chore(deps-dev): bump pdoc from 15.0.4 to 16.0.0

[dependabot]

Bumps pdoc from 15.0.4 to 16.0.0.

Changelog

Sourced from pdoc's changelog.

2025-10-27: pdoc 16.0.0

• pdoc has a new logo. 🐍 (#838, @​mhils)
• Add support for Python 3.14. (#843, @​mhils)
• Drop support for Python 3.9, which as reached end of life. (#842, @​mhils)
• Fix linking of identifiers that contain unicode characters. (#831, @​iFreilicht)
• Replace vendored version of markdown2 with the official upstream
• Add support for keyword args for Google flavor docs. (#840, @​aleksslitvinovs)
• Add support for Pydantic-style field docstrings, e.g. pydantic.Field(description="...") (#802, @​jinnovation)

Commits

• 6677d73 pdoc 16.0.0
• 3f75834 Support Pydantic model defaults + field descriptions (#802)
• f19fbf7 Add support for Python 3.14 (#843)
• 8aa648f Bump mhils/workflows in the dependencies group (#844)
• b782455 Add support for keyword args for Google flavor docs (#840)
• 34c7759 Drop Support for Python 3.9 (#842)
• 0f27371 fix: remove hard-coded pdoc mention from title in template (#841)
• a12c236 Add new pdoc logo (#838)
• 0f308ab Bump mhils/workflows in the dependencies group (#837)
• 7c880c5 Replace vendored markdown2 w/ official upstream (#836)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Disclaimer: Experimental PR review

Greptile Summary

This PR bumps the pdoc documentation tool from 15.0.4 to 16.0.0 in the docs dependency group. The version constraint in pyproject.toml is widened from <16 to <17, and the lock file is updated accordingly.

Key changes introduced by pdoc 16.0.0 relevant to this project:

• New explicit dependency: markdown2 2.5.5 is now a declared dependency (it was previously vendored inside pdoc; pdoc 16 switched to the official upstream markdown2 package).
• Python 3.9 dropped: pdoc 16 drops Python 3.9 support, which is not a concern here since langfuse already requires Python >=3.10.
• Python 3.14 support added, along with unicode identifier linking fixes, Pydantic field docstring support, and Google-flavor keyword-args support.

Since pdoc is a dev-only tool used exclusively for documentation generation, this bump carries negligible runtime risk for the library itself.

Confidence Score: 5/5

Safe to merge — affects only the docs toolchain, no runtime or test dependencies are changed.

This is a dev-only dependency bump confined to the docs group. The project's minimum Python requirement (3.10) is already higher than what pdoc 16 requires (3.10+), so the Python 3.9 drop is a non-issue. The sole substantive lock-file change is adding markdown2 2.5.5 as an explicit dependency (previously vendored). No production code, tests, or public API are affected.

No files require special attention.

Important Files Changed

Filename	Overview
pyproject.toml	Upper version bound for the docs optional dependency pdoc widened from <16 to <17, allowing pdoc 16.x.
uv.lock	Lock file updated to pin pdoc 16.0.0 and its new explicit dependency markdown2 2.5.5 (previously vendored inside pdoc, now a standalone upstream package).

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[pyproject.toml\ndocs group] -->|pdoc >=15.0.4,<17| B[pdoc 16.0.0]
    B --> C[jinja2]
    B --> D[markdown2 2.5.5\nnew explicit dep]
    B --> E[markupsafe]
    B --> F[pygments]
    note1["pdoc 15.x vendored markdown2 internally\npdoc 16.x uses the official upstream package"]
    D -.->|replaces| note1

Loading

_{Reviews (1): Last reviewed commit: "chore(deps-dev): bump pdoc from 15.0.4 t..." | Re-trigger Greptile}

[claude]

LGTM — straightforward Dependabot dev-dependency bump with no production impact.

Extended reasoning...

Overview

This PR bumps pdoc from 15.0.4 to 16.0.0 in two files: the version constraint in pyproject.toml (docs extra) and the pinned entry in uv.lock. pdoc is a docs-generation tool listed only under the docs dependency group — it is not a runtime or test dependency.

Security Risks

None. pdoc is a documentation-generation utility with no role in authentication, data handling, or production execution paths.

Level of Scrutiny

Low. This is a standard automated Dependabot bump for a dev-only tool. The lock file correctly pins pdoc 16.0.0 and adds the new markdown2 transitive dependency. The only concern (flagged as a nit in an inline comment) is that the lower bound in pyproject.toml was not tightened to >=16.0.0 — standard Dependabot behavior. Since this affects only the docs extra and no uv-based workflow bypasses the lock file, the practical impact is negligible.

Other Factors

No prior reviews on this PR. The change is mechanical, self-contained, and follows the established pattern for Dependabot PRs in this repo.

[claude]

🟡 The pdoc version constraint was updated to >=15.0.4,<17 but the lower bound was not updated to >=16.0.0, meaning environments that install without the lock file (e.g., pip install langfuse[docs]) could resolve to pdoc 15.x instead of the intended 16.x. Consider changing the constraint to pdoc>=16.0.0,<17 to match the PR's intent.

Extended reasoning...

What the bug is: The PR bumps pdoc from 15.0.4 to 16.0.0, and correctly updates the lock file to pin pdoc 16.0.0. However, the version constraint in pyproject.toml was changed from >=15.0.4,<16 to >=15.0.4,<17 — only widening the upper bound — rather than >=16.0.0,<17. This means the lower bound still allows any pdoc 15.x release to satisfy the constraint.

The specific code path: In pyproject.toml line 38, the docs extra dependency is declared as pdoc>=15.0.4,<17. A resolver that sees this constraint (without the lock file) is free to choose pdoc 15.0.4 as a valid solution.

Why existing code doesn't prevent it: The uv.lock file pins pdoc to exactly 16.0.0, so any uv sync or uv run invocation respects the lock and gets 16.0.0. However, anyone running pip install "langfuse[docs]" (a common workflow for users installing the docs extra manually, or in CI pipelines not using uv) bypasses the lock file entirely and relies solely on the pyproject.toml constraint. With >=15.0.4,<17, pip could resolve to 15.x.

Impact: pdoc 16.0.0 is a major version release with meaningful changes: it adds markdown2 as a new dependency, drops Python 3.9 support, and changes templating behavior. Running with pdoc 15.x versus 16.x would produce different documentation output and could silently fail to include markdown2. That said, this is a docs-only dev dependency, so production users are entirely unaffected.

How to fix it: Change line 38 in pyproject.toml from pdoc>=15.0.4,<17 to pdoc>=16.0.0,<17.

Step-by-step proof:

1. A user runs pip install "langfuse[docs]" (not using uv, no lock file honored).
2. pip sees the constraint pdoc>=15.0.4,<17.
3. pip resolves the latest compatible version — normally 16.0.0 — but if 16.0.0 is yanked or if the user has a conflicting constraint pinning an older version, pip could legitimately choose any pdoc 15.x release (e.g., 15.0.4).
4. The installed pdoc 15.x lacks the markdown2 dependency and has different rendering behavior compared to 16.x.
5. The developer or CI system gets unexpected documentation output without any error indicating the wrong version is installed.

Addressing the refutation: The refutation correctly notes this is standard Dependabot behavior — Dependabot typically only widens the upper bound. However, "standard Dependabot behavior" and "correct constraint" are different things. The constraint >=15.0.4,<17 is technically imprecise for a PR whose stated goal is to adopt pdoc 16.0.0. This is a nit rather than a blocking issue because the lock file protects most real workflows, but tightening the lower bound is a small, low-risk improvement worth noting.