0
openai>=2.38.0,<3 # https://github.com/openai/openai-python (pydantic-ai 1.x requires >=2.11.0)
openai>=2.41.0,<3 # https://github.com/openai/openai-python (pydantic-ai 1.x requires >=2.11.0)
# Bumping pydantic-ai is a deliberate decision: this codebase relies on the
# precedence rule that ``instructions=`` (not ``system_prompt=``) is the only
# way to deliver a system instruction when ``message_history`` is non-empty
Expand Down