You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
chore: remove stale functions lockfile and upgrade vulnerable dependencies - #1952
Upgrade the three packages in the root uv.lock that still had open alerts: pytest 8.4.2 to 9.2.0, python-dotenv 1.1.1 to 1.2.4 and requests 2.32.5 to 2.34.2.
Allow pytest 9 and pytest-asyncio 1.x in the functions and supabase dev dependencies. Their upper bounds (pytest <9.0.0, pytest-asyncio <1.2.0 and <1.1) blocked the pytest upgrade. pytest-asyncio moves from 1.0.0 to 1.4.1.
Root lockfile
The other open alerts on the root uv.lock are already fixed by #1951, which bumped every affected package to a patched version. They should close when Dependabot next rescans the default branch.
Testing
uv lock --check passes.
supabase_functions and supabase tests pass with pytest 9.
Every package's test suite collects under pytest 9. The infra-backed suites run in CI.
No actionable comments were generated in the recent review.
Summary
Summary by CodeRabbit
Chores
Updated test dependency version ranges to allow newer releases of pytest and pytest-asyncio.
The functions package now permits pytest versions below 10 and pytest-asyncio versions below 2. The supabase package now permits pytest-asyncio versions below 2. The pytest-cov constraint and the existing lower bounds remain unchanged.
Assessment against linked issues
Objective
Addressed
Explanation
Remove the stale functions lockfile, refresh vulnerable dependencies, and update the specified mypy configuration [#1914]
❌
The changes only update test dependency bounds.
Out-of-scope changes
Code Change
Explanation
Broaden pytest and pytest-asyncio bounds (src/functions/pyproject.toml:31-33) and pytest-asyncio bounds (src/supabase/pyproject.toml:57)
These changes do not address the linked issue’s lockfile, vulnerable package, or mypy objectives. The issue also states that pytest remains below 9.
Possibly related PRs
supabase/supabase-py#1915: Updates test dependency contracts in the same two package configurations.
Change: Other
Merge Risk: Minimal · up to b8402
The broader test-dependency bounds present no identified merge-blocking issue. Merge after normal dependency and test checks pass.
- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Run CodeRabbit Verify to test the changes in this pull request.
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: d98fb0f8-de0b-4e68-a583-afdf1b76d3b1
Commits
Reviewing files that changed from the base of the PR and between d781d63 and b840243.
Files ignored due to path filters: 2
src/functions/uv.lock is excluded by !**/*.lock
uv.lock is excluded by !**/*.lock
Files selected for processing: 2
src/functions/pyproject.toml
src/supabase/pyproject.toml
Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.
spydon
changed the title
chore(functions): remove stale functions lockfile
chore: remove stale functions lockfile and upgrade vulnerable dependencies
Nov 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
spydon
changed the title
Summary
src/functions/uv.lock, the same fix chore: remove stale functions lockfile and upgrade vulnerable dependencies #1914 applied to the v2 line. The file was left over from moving functions-py into the monorepo.src/functionsis a uv workspace member, so uv only reads the rootuv.lock, but Dependabot still scans this file and reports 66 open alerts against it (pyjwt, virtualenv, setuptools, anyio, certifi and others). The v3 branch never got chore: remove stale functions lockfile and upgrade vulnerable dependencies #1914, so these alerts appeared once v3 became the default branch.uv.lockthat still had open alerts: pytest 8.4.2 to 9.2.0, python-dotenv 1.1.1 to 1.2.4 and requests 2.32.5 to 2.34.2.functionsandsupabasedev dependencies. Their upper bounds (pytest <9.0.0,pytest-asyncio <1.2.0and<1.1) blocked the pytest upgrade. pytest-asyncio moves from 1.0.0 to 1.4.1.Root lockfile
The other open alerts on the root
uv.lockare already fixed by #1951, which bumped every affected package to a patched version. They should close when Dependabot next rescans the default branch.Testing
uv lock --checkpasses.supabase_functionsandsupabasetests pass with pytest 9.