[spydon]

Summary

• Delete src/functions/uv.lock, the same fix chore: remove stale functions lockfile and upgrade vulnerable dependencies #1914 applied to the v2 line. The file was left over from moving functions-py into the monorepo. src/functions is a uv workspace member, so uv only reads the root uv.lock, but Dependabot still scans this file and reports 66 open alerts against it (pyjwt, virtualenv, setuptools, anyio, certifi and others). The v3 branch never got chore: remove stale functions lockfile and upgrade vulnerable dependencies #1914, so these alerts appeared once v3 became the default branch.
• Upgrade the three packages in the root uv.lock that still had open alerts: pytest 8.4.2 to 9.2.0, python-dotenv 1.1.1 to 1.2.4 and requests 2.32.5 to 2.34.2.
• Allow pytest 9 and pytest-asyncio 1.x in the functions and supabase dev dependencies. Their upper bounds (pytest <9.0.0, pytest-asyncio <1.2.0 and <1.1) blocked the pytest upgrade. pytest-asyncio moves from 1.0.0 to 1.4.1.

Root lockfile

The other open alerts on the root uv.lock are already fixed by #1951, which bumped every affected package to a patched version. They should close when Dependabot next rescans the default branch.

Testing

• uv lock --check passes.
• supabase_functions and supabase tests pass with pytest 9.
• Every package's test suite collects under pytest 9. The infra-backed suites run in CI.

[coderabbitai]

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

• Chores
  • Updated test dependency version ranges to allow newer releases of pytest and pytest-asyncio.

The functions package now permits pytest versions below 10 and pytest-asyncio versions below 2. The supabase package now permits pytest-asyncio versions below 2. The pytest-cov constraint and the existing lower bounds remain unchanged.

Assessment against linked issues

Objective	Addressed	Explanation
Remove the stale functions lockfile, refresh vulnerable dependencies, and update the specified mypy configuration [#1914]	❌	The changes only update test dependency bounds.

Out-of-scope changes

Code Change	Explanation
Broaden pytest and pytest-asyncio bounds (src/functions/pyproject.toml:31-33) and pytest-asyncio bounds (src/supabase/pyproject.toml:57)	These changes do not address the linked issue’s lockfile, vulnerable package, or mypy objectives. The issue also states that pytest remains below 9.

Possibly related PRs

• supabase/supabase-py#1915: Updates test dependency contracts in the same two package configurations.

Change: Other

Merge Risk: Minimal · up to b8402

The broader test-dependency bounds present no identified merge-blocking issue. Merge after normal dependency and test checks pass.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d98fb0f8-de0b-4e68-a583-afdf1b76d3b1

Commits

Reviewing files that changed from the base of the PR and between d781d63 and b840243.

Files ignored due to path filters: 2

• src/functions/uv.lock is excluded by !**/*.lock
• uv.lock is excluded by !**/*.lock

Files selected for processing: 2

• src/functions/pyproject.toml
• src/supabase/pyproject.toml

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.