Consolidate Dependabot dependency updates - #2
Conversation
Source PR: microsoft#14385 Source head: 4688453 Workflow replica: frozen-to-base
⛔ Shipwright · BlockedRecommendation: do not merge PR #2 · Tier
Findings (6)
Fireworks usage: 61,649 input · 678 output · 62,327 total tokens · $0.0140 · 15s · 0 fix iteration(s) Open the Shipwright check for full evidence and the audit bundle. Use |
![shipwright-agent[bot]](https://avatars.githubusercontent.com/u/140162738?s=60&v=4){kind=small}
| <ItemGroup> | ||
| <PackageReference Include="AWSSDK.BedrockRuntime" /> | ||
| <PackageReference Include="AWSSDK.Extensions.Bedrock.MEAI" /> | ||
| <PackageReference Include="AWS.Bedrock.MEAI" /> |
There was a problem hiding this comment.
Shipwright · CRITICAL
The .NET package rename from AWSSDK.Extensions.Bedrock.MEAI to AWS.Bedrock.MEAI changes the package ID and major version (4.0.5.3 to 1.0.0).
Impact: The .NET package rename from AWSSDK.Extensions.Bedrock.MEAI to AWS.Bedrock.MEAI changes the package ID and major version (4.0.5.3 to 1.0.0). The csproj reference is updated, but no code changes are shown. If any source file still references the old namespace or types, the build will fail. The diff contains no evidence that compilation was verified.
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
| <PackageVersion Include="Azure.AI.Projects" Version="2.0.1" /> | ||
| <PackageVersion Include="Azure.Identity" Version="1.21.0" /> | ||
| <PackageVersion Include="Azure.Monitor.OpenTelemetry.Exporter" Version="1.7.0" /> | ||
| <PackageVersion Include="Azure.Monitor.OpenTelemetry.Exporter" Version="1.8.3" /> |
There was a problem hiding this comment.
Shipwright · CRITICAL
Azure.AI.Projects is upgraded from a beta (2.0.0-beta.2) to a stable release (2.0.1).
Impact: Azure.AI.Projects is upgraded from a beta (2.0.0-beta.2) to a stable release (2.0.1). Beta-to-stable transitions frequently include breaking API changes. No code changes accompany this dependency bump, so any API surface used from the beta may no longer exist or behave differently, causing runtime failures.
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
| google = [ | ||
| "google-cloud-aiplatform>=1.114,<1.134", | ||
| "google-genai >= 1.51,< 1.75" | ||
| "google-genai >= 1.51,< 2.21" |
There was a problem hiding this comment.
Shipwright · HIGH
The google-genai Python dependency upper bound is widened from <1.75 to <2.21, a full minor-version jump.
Impact: The google-genai Python dependency upper bound is widened from <1.75 to <2.21, a full minor-version jump. This allows potentially breaking API changes into the project without any accompanying code or test changes, making future failures hard to attribute.
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
| usearch = [ | ||
| "usearch >= 2.16,< 2.25", | ||
| "pyarrow>=12.0,<24.0" | ||
| "pyarrow>=12.0,<26.0" |
There was a problem hiding this comment.
Shipwright · HIGH
The pyarrow upper bound is widened from <24.0 to <26.0, spanning two major versions.
Impact: The pyarrow upper bound is widened from <24.0 to <26.0, spanning two major versions. pyarrow has known breaking changes between major versions, and no compatibility testing evidence is provided.
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
1 participant
Motivation and Context
Consolidates the currently open Dependabot updates into one reviewable dependency PR while preserving each source update's intent across GitHub Actions, .NET, Python, and JavaScript sample dependencies.
Description
Updates pinned GitHub Actions, central NuGet package versions, Python dependency constraints and uv lockfiles, and npm/Yarn lockfiles for the affected samples. Overlapping lockfile updates were regenerated or reconciled so that all compatible requested versions are retained together on the latest
main. The incompatible MCP 2.x and Python 3.10onnxruntime-genaiupdates are excluded, the private-feed-only@humanfs/nodeupdate is omitted, and the logging abstractions floor is aligned with the updated Azure AI Projects dependency.Related Issue
Supersedes:
Contribution Checklist
Source merge-base:
a85a5503938b535c18862ab936b84eaa30ec8129Source head:
468845320f837b4216fa47a17f3adc87087559f9Workflow files in
.github/workflowsare unchanged in this replica because the GitHub token lacks theworkflowscope.