Repository navigation
Ooniapi python 314 - #1281
Open
aagbsn wants to merge 12 commits into
Open
Ooniapi python 314#1281aagbsn wants to merge 12 commits into
aagbsn wants to merge 12 commits into
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #1281 +/- ##
==========================================
+ Coverage 94.85% 98.59% +3.73%
==========================================
Files 59 29 -30
Lines 5482 2698 -2784
Branches 229 106 -123
==========================================
- Hits 5200 2660 -2540
+ Misses 246 32 -214
+ Partials 36 6 -30
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This was referenced Oct 4, 2026
Contributor
Author
|
test is failing at upload coverage to codecov |
Contributor
Author
|
for some reason i'm seeing intermittant CI errors with the rate_limit tests failing; maybe github is overloaded |
The shared package declares the same pins as the services that symlink it; keep it in step with them: fastapi 0.142 (Starlette 1.7), pyjwt 2.15, ujson 5.13, urllib3 2.8, prometheus-fastapi-instrumentator 8.1, and Python 3.14.
The image moves from python:3.11-bookworm to python:3.14-bookworm and
requires-python to >=3.14. pip-audit of the service's runtime
dependencies, installed on Python 3.14, reported 40 advisory matches (several listed twice)
with the current pins: starlette, fastapi, pyjwt, ujson. Bumped:
- fastapi 0.108 -> 0.142 (Starlette 0.32 -> 1.7)
- pyjwt 2.8 -> 2.15
- ujson 5.9 -> 5.13
prometheus-fastapi-instrumentator 6.1 resolved with the new FastAPI but
failed every request ('_IncludedRouter' object has no attribute 'path'),
so it moves to 8.1. After the bumps pip-audit reports none.
Tests on Python 3.14: 27 passed, the same as master.
The image moves from python:3.11-bookworm to python:3.14-bookworm and
requires-python to >=3.14. pip-audit of the service's runtime
dependencies, installed on Python 3.14, reported 32 advisory matches (several listed twice)
with the current pins: starlette, fastapi, pyjwt. Bumped:
- fastapi 0.108 -> 0.142 (Starlette 0.32 -> 1.7)
- pyjwt 2.8 -> 2.15
prometheus-fastapi-instrumentator 6.1 resolved with the new FastAPI but
failed every request ('_IncludedRouter' object has no attribute 'path'),
so it moves to 8.1. After the bumps pip-audit reports none.
Tests on Python 3.14: 15 passed, 1 skipped, the same as master.
The image moves from python:3.11-bookworm to python:3.14-bookworm and
requires-python to >=3.14. pip-audit of the service's runtime
dependencies, installed on Python 3.14, reported 54 advisory matches (several listed twice)
with the current pins: starlette, fastapi, pyjwt, ujson, urllib3. Bumped:
- fastapi 0.108 -> 0.142 (Starlette 0.32 -> 1.7)
- pyjwt 2.8 -> 2.15
- ujson 5.9 -> 5.13
- urllib3 2.1 -> 2.8
prometheus-fastapi-instrumentator 6.1 resolved with the new FastAPI but
failed every request ('_IncludedRouter' object has no attribute 'path'),
so it moves to 8.1. After the bumps pip-audit reports none.
Tests on Python 3.14: 210 passed, 7 skipped, the same as master.
FastAPI now builds a route's parameter model on its first request. In
the tests that first request could happen under freezegun, which
replaces datetime with a class pydantic rejects (Invalid args for
response field, 27 tests); the client fixture now builds them all first
by fetching /openapi.json. The service itself doesn't use freezegun.
The image moves from python:3.11-bookworm to python:3.14-bookworm and
requires-python to >=3.14. pip-audit of the service's runtime
dependencies, installed on Python 3.14, reported 54 advisory matches (several listed twice)
with the current pins: starlette, fastapi, pyjwt, ujson, urllib3. Bumped:
- fastapi 0.108 -> 0.142 (Starlette 0.32 -> 1.7)
- pyjwt 2.8 -> 2.15
- ujson 5.9 -> 5.13
- urllib3 2.1 -> 2.8
prometheus-fastapi-instrumentator 6.1 resolved with the new FastAPI but
failed every request ('_IncludedRouter' object has no attribute 'path'),
so it moves to 8.1. After the bumps pip-audit reports none.
Tests on Python 3.14: 86 passed, 2 skipped, the same as master.
The image moves from python:3.11-bookworm to python:3.14-bookworm and
requires-python to >=3.14. pip-audit of the service's runtime
dependencies, installed on Python 3.14, reported 54 advisory matches (several listed twice)
with the current pins: starlette, fastapi, pyjwt, ujson, urllib3. Bumped:
- fastapi 0.108 -> 0.142 (Starlette 0.32 -> 1.7)
- pyjwt 2.8 -> 2.15
- ujson 5.9 -> 5.13
- urllib3 2.1 -> 2.8
prometheus-fastapi-instrumentator 6.1 resolved with the new FastAPI but
failed every request ('_IncludedRouter' object has no attribute 'path'),
so it moves to 8.1. After the bumps pip-audit reports none.
Tests on Python 3.14: 31 passed, the same as master.
The image moves from python:3.11-bookworm to python:3.14-bookworm and
requires-python to >=3.14. pip-audit of the service's runtime
dependencies, installed on Python 3.14, reported 61 advisory matches (several listed twice)
with the current pins: dulwich, starlette, fastapi, pyjwt, ujson, urllib3. Bumped:
- fastapi 0.108 -> 0.142 (Starlette 0.32 -> 1.7)
- pyjwt 2.8 -> 2.15
- ujson 5.9 -> 5.13
- urllib3 2.6 -> 2.8
- dulwich 0.25 -> 1.2
prometheus-fastapi-instrumentator 6.1 resolved with the new FastAPI but
failed every request ('_IncludedRouter' object has no attribute 'path'),
so it moves to 8.1. After the bumps pip-audit reports none.
Tests on Python 3.14: 29 passed, 1 skipped, the same as master.
The services now require Python 3.14, but their test workflows still set up Python 3.11. They passed only because hatch provides a matching interpreter on its own; set the version the services require instead of relying on that. The version is quoted, as setup-python recommends. Unquoted, YAML reads it as a number: 3.14 still comes through as "3.14", but a version ending in 0 would not, e.g. 3.20 would be read as 3.2.
aagbsn
force-pushed
the
ooniapi_python_314
branch
from
October 5, 2026 15:14
761bb07 to
cc9b716
Compare
FastAPI 0.142 keeps an included router's routes as they were defined, so scope["route"].path lacks include_router's /api prefix and the log_comment handler read GET /v1/measurements. Look the full template up with iter_route_contexts, built once per app.
The template map is built on the first request. A route added or replaced after that isn't in it, and its queries would be tagged "unknown".
As asked in review: route_templates(app) builds an app's map once and lru_cache keeps it, keyed by the app, which hashes as itself. route_template only looks the route up.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ooniapi services on Python 3.14 with patched dependencies
Why: pip-audit found published vulnerabilities in every service's pinned dependencies (Starlette, FastAPI,
PyJWT, ujson, urllib3; dulwich in testlists).
Changes (one commit for
common, one per service):python:3.11-bookworm→python:3.14-bookworm;requires-python >=3.14.fastapi0.108 → 0.142 (Starlette 0.32 → 1.7),pyjwt2.8 → 2.15,ujson5.9 → 5.13,urllib3→ 2.8,dulwich0.25 → 1.2 (testlists).
prometheus-fastapi-instrumentator6.1 → 8.1. 6.1 installs with the new FastAPI but fails every request./openapi.json), since FastAPI nowbuilds them on first use and that clashed with freezegun in the tests. No service code change.
Verified:
pip-audit: no known vulnerabilities in any service after the bumps.29 passed.