[misc] chore: bump ruff to 0.16.5 and widen harbor, openai-agents, and mcp ranges

Merged
JO
2mo ago
+60-56

What

Consolidates dependabot #340, #341, #342, and #343 into one reviewed change, with the uv.lock update those PRs are missing:

DependencyBeforeAfterLocked
ruff (dev)==0.16.0==0.16.50.16.5
openai-agents[litellm]>=0.18.1,<0.19>=0.18.1,<0.210.20.0
harbor[daytona]>=0.20.0,<0.21>=0.20.0,<0.230.22.0
mcp (strands, openai-agents)>=1.28.1,<2.0.0>=1.28.11.29.1

Also bumps the ruff-pre-commit rev to match, and fixes three comments/docstrings that referred to harbor 0.20 behaviour (diagnostics.py timestamp note, backend.py module docstring, pyproject dockerfile-parse/PyIceberg rationale).

Why

All four dependabot PRs fail CI identically: they edit pyproject.toml only, and uv sync --locked rejects the stale lock. Each range was audited against the SDK's actual usage before widening:

  • openai-agents <0.21, not <0.23. Every symbol the adapter uses (SessionABC, Converter.items_to_messages, LitellmModel signatures, Usage/ModelResponse fields) is unchanged through 0.20.0; the only additions are optional fields. 0.21+ requires openai>=3.0 (HTTPX2 transport), which no install can reach today because LiteLLM pins openai<3. <0.23 would therefore only take effect silently and untested once LiteLLM moves; cap at <0.21 so that crossing is a deliberate bump.
  • harbor <0.23, lock at 0.22.0. Every module the SDK imports or subclasses is byte-identical or additively extended between 0.20.0 and 0.22.0 (trial/hooks.py, trial/queue.py, trial/network_policy.py, agents/installed/base.py abstract surface, models/task/id.py, models/trajectories). [daytona] still exists, [skypilot] still pulls skypilot-nightly, base deps unchanged apart from litellm>=1.92.0. Widening without the lock bump would leave CI testing 0.20 while pip install osmosis-ai[harbor] resolves 0.22, which is the drift the pyproject comment exists to prevent.
  • mcp: keep the security floor, drop our ceiling. The SDK never imports mcp; it is transitive via strands-agents (pins mcp<2) and openai-agents (0.20 supports 1.x and 2.x via a real compat layer, openai/openai-agents-python#4106). >=1.28.1 still excludes every advisory-affected release (GHSA-hvrp-rf83-w775, GHSA-jpw9-pfvf-9f58, GHSA-vj7q-gjh5-988w). Our own <2/<3 cap only duplicated the adapters' pins and would re-trigger dependabot on every mcp major. Verified a fresh [openai-agents] install (mcp 2.1.1 + openai-agents 0.20.0): uv pip check, the SDK tests, verify-wheel-install.py --scenario openai-agents, and a live stdio MCP tool call all pass.
  • ruff 0.16.5: zero new diagnostics, zero formatting changes, no stable-rule changes in the selected sets. CI's ruff-action reads the pin from pyproject.toml dependency-groups, so no workflow change is needed.

Harbor 0.21/0.22 behaviour changes worth knowing about (no SDK change required):

  • harbor-framework/harbor#2522: ExceptionInfo.occurred_at is now timezone-aware UTC. diagnostics._as_utc already handled both shapes; only its comment was stale.
  • harbor-framework/harbor#2529: a task directory that ships a top-level trajectory.json now fails at trial start because no installed agent (ours included) supports ATIF trajectory loading. The SDK never writes that file; only user-authored tasks are affected, and the failure is loud.
  • harbor-framework/harbor#2580: Linux Docker hosts now run the nftables kernel probe (docker run alpine, up to 30 s, once per process) instead of assuming support. If the probe fails, allowlist/no-network trials raise at environment setup instead of attempting enforcement. Public-network trials are unaffected.

Supersedes #340, #341, #342, #343; dependabot closes them automatically once this lands.

How to Test

uv lock --check
uv sync --locked --all-extras --group dev
uv run ruff check . && uv run ruff format --check .
uv run pyright osmosis_ai/
uv run pytest

Verified locally on Python 3.13 with the new lock: 3036 passed, 1 skipped; pyright 0 errors; --verifytypes shows only the known harbor.harness_agent baseline.

Checklist

  • PR title follows [module] type: description format
    (labels are derived from it automatically — no need to add them by hand)
  • ruff check . and ruff format --check . pass
  • pyright osmosis_ai/ passes
  • pytest passes (new tests added if applicable)
  • Public API changes are documented (none)
  • No secrets or credentials included
Devin Review

Summary by cubic

Bumps ruff to 0.16.5 and widens the harbor, openai-agents, and mcp ranges, with the uv.lock and pre-commit updates the four dependabot PRs were missing. openai-agents stays capped below 0.21 because 0.21+ requires openai>=3.0, which LiteLLM can't reach yet.

Harbor 0.21/0.22 behavior changes

  • ExceptionInfo.occurred_at is now timezone-aware; _as_utc already handled both shapes, so only comments changed.
  • Tasks shipping a top-level trajectory.json now fail at trial start; the SDK never writes that file.
  • Linux Docker hosts now run an nftables probe once per process; failures surface at environment setup instead of attempting enforcement.

Also updates stale comments and docstrings that referenced the old harbor 0.20 pinned behavior.