[dependabot]

Problem

Dependabot bumped 26 Python packages in requirements.txt but moved only 13 of them in uv.lock. The two files disagreed, so CI failed at the export check and never ran lint, mypy, or tests on the new versions. The dependency-exports repair also failed, because two requested pins cannot resolve.

Change

The repo's own repair logic (scripts/qa/sync_dependency_exports.py) runs with two pins held back. uv.lock now holds the other 24 requested versions. It also keeps opentelemetry-sdk 1.45.2, which Dependabot's lock already moved with opentelemetry-api. requirements.txt is the exact export of the lock.

Package	From	To	Kind
anthropic	2.3.0	2.4.0	minor
growthbook	3.2.2	4.0.0	major, dev group only
pydantic, pydantic-core	2.14.1, 2.50.1	2.14.2, 2.50.2	patch, security fixes
snaptrade-python-sdk	13.0.49	13.0.52	patch
xlsxwriter	3.3.0	3.3.1	patch
mypy, pytest, pandas-stubs, types-pyyaml, types-requests			dev group
opentelemetry-api, opentelemetry-sdk, opentelemetry-semantic-conventions	1.45.1, 1.45.1, 0.66b1	1.45.2, 1.45.2, 0.66b2	patch. opentelemetry-api is also a runtime dependency through anthropic.
anyio, filelock, fonttools, frozendict, narwhals, pip, platformdirs, python-multipart, pytz, tzdata, websockets			patch or minor, transitive
python-dateutil	2.9.0.post0	2.9.0.post0	held, 4.0.0 cannot resolve
watchdog	6.0.0	6.0.0	held, 7.0.0 forces an unrequested streamlit bump

uv lock --no-build --upgrade-package python-dateutil==4.0.0 ...
cause: Because snaptrade-python-sdk==13.0.52 depends on python-dateutil>=2.8.2,<3.0.0 and python-dateutil==4.0.0, ...

streamlit 1.66.1 requires watchdog<7, and 1.67.0 allows watchdog<8. With watchdog 7.0.0 the repair's drift check refuses streamlit 1.66.1 -> 1.67.0.

No source code changed.

Proof

Check	Before (4e80bac)	After (cbf5d71)
uv export ... | diff -u requirements.txt -	fails, 14 packages differ	passes, no diff
dependency-exports repair	fails, python-dateutil 4.0.0 cannot resolve	not needed
uv lock --check, uv sync --locked --dev	not run in CI	pass
ruff format, ruff check, mypy src/	not run in CI	pass, 101 source files
pytest, not integration	not run in CI	1833 passed, 1 skipped, coverage 86.74%
Project verify skills		verify: none.

pydantic 2.14.2 now treats JSON keys that match only an unused alias as extra data. No model in src/ or buy_ticket_agent/ declares an alias, per grep -rn "alias=" src buy_ticket_agent. No code imports growthbook, watchdog, or dateutil.

Review

Finding	Disposition	Reason
python-dateutil 4.0.0 cannot install beside snaptrade-python-sdk 13.0.52	Fix	Held at 2.9.0.post0, as #311 did for 3.0.0.
watchdog 7.0.0 pulls streamlit 1.67.0, which no pin requested	Fix	Held at 6.0.0. The next Dependabot run can propose streamlit 1.67.0 and watchdog 7.0.0 together.
test_typescript_syntax_valid fails in a fresh worktree	Defer #314	Unrelated to these bumps. bun install --frozen-lockfile makes it pass.

Merge danger

Door: two-way. Revert this PR to restore the old lock and export.
Blast radius: medium. Every Python job in the live Finance Guru checkout runs on these versions after it pulls main and syncs, including SnapTrade reads and pydantic models. Offline tests prove those paths, but no live SnapTrade or Claude call ran.

A second model, GPT-6.1 Sol, reviewed commit cbf5d71 before the push and found nothing to fix.

Changes made by Claude Opus 5.5 via Claude Code

[coldtea-pr-lens]

Note

dependabot[bot] opened this pull request, so PR Lens left it undrawn. Comment @pr-lens draw to draw it

_{github.comment.notice: false in .github/pr-lens.yml turns this note off}

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-06T09:38:35.692042Z We couldn’t complete this review. Comment @codex review to try again.	4e80bac	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2b15a02e-d272-4fe9-8912-9ed3a3296dbf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[AojdevStudio]

@pullfrog review

[pullfrog]

✅ No new issues found.

Reviewed changes — Reviewed the dependency updates and synchronization of uv.lock with requirements.txt.

• Runtime dependencies — Updates Anthropic, SnapTrade, Pydantic, and supporting libraries without source changes.
• Development dependencies — Updates GrowthBook, pytest, mypy, type stubs, and telemetry packages.
• Compatible resolution — Retains python-dateutil 2.9.0.post0 and watchdog 6.0.0; lock validation, locked installation, package compatibility, and the exact requirements export all pass.
• Validation — Local Ruff and mypy checks pass; the offline suite reports 1,833 passed, 1 skipped, and 86.74% coverage, including installed-SDK contract tests for Anthropic and SnapTrade. Live provider calls were not exercised.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}