deps: pydantic brings its own pydantic-core, so the direct pin goes

Merged
HA
1d ago
+0-3

Summary

The Dependabot update for uv in /backend fails on every run (39336898284, 39321368884) with dependency_file_not_resolvable for both pydantic and pydantic-core. pyproject pins pydantic==2.14.0 and pydantic_core==2.50.0, pydantic 2.14.1 requires pydantic-core==2.50.1 (PyPI), and Dependabot bumps the two one at a time, so neither update can resolve. pydantic stays stuck at 2.14.0.

Changes

The direct pydantic_core pin goes. Nothing imports pydantic_core, and pydantic pins it exactly, so the lock keeps pydantic-core 2.50.0 and the next Dependabot run moves both together. The pin came from the pip to uv move in #7, which copied a frozen requirements.txt into pyproject.

Type of Change

  • Bug fix (non-breaking change that fixes an issue)
  • New feature (non-breaking change that adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update
  • Refactoring (no functional changes)
  • CI/CD or tooling changes

Test Plan

  • Backend unit tests pass (cd backend && uv run pytest tests/unit)
  • Frontend unit tests pass (cd frontend && npm run test)
  • Backend E2E tests pass (docker compose exec -T backend sh -c 'uv sync --group test --no-dev --frozen --no-install-project --no-build && pytest tests/e2e')
  • Frontend E2E tests pass (cd frontend && npm run test:e2e)
  • API spec and client regenerated if routes or schemas changed (./deploy.sh openapi, then ./deploy.sh types), never edited by hand
  • Manual testing performed

Validation: uv lock changes only the two lines of the pin, uv lock --check passes, the synced env has pydantic 2.14.0 with pydantic-core 2.50.0, and 545 unit tests and mypy --strict pass.

Checklist

  • My code follows the project's style guidelines
  • I have run pre-commit run --all-files and all checks pass
  • I have added tests that prove my fix/feature works
  • I have updated documentation if needed
  • My changes don't introduce new warnings

Summary by cubic

Removes the direct pydantic_core pin so Dependabot can update pydantic and pydantic-core together.

backend/pyproject.toml pinned pydantic==2.14.0 and pydantic_core==2.50.0, but Dependabot bumps the two one at a time, so neither update could resolve and every run failed. Nothing imports pydantic_core directly, and pydantic pins its exact version, so the lock keeps pydantic-core 2.50.0 and the next run resolves both together.