build(deps): Bump the python-dependencies group in /fp-cloud-cli with 3 updates - #771
Merged
NiveditJain merged 3 commits intoSep 2, 2026
Conversation
dependabot
Bot
added
dependencies
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
|
Thanks @dependabot[bot] for keeping our dependencies current! 🙌 |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
hermes-exosphere
previously approved these changes
Aug 31, 2026
hermes-exosphere
left a comment
hermes-exosphere
left a comment
Contributor
There was a problem hiding this comment.
Approved automatically by the Hermes Dependabot approver.
Bumps the python-dependencies group in /fp-cloud-cli with 3 updates: [typer](https://github.com/fastapi/typer), [click](https://github.com/pallets/click) and [posthog](https://github.com/posthog/posthog-python). Updates `typer` from 0.27.1 to 0.27.2 - [Release notes](https://github.com/fastapi/typer/releases) - [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md) - [Commits](fastapi/typer@0.27.1...0.27.2) Updates `click` from 8.4.2 to 8.5.0 - [Release notes](https://github.com/pallets/click/releases) - [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md) - [Commits](pallets/click@8.4.2...8.5.0) Updates `posthog` from 7.42.0 to 7.44.2 - [Release notes](https://github.com/posthog/posthog-python/releases) - [Changelog](https://github.com/PostHog/posthog-python/blob/main/CHANGELOG.md) - [Commits](PostHog/posthog-python@posthog-v7.42.0...posthog-v7.44.2) --- updated-dependencies: - dependency-name: typer dependency-version: 0.27.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: click dependency-version: 8.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: posthog dependency-version: 7.44.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
…cannot rebind them all typer 0.27.2 moved `Abort` out of its vendored `typer._click.exceptions` into a plain `typer.exceptions.Abort(RuntimeError)`. `_click_compat` imported all six of its symbols under one `try: … except ImportError: from click import …`, so that single missing name sent the whole block to the fallback and bound `ClickException`, `UsageError`, `BadParameter`, `Command` and `Parameter` to the pip `click` distribution — which is not the Click Typer runs, and Typer catches only its own. Every typed error then escaped its handler: `fp alerts show ghost` exited 1 with an empty stderr instead of 6 with `no alert named "ghost"`, and likewise for exits 2, 3, 4 and 5. 105 tests went red on this PR's bump — the first one to install 0.27.2 — and nothing else warned, because the CLI still imported and every happy path still passed. This is precisely the failure mode the module's own docstring describes; it just had one all-or-nothing `except ImportError` standing between the two Clicks. Pick the Click ONCE, on whether `typer._click` exists at all, then import every symbol from that choice. A name that later goes missing inside the chosen Click now raises at import — a CLI that refuses to start — instead of silently flattening the exit-code contract to 1. `Abort` is the one symbol not pinned to a Click at all: it comes from `typer.Abort`, which tracks the move by construction (pip Click's before typer 0.26, the vendored class through 0.27.1, `typer.exceptions.Abort` from 0.27.2) and is by definition the class `typer.prompt` raises and typer's own `_main` catches — the only property `select.py`'s `except click.Abort` needs. `test_click_compat.py` gains three alarms for the partial miss the old shape swallowed: every symbol's provenance asserted separately, `Abort` pinned to `typer.Abort`, and the hand-raised `UsageError`/`BadParameter` checked end to end for exit 2. All three fail against the previous `_click_compat` and pass against this one. Suite verified green against typer 0.25.1, 0.27.0, 0.27.1 and 0.27.2 (915 passed); 0.13.0 and 0.26.0 have the same pre-existing failures before and after, untouched by this change. Wheel build, `fp --version`, `fp help` and a real typed-error exit (4, message on stderr) verified from a clean install of the built wheel. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VZSRsXYbse5cDU3iancJKq
NiveditJain
dismissed stale reviews from hermes-exosphere and github-actions[bot]
via
September 2, 2026 06:56
2b90da0
NiveditJain
force-pushed
the
dependabot/uv/fp-cloud-cli/python-dependencies-268ef1d861
branch
from
September 2, 2026 06:56
8dcaf4f to
2b90da0
Compare
hermes-exosphere
previously approved these changes
Sep 2, 2026
hermes-exosphere
left a comment
hermes-exosphere
left a comment
Contributor
There was a problem hiding this comment.
Approved automatically by the Hermes Dependabot approver.
…bun.lock GHSA-73wf-gq98-2v4g and GHSA-c83g-rgw3-j3cx are both against browserslist 4.28.2 and both fixed in 4.28.7, so the Supply Chain gate blocks on them correctly — "2 vulnerabilities can be fixed". They turned `main` red on its own scheduled run this morning (33591233694), not on anything a PR changed: the advisories were disclosed after this branch's first CI run, which is the same surface-late mechanism osv-scanner.toml already describes for chromadb. browserslist is transitive-only, reached through `@babel/helper-compilation- targets`'s `^4.24.0`, so this is an `overrides` pin rather than a dependency bump — which is what osv-scanner.toml's own header prescribes ("Always prefer FIXING (bump the dependency, or pin it via `overrides` in package.json) over ignoring"), and what the seven pins already in that block are. `bun update browserslist` is NOT the fix and was reverted: it adds browserslist to `dependencies` as a direct dep it is not, and it leaves 4.28.2 in the tree nested under `@babel/helper-compilation-targets/browserslist`, so the gate stays red for the same two advisories. The override collapses the tree to exactly one browserslist, at 4.28.8. Diff is browserslist and its own dependency set only. Verified: `bun run build`, `bun run lint` (0 errors), `bunx tsc --noEmit` clean, `bun run test:run` 4856 passed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VZSRsXYbse5cDU3iancJKq
NiveditJain
approved these changes
Sep 2, 2026
dependabot
Bot
deleted the
dependabot/uv/fp-cloud-cli/python-dependencies-268ef1d861
branch
September 2, 2026 07:15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
CI needed a code fix, not just the lockfile bump. typer 0.27.2's "Create
exceptionsmodule andTyperExceptionbase class" refactor(typer#1942) moved
Abortout of thevendored
typer._click.exceptions.fp_cli/_click_compat.pyimported all six of itssymbols under one
try: … except ImportError: from click import …, so that singlemissing name sent the whole block to the fallback and bound
ClickException,UsageError,BadParameter,CommandandParameterto pipclick— which is notthe Click Typer runs, and Typer catches only its own. Every typed error escaped its
handler:
fp alerts show ghostexited 1 with an empty stderr instead of 6 withno alert named "ghost", and the same for exits 2, 3, 4 and 5. 105 tests red.The shim now picks the Click once — on whether
typer._clickexists at all — andimports every symbol from that choice, so a future move raises at import (a CLI that
refuses to start) instead of silently flattening the exit-code contract.
Abortalonecomes from
typer.Abort, which tracks the move by construction and is by definitionthe class
typer.promptraises and typer's own_maincatches.Three new alarms in
tests/test_click_compat.pycover the partial miss the old shapeswallowed; all three fail against the previous shim. Suite green against typer 0.25.1,
0.27.0, 0.27.1 and 0.27.2 (915 passed), plus wheel build and a real typed-error exit
from a clean install.
Second commit:
browserslistpinned to 4.28.8. GHSA-73wf-gq98-2v4g andGHSA-c83g-rgw3-j3cx (both 7.5, both fixed in 4.28.7) were failing the Supply Chain
gate. They are not from this PR —
mainwent red on them on its own scheduled runthis morning, the same surface-late mechanism
osv-scanner.tomldocuments forchromadb. browserslist is transitive-only (via
@babel/helper-compilation-targets's^4.24.0), so this is anoverridespin — what that file's own header prescribes, andwhat the seven pins already in that block are. Note
bun update browserslistis notthe fix: it adds a direct dependency that does not belong and leaves 4.28.2 nested
under
@babel/helper-compilation-targets, keeping the gate red. Verified withbun run build,bun run lint,bunx tsc --noEmitandbun run test:run(4856passed).
Bumps the python-dependencies group in /fp-cloud-cli with 3 updates: typer, click and posthog.
Updates
typerfrom 0.27.1 to 0.27.2Release notes
Sourced from typer's releases.
Changelog
Sourced from typer's changelog.
Commits
99eb220🔖 Release version 0.27.2 (#1943)a2c9f1e📝 Update release notes41dea8f♻️ Createexceptionsmodule andTyperExceptionbase class (#1942)407d924📝 Update release notes41c8224⬆️ Bump setup-uv action to 10.0.1 (#1940)9a7b2e8📝 Update release notes31f30d7👷 Migrate automatic labels to Latest Changes (#1931)dacef1b📝 Update release notes42a9639👷 Remove legacy label check (#1930)361bdd8📝 Update release notesUpdates
clickfrom 8.4.2 to 8.5.0Release notes
Sourced from click's releases.
... (truncated)
Changelog
Sourced from click's changelog.
... (truncated)
Commits
8b19813Release version 8.5.02c8cd3aAdd FAQ entry aboutUnicodeEncodeErroron Windows (#3778)131c86aAdd FAQ entry aboutUnicodeEncodeErroron Windowse1fd594Add support ofpathlib.Pathtoedit(#3781)a1d8785Add support ofpathlib.Pathtoedit2103e15Forward all user's parameters set inPAGERand improve flag detection (#3777)a6256bfForwards all user's parameters set inPAGER61b69e9Resolve the pager command once, in_pager_contextmanager(#3776)9835b0fResolve the pager command once, in_pager_contextmanagerf36d58bRefactor pager stream handling (#3767)Updates
posthogfrom 7.42.0 to 7.44.2Release notes
Sourced from posthog's releases.
Commits
953ea59chore: Release v7.44.2 [skip ci]fc7e043fix: Honor a default_cache_ttl_seconds of 0 in Prompts (#873)5e80659Update generated references645f4d3chore: Release v7.44.1 [skip ci]0e70f0cfix(flags): align presence operator semantics (#897)5eb886dUpdate generated references2ab1fe5chore: Release v7.44.0 [skip ci]9a1d137chore: add changeset for capture_trace_context (#896)550f5b5feat: opt-in OTel trace/span IDs on regular capture() via capture_trace_conte...b72fed3Update generated referencesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions