Bump litellm from 1.83.7 to 1.84.0 in /examples/airlift-mwaa-example/dags in the pip group across 1 directory#33995
Conversation
Bumps the pip group with 1 update in the /examples/docs_projects/project_dspy directory: [litellm](https://github.com/BerriAI/litellm). Updates `litellm` from 1.83.7 to 1.84.0 - [Release notes](https://github.com/BerriAI/litellm/releases) - [Commits](https://github.com/BerriAI/litellm/commits/v1.84.0) --- updated-dependencies: - dependency-name: litellm dependency-version: 1.84.0 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>
Greptile SummaryThis dependabot PR bumps
Confidence Score: 3/5The litellm and onnx bumps are safe, but the apache-airflow changes in the MWAA files introduce a dependency conflict and target an Airflow version the MWAA service does not yet support. The MWAA requirements files now require apache-airflow>=3.3.0 while retaining pendulum<3.0.0 — a combination that is unresolvable on Python 3.12+ since Airflow 3.x mandates pendulum 3.x there. The >=3.3.0 floor also exceeds the MWAA service's current maximum of 3.2.1, meaning integration tests targeting real MWAA environments cannot install a matching Airflow version. Both MWAA requirements files — examples/airlift-mwaa-example/dags/requirements.txt and python_modules/libraries/dagster-airlift/dagster_airlift_tests/mwaa_integration_tests/airflow_project/requirements.txt — need the pendulum constraint updated and the Airflow version floor reconsidered.
|
| Filename | Overview |
|---|---|
| examples/airlift-mwaa-example/dags/requirements.txt | apache-airflow jumped from >=2.0.0,<2.8 to >=3.3.0,<3.4 — major version bump with retained pendulum<3.0.0 constraint that conflicts with Airflow 3.x on Python 3.12+; also requires Airflow 3.3.x which exceeds MWAA's max supported version (3.2.1) |
| python_modules/libraries/dagster-airlift/dagster_airlift_tests/mwaa_integration_tests/airflow_project/requirements.txt | Same apache-airflow 2.x to 3.3.x jump and same pendulum<3.0.0 conflict as dags/requirements.txt; integration tests now target a version of Airflow not currently available on MWAA |
| examples/docs_projects/project_dspy/pyproject.toml | litellm pinned from 1.83.7 to 1.84.0; the release includes breaking changes (per PR description) and a security fix for Host Header Injection |
| examples/starlift-demo/pyproject.toml | apache-airflow upper bound widened from <3.0.0 to <4.0.0, allowing Airflow 3.x; intentional but not validated against dagster-airlift Airflow 3.x compatibility |
| examples/docs_snippets/pyproject.toml | apache-airflow minimum raised from >=3.2 to >=3.3.0 for Python 3.12+; minor version floor bump, low risk |
| examples/with_wandb/pyproject.toml | onnx minimum bumped from >=1.21.0 to >=1.22.0; low risk, follows existing comment about cp314 wheels |
Reviews (1): Last reviewed commit: "Bump litellm" | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| apache-airflow>=3.3.0,<3.4 | ||
| flask-session<0.6.0 | ||
| connexion<3.0.0 | ||
| pendulum>=2.0.0,<3.0.0 |
There was a problem hiding this comment.
Apache Airflow 3.x requires pendulum>=3.0.0 when running on Python 3.12+, but this file still pins pendulum>=2.0.0,<3.0.0. On any Python 3.12 environment, pip/uv will refuse to resolve this combination, making the environment uninstallable. Both MWAA files (dags/requirements.txt and airflow_project/requirements.txt) need pendulum>=3.0.0,<4.0.0 (or simply pendulum>=2.0.0,<4.0.0) to be compatible with the new Airflow floor.
| @@ -1,4 +1,4 @@ | |||
| apache-airflow>=2.0.0,<2.8 | |||
| apache-airflow>=3.3.0,<3.4 | |||
There was a problem hiding this comment.
The MWAA service currently supports Apache Airflow up to version 3.2.1. Pinning apache-airflow>=3.3.0,<3.4 in the MWAA integration files means no MWAA environment can satisfy this requirement, so integration tests that provision or target a real MWAA environment will fail at environment-creation time. The same constraint applies to airflow_project/requirements.txt. Consider aligning with the highest MWAA-available version (>=3.2.0,<3.3 or similar) until MWAA adds 3.3.x support.
| "dbt-duckdb", | ||
| "pandas", | ||
| "apache-airflow<3.0.0", | ||
| "apache-airflow<4.0.0", |
There was a problem hiding this comment.
<4.0.0 admits Airflow 3.x without validation
The previous <3.0.0 cap kept Airflow 2.x only. Allowing Airflow 3.x here is a larger behaviour change than a routine version bump: Airflow 3.0 introduced breaking changes (new task execution API, DAG serialisation changes, removed legacy features). If dagster-airlift hasn't been validated against Airflow 3.x in this demo project, CI could pass locally while the demo itself is broken for users installing Airflow 3.x.
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
Bumps the pip group with 1 update in the /examples/docs_projects/project_dspy directory: litellm.
Updates
litellmfrom 1.83.7 to 1.84.0Release notes
Sourced from litellm's releases.
... (truncated)
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.