deps: bump pydantic-core from 2.46.4 to 2.47.0 - #333
Conversation
Bumps [pydantic-core](https://github.com/pydantic/pydantic) from 2.46.4 to 2.47.0. - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](https://github.com/pydantic/pydantic/commits) --- updated-dependencies: - dependency-name: pydantic-core dependency-version: 2.47.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Closing as genuinely unresolvable, not merely unresynced.
Verified against PyPI's own No security advisory affects Follow-up: #416 adds a |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
…xact version (#416) * ci(dependabot): ignore pydantic-core bumps past the pydantic-pinned exact version pydantic-core is transitive (hypermnesia-mcp -> pydantic -> pydantic-core) and pydantic pins it EXACTLY per release rather than by range: pydantic 2.13.4 (latest stable) declares `pydantic-core==2.46.4`. Verified against PyPI's own metadata that no pydantic release accepts 2.47.0 at any maturity — the only releases past 2.13.4 are pre-releases 2.14.0a1/b1, and both already require `pydantic-core==2.48.0`. 2.47.0 sits in a gap between the two pydantic pin generations with no compatible pydantic release, so the bump PR #333 proposed is unresolvable, not merely unresynced (same class of failure as the existing caio ignore entry above it, PR #322). No advisory affects pydantic-core, so this is not a security hold. PR #333 is closed with this same reasoning in its body. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(deps): correct the pydantic-core exclusion's stated reason and bound it Review finding on PR #416: the prior comment claimed no pydantic release at any maturity accepts pydantic-core 2.47.0. That was checked against only one of the two pre-releases past 2.13.4 (2.14.0b1, which requires pydantic-core==2.48.0) and wrongly generalized to the other. PyPI's own metadata for 2.14.0a1 (not previously queried) shows it requires pydantic-core==2.47.0 exactly -- a real match exists, just on an alpha this repo does not track. The practical conclusion is unchanged (2.13.4, the latest STABLE pydantic, pins pydantic-core==2.46.4 exactly, so the bump to 2.47.0 does not resolve against what this repo actually installs) but the comment now states that reason instead of the false "no match at any maturity" one -- a wrong # source: comment is worse than no comment, since the next person to read it takes it as fact. Also narrows the exclusion from the open `>2.46.4` to `>2.46.4,<2.48.0` (PEP 440 comma-AND syntax, verified against `packaging.specifiers .SpecifierSet`): the open form would also have silently blocked the legitimate 2.48.0 bump the day pydantic's stable line reaches 2.14.0 (matching the beta's pin) -- an exclusion should be no wider than the problem it routes around. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
1 participant
Bumps pydantic-core from 2.46.4 to 2.47.0.
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)