Skip to content

F19: upstream Python pins (fastapi 0.162, starlette 1.10, transformers 5.22, openai 3.41) - #222

Merged
jtn0123 merged 5 commits into
nextfrom
section/py-deps
Nov 3, 2026
Merged

jtn0123 merged 5 commits into
nextfrom
section/py-deps

Conversation

@jtn0123

@jtn0123 jtn0123 commented Nov 3, 2026

Copy link
Copy Markdown
Owner

Ports upstream's next four Python pin bumps (F19), one commit each, cherry-picked with -x. Each commit regenerates both hash-locked runtime locks with fork/scripts/runtime_lock.py --update, the same way F16 did. Only the named package changes in each lock.

Package From To Upstream
fastapi 0.159.1 0.162.0 blakeblackshear#24858
starlette 1.9.0 1.10.0 blakeblackshear#24855
transformers 5.21.1 5.22.1 blakeblackshear#24856
openai 3.36.1 3.41.0 blakeblackshear#24857

Conflicts. The fastapi and starlette picks conflicted only on neighboring lines, where upstream has uvicorn 0.54 and a looser aiohttp pin. next keeps its own uvicorn 0.52 and aiohttp 3.14.4.

Breaking changes checked. I read each changelog. None of them needed a code change:

  • FastAPI 0.160 applies a parameter model's extra setting to every field in the same location. FastAPI 0.162 no longer infers False for omitted boolean form fields. No Frigate query model sets extra="forbid", and no endpoint takes Form fields.
  • Starlette 1.10 deprecates FormMessage, compares QueryParams in order, strips one pair of quotes in Config values, and changes how some middleware handles missing headers. Frigate uses none of FormMessage, Config or QueryParams comparisons.
  • transformers 5.21 lists breaking changes for tensor and expert parallel plans, which Frigate does not use. It also composites PNG transparency onto white, but the CLIP image processor only receives RGB frames here.
  • openai 3.37's breaking change only touches the Decisions and Live types. 3.38 changes the text of API status errors. Frigate only logs that text and never matches on it.
  • The OpenAPI spec check passes, so docs/static/frigate-api.yaml is unchanged.

Tests (Colima, fork/Dockerfile.test)

  • The test image builds and installs the full hash-locked runtime lock with the new pins (fastapi 0.162.0, starlette 1.10.0, openai 3.41.0, transformers 5.22.1).
  • Smoke test in that image: the pinned jina-clip-v1 (BERT) and jina-clip-v2 (XLM-R) tokenizers load and tokenize, and CLIPImageProcessorPil loads and gives (1, 3, 224, 224) float32.
  • fork/scripts/py-checks.sh, first run: mypy passed (696 files), the API spec check passed, and the fork test roots passed. The frigate suite ran 5386 tests with 1 failure, test_concurrent_duplicate_deletion_cleans_up_once. It got 409 instead of 404 because the config FileLock hit its 5 s timeout. That run happened while the VM disk was at about 98% I/O pressure from a boot-time fstrim. The test calls delete_camera directly, so none of the bumped libraries are involved.
  • That test class then passed 3 times in a row. In make check-fast, the Docker python lane (mypy, API spec check, the full unit suite) passed in a second full run.
  • make check-fast: lint, typecheck, ratchet, vitest, i18n, ruff, mypy_fork, gitleaks, scripts and python all passed. Build and e2e were not run because there are no web changes.

🤖 Generated with Claude Code

dependabot Bot and others added 5 commits November 2, 2026 19:53
…r/main (blakeblackshear#24858)

Bump fastapi to 0.162 in requirements-wheels.txt and regenerate both
runtime locks with runtime_lock.py --update (fastapi 0.159.1 to 0.162.0,
nothing else moves). The conflict was upstream's uvicorn 0.54 on the
next line; next keeps its own uvicorn 0.52 pin.

FastAPI 0.160 applies a parameter model's extra config to every field in
the same location and 0.162 stops inferring False for omitted boolean
form fields. No Frigate query model sets extra="forbid" and no endpoint
takes Form fields, so neither changes behavior here.

(cherry picked from commit 2a1d36f)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…/main (blakeblackshear#24855)

Bump starlette to 1.10 in requirements-wheels.txt and regenerate both
runtime locks with runtime_lock.py --update (starlette 1.9.0 to 1.10.0,
nothing else moves). The conflict was upstream's looser aiohttp pin on
the line above; next keeps aiohttp 3.14.4.

Starlette 1.10 deprecates FormMessage, makes QueryParams order-sensitive
for equality, strips only one pair of quotes in Config values and lets
BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware default omitted
response-start headers. Frigate uses none of FormMessage, Config or
QueryParams comparisons, so no code changes.

(cherry picked from commit 170a992)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…#24856)

Bump transformers from 5.21 to 5.22 in requirements-wheels.txt and
regenerate both runtime locks with runtime_lock.py --update
(transformers 5.21.1 to 5.22.1; tokenizers and huggingface-hub stay).

5.21's breaking items are tensor and expert parallel plans, which
Frigate does not use, and the shared RGB conversion now compositing
PNG transparency onto white. Frigate hands the CLIP image processor
decoded RGB frames, so that path never sees an alpha channel. 5.22 has
no breaking change for AutoTokenizer or the image processors.

(cherry picked from commit dd97f48)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ain (blakeblackshear#24857)

Bump openai to 3.41 in requirements-wheels.txt and regenerate both
runtime locks with runtime_lock.py --update (openai 3.36.1 to 3.41.0,
nothing else moves).

3.37's breaking change is limited to the Decisions and Live types,
which Frigate does not use. 3.38 builds the text of API status errors
from the server's message; Frigate only logs that text and never
matches on it. Chat completions, streaming, embeddings, transcription
and the OpenAI and AzureOpenAI clients are unchanged.

(cherry picked from commit 91bf509)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Nov 3, 2026

Copy link
Copy Markdown

Important

  • Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: f6141050-b8fe-4f7e-9290-7a2896073724
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

CodeRabbit Verify

  • Run CodeRabbit Verify to test the changes in this pull request.

@sonarqubecloud

sonarqubecloud Bot commented Nov 3, 2026

Copy link
Copy Markdown

@jtn0123
jtn0123 merged commit 8ab42ad into next Nov 3, 2026
18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant