Skip to content

chore(deps-dev): update pytest-asyncio requirement from <2,>=1.3.0 to >=1.4.0,<2#92

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pytest-asyncio-gte-1.4.0-and-lt-2
Closed

chore(deps-dev): update pytest-asyncio requirement from <2,>=1.3.0 to >=1.4.0,<2#92
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pytest-asyncio-gte-1.4.0-and-lt-2

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 28, 2026

Updates the requirements on pytest-asyncio to permit the latest version.

Release notes

Sourced from pytest-asyncio's releases.

pytest-asyncio v1.4.0

1.4.0 - 2026-05-26

Deprecated

  • Overriding the event_loop_policy fixture is deprecated. Use the pytest_asyncio_loop_factories hook instead. (#1419)

Added

  • Added the pytest_asyncio_loop_factories hook to parametrize asyncio tests with custom event loop factories.

    The hook returns a mapping of factory names to loop factories, and pytest.mark.asyncio(loop_factories=[...]) selects a subset of configured factories per test. When a single factory is configured, test names are unchanged.

    Synchronous @pytest_asyncio.fixture functions now see the correct event loop when custom loop factories are configured, even when test code disrupts the current event loop (e.g., via asyncio.run() or asyncio.set_event_loop(None)). (#1164)

Changed

  • Improved the readability of the warning message that is displayed when asyncio_default_fixture_loop_scope is unset (#1298)
  • Only import asyncio.AbstractEventLoopPolicy for type checking to avoid raising a DeprecationWarning. (#1394)
  • Updated minimum supported pytest version to v8.4.0. (#1397)

Fixed

  • Fixed a ResourceWarning: unclosed event loop warning that could occur when a synchronous test called asyncio.run() or otherwise unset the current event loop after pytest-asyncio had run an async test or fixture. (#724)

Notes for Downstream Packagers

  • Added dependency on sphinx-tabs >= 3.5 to organize documentation examples into tabs. (#1395)
Commits
  • 6e14cd2 chore: Prepare release of v1.4.0.
  • 4b900fb Build(deps): Bump codecov/codecov-action from 6.0.0 to 6.0.1
  • ab9f632 Build(deps): Bump zipp from 3.23.1 to 4.1.0
  • a56fc77 Build(deps): Bump hypothesis from 6.152.6 to 6.152.8
  • e8bae9b Build(deps): Bump requests from 2.34.0 to 2.34.2
  • fc43340 Build(deps): Bump idna from 3.14 to 3.15
  • 762eaf5 Build(deps): Bump jaraco-functools from 4.4.0 to 4.5.0
  • b62e222 Build(deps): Bump click from 8.3.3 to 8.4.0
  • 9190447 Build(deps): Bump pydantic from 2.13.3 to 2.13.4
  • 82a393c ci: Remove unnecessary debug output.
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Updates the requirements on [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio) to permit the latest version.
- [Release notes](https://github.com/pytest-dev/pytest-asyncio/releases)
- [Commits](pytest-dev/pytest-asyncio@v1.3.0...v1.4.0)

---
updated-dependencies:
- dependency-name: pytest-asyncio
  dependency-version: 1.4.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels May 28, 2026
@bk86a
Copy link
Copy Markdown
Owner

bk86a commented May 28, 2026

Superseded by #94, which bundles this bump together with the other three open Dependabot PRs and regenerates requirements.lock (also pulling starlette to 1.1.0 to clear PYSEC-2026-161 that was failing the CI security gate on this PR). Closing in favour of the bundled release.

@bk86a bk86a closed this May 28, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 28, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot Bot deleted the dependabot/pip/pytest-asyncio-gte-1.4.0-and-lt-2 branch May 28, 2026 09:40
bk86a added a commit that referenced this pull request May 28, 2026
Bundles the four open Dependabot PRs into a single release rather than
landing them one-by-one with four lockfile-update follow-ups:

- fastapi 0.136.1 -> 0.136.3 (#89)
- uvicorn  >=0.47 -> >=0.48   (#91)
- idna     >=3.15 -> >=3.16   (#90)
- pytest-asyncio 1.3.0 -> 1.4.0 (#92, dev)

While regenerating requirements.lock to clear those bumps, the resolver
also pulls starlette from 0.52.1 to 1.1.0 -- this clears PYSEC-2026-161
(fix in 1.0.1), which the CI security gate had started reporting on
every open Dependabot PR. fastapi 0.136.3 declares starlette>=0.46.0
with no upper bound, so the 1.x bump is in-range. Dependabot does not
open PRs for undeclared transitives, hence the direct lockfile bump.

Bumps __version__ to 0.19.3 and folds the [Unreleased] CHANGELOG block
into a dated [0.19.3] release. No app-code or API changes.

Test plan:
- 222/222 pytest pass against the regenerated lockfile
- ruff check app/ clean
- bandit -r app/ -ll clean
- pip-audit -r requirements.lock reports no known vulnerabilities

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant