Commit graph

5 commits

Author SHA1 Message Date
fusion44
65588d6c7c
chore(deps): bump dependencies with known security vulnerabilities
Direct dependencies:
- fastapi 0.128.0 -> 0.139.0 (needed for starlette 1.x support)
- starlette 0.49.1 -> 1.3.1
- pyjwt 2.10.1 -> 2.13.0
- aiohttp 3.13.3 -> 3.14.1
- deepdiff 8.6.1 -> 9.1.0
- requests 2.32.5 -> 2.33.0

Transitive dependencies:
- urllib3 2.6.3 -> 2.7.0
- idna 3.11 -> 3.18
- python-multipart 0.0.22 -> 0.0.32

Dev dependencies:
- pytest 9.0.2 -> 9.0.3

The update-requirements-file make target now passes --upgrade to
uv pip compile; without it, stale (vulnerable) pins from the existing
requirements.txt are silently preserved.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 17:46:36 +02:00
fusion44
c9f27c3f47
chore(nix): migrate flake from poetry2nix to uv2nix
The project switched from poetry to uv in 44385ca, but the flake still
built everything through poetry2nix (an undeclared input resolved via
the flake registry) and no longer evaluated against the uv-based
pyproject.toml.

- build packages.blitz-api as a uv2nix virtualenv from uv.lock
  (wheels preferred), keeping the bin/api entry point the NixOS
  module expects
- replace the poetry dev shell with a uv-based tooling shell that
  mirrors devenv.nix
- move click to the main dependencies: the api console script
  imports it at runtime, so a production install without the dev
  group would crash on startup
- update the nixpkgs pin so the dev shell ships a uv that
  understands the current lockfile revision

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 16:00:42 +02:00
fusion44
e0f4d7e2fc
fix(deps): ensure async-timeout is included for older Python 3.11
- Add async-timeout as a direct dependency in pyproject.toml to fix
  ModuleNotFoundError on systems with Python < 3.11.3 (e.g. Raspberry Pi).
- Switch to universal requirements generation in Makefile and
  requirements.txt to include platform-specific markers and conditional
  dependencies.
- Update uv.lock to reflect dependency changes.

This resolves a crash where redis-py attempted to import async_timeout,
which was missing because it was pruned during requirements generation
on a newer Python version.
2026-02-21 08:04:34 +01:00
fusion44
07d2bfbc76
feat: update Python and Devenv deps
- Updated all dependencies to their latest versions
- Vendored fastapi-plugins[redis] as it looks unmaintained
2026-02-03 11:04:41 +01:00
fusion44
44385ca40c
chore: deprecate poetry for uv; update dependencies 2025-11-10 12:30:03 +01:00