Skip to content

Python: Update flit-core requirement from <4.0,>=3.9 to >=3.9,<5.0 in /python - #14596

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python/flit-core-gte-3.9-and-lt-5.0
Closed

Python: Update flit-core requirement from <4.0,>=3.9 to >=3.9,<5.0 in /python#14596
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python/flit-core-gte-3.9-and-lt-5.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on flit-core to permit the latest version.

Changelog

Sourced from flit-core's changelog.

Release history

Version 4.1

  • License expressions with named exceptions, the WITH syntax, are accepted (:ghpull:809).
  • flit init allows dotted module names, for a component of a namespace package (:ghissue:822).
  • Fix line endings in .cmd script wrappers on Windows (:ghpull:824).

Version 4.0.3

  • Fix built wheels being created with overly restrictive 0600 permissions instead of the normal, world-readable 0644 (:ghpull:806).

Version 4.0.2

  • Fix invalid metadata files with Import-Name (:ghissue:813).

Version 4.0.1

No changes, but a new tag to trigger an upload to PyPI now that twine will accept it.

Version 4.0

This version contains breaking changes, but most projects which are already using the [project] table for metadata shouldn't be affected, and can simply change the flit_core <4 constraint to <5.

  • The [tool.flit.metadata] table is no longer used for project metadata (:ghpull:771). Use the newer :ref:[project] table <pyproject_toml_project> instead (or if that is not possible, build with flit_core <4).
  • :ref:build_cmd and :ref:publish_cmd no longer include files in the sdist based on what is committed in git or Mercurial (:ghpull:772). These commands now build packages more like Flit does when called as a backend by e.g. python -m build. Specify :ref:sdist include & exclude patterns <pyproject_toml_sdist> instead (Flit can help to generate these), or pass the --use-vcs option to get the old behaviour back.
  • flit_core now requires Python 3.8 or above (:ghpull:738)
  • The --setup-py option to generate sdists containing a setup.py file is no longer available (:ghpull:776).
  • Making typing stubs packages with a -stubs suffix will now work (:ghpull:742).

... (truncated)

Commits
  • 75b1c90 Merge pull request #826 from pypa/prepare-4.1
  • b5ad0d7 Add release note about PR #824
  • 9fb48c1 Bump version: 4.0.2 → 4.1.0
  • a4ea331 Prepare release notes for 4.1
  • 337c499 Merge pull request #824 from r3wretrhy/fix-win-cmd-crlf
  • 04cfa08 Merge pull request #825 from hxperl/docs-dynamic-fields
  • 33be607 doc: list all four fields accepted in project.dynamic
  • d538cb4 install: keep explicit CRLF in Windows .cmd wrappers
  • 3c92604 Merge pull request #809 from yangfan-yf-yf/fix/spdx-with-exceptions
  • 33a7a39 Clarify SPDX WITH version requirement and error message
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Update flit-core requirement from <4.0,>=3.9 to >=3.9,<5.0 in /python
edcb982 
Updates the requirements on [flit-core](https://github.com/pypa/flit) to permit the latest version.
- [Changelog](https://github.com/pypa/flit/blob/main/doc/history.rst)
- [Commits](pypa/flit@3.9.0...4.1.0)

---
updated-dependencies:
- dependency-name: flit-core
  dependency-version: 4.1.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file. Used by Dependabot. label Oct 14, 2026
Copilot AI balanced review requested due to automatic review settings October 14, 2026 06:50
@dependabot
dependabot Bot requested a review from a team as a code owner October 14, 2026 06:50
@dependabot dependabot Bot added the python Pull requests for the Python Semantic Kernel label Oct 14, 2026
@dependabot
dependabot Bot temporarily deployed to github-app-auth October 14, 2026 06:51 Inactive
@github-actions github-actions Bot changed the title Update flit-core requirement from <4.0,>=3.9 to >=3.9,<5.0 in /python Python: Update flit-core requirement from <4.0,>=3.9 to >=3.9,<5.0 in /python Oct 14, 2026
@dependabot
dependabot Bot temporarily deployed to github-app-auth October 14, 2026 06:51 Inactive
Copilot AI reviewed Oct 14, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The project uses compatible PEP 621 metadata and the dependency constraint update is valid.

0 open findings

What changed in this PR

Updates the Python package build backend constraint to permit Flit Core 4.x.

Changes:

  • Expands the supported flit-core range from <4.0 to <5.0.
File Description
python/​pyproject.toml Allows Flit Core 4.x for Python package builds.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Merged
1 of 4 tasks
@eavanvalkenburg

Eduard van Valkenburg (eavanvalkenburg) commented Nov 4, 2026

Copy link
Copy Markdown
Member

Consolidated into #14720 for the Python 1.47.0 release, including the dependency changes and regenerated lockfiles. The release branch includes the merged Python 3.10 removal from #14708. Closing this PR as superseded; the combined changes remain under review in #14720.

@dependabot @github

dependabot Bot commented on behalf of github Nov 4, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/pip/python/flit-core-gte-3.9-and-lt-5.0 branch November 4, 2026 14:47
westey (westey-m) pushed a commit to westey-m/semantic-kernel-1 that referenced this pull request Nov 5, 2026
@eavanvalkenburg
Python: Prepare 1.47.0 release and consolidate dependency updates (mi…
d08a482 
…crosoft#14720)

### Motivation and Context

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

Prepare the Semantic Kernel Python package for the `1.47.0` release and
consolidate all six open Python package Dependabot updates into one
validated change.

The prerequisite microsoft#14708 has merged and is included in this branch.
Python 3.10 support is removed; the package now requires Python 3.11+
and advertises support through Python 3.14. This compatibility change is
the reason for the minor release.

Other Python changes already merged since `python-1.46.0` include fixes
for MCP initialization and prompt arguments, Redis vector search, Google
AI embeddings and token usage, Mistral settings and finish reasons, SQL
Server handling, OpenAPI URL matching, schema generation, chat history
and tool results, Handlebars helpers, and empty in-memory searches.

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

- Update `semantic_kernel.__version__` from `1.46.0` to `1.47.0`.
- Allow `flit-core >=3.9,<5.0`; verified the build with Flit Core 4.2.0.
Supersedes microsoft#14596.
- Expand the boto3 upper bound to `<1.44.0` and lock boto3/botocore
1.43.123 with s3transfer 0.19.3. Supersedes microsoft#14597.
- Expand the google-genai upper bound to `<2.30`. The combined Google
extra still resolves google-genai 1.75.0 because google-cloud-aiplatform
requires `<2.0.0`. Supersedes microsoft#14598.
- Expand the Redis upper bound to `<9`; lock Redis 8.1.0 and compatible
redisvl 0.30.0. Supersedes microsoft#14599.
- Pin ONNX Runtime GenAI to 0.18.0 and lock its required ONNX Runtime
1.31.1. No Python 3.10 compatibility pins remain. Supersedes microsoft#14600.
- Update the MCP OAuth sample lockfile from MCP 1.28.1 to 1.30.0.
Supersedes microsoft#14627.
- Regenerate both affected lockfiles. Preserve exact original lock
entries, including registry URLs and artifact metadata, for every
unchanged SDK dependency. New package versions use PyPI because the
existing proxy returned a metadata 404 for the new ONNX GenAI wheel.

Validation:

- `uv build --project python --no-sources` — passed; built the `1.47.0`
wheel and source distribution. The build selected Flit Core 4.2.0. uv
reports the existing prerelease-mode deprecation warning.
- `cd python && uv run --no-sync pytest tests/unit/connectors/ai/bedrock
tests/unit/connectors/ai/google/google_ai tests/unit/connectors/ai/onnx
tests/unit/connectors/memory/test_redis_store.py
tests/unit/connectors/mcp --disable-warnings -q` — passed on Python
3.14.0rc3 with boto3 1.43.123, Redis 8.1.0, redisvl 0.30.0, ONNX Runtime
GenAI 0.18.0, and ONNX Runtime 1.31.1 installed.
- `python/.venv/bin/pre-commit run --files python/pyproject.toml
python/semantic_kernel/__init__.py python/uv.lock
python/samples/demos/mcp_with_oauth/uv.lock --config
python/.pre-commit-config.yaml` — passed for all applicable hooks.
- `uvx --from uv==0.5.30 uv lock --project python --check` — passed,
using the SDK's pre-commit resolver version.
- `uv lock --project python/samples/demos/mcp_with_oauth --check` —
passed.
- `git diff --check` — passed.
- Parsed wheel `METADATA` and source `PKG-INFO` — passed: version
`1.47.0`, `Requires-Python: >=3.11`, and all requested runtime
dependency bounds are present.
- Asserted that all unchanged SDK dependencies retain their exact
original lock entries and that both affected lockfiles contain the
requested updates — passed.

The full unit-test suite and live-service integration tests were not run
locally. This PR remains a draft pending release review and CI; it does
not publish a release.

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [ ] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄

This branch was previously deployed

1 inactive deployment
github-app-auth — edcb9829 Deployed Oct 14, 2026 by dependabot[bot] via team_check #621
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file. Used by Dependabot. python Pull requests for the Python Semantic Kernel

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@eavanvalkenburg