Skip to content

ci(deps): bump The-PR-Agent/pr-agent from 0.41.0 to 0.44.0 - #527

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/The-PR-Agent/pr-agent-0.44.0
Open

ci(deps): bump The-PR-Agent/pr-agent from 0.41.0 to 0.44.0#527
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/The-PR-Agent/pr-agent-0.44.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor

Bumps The-PR-Agent/pr-agent from 0.41.0 to 0.44.0.

Release notes

Sourced from The-PR-Agent/pr-agent's releases.

v0.44.0

⚠️ Important Changes

  • GitHub App webhooks now require a configured secret (#2595): get_body() no longer accepts unsigned webhooks — a deployment without GITHUB.WEBHOOK_SECRET set is rejected with HTTP 403 instead of trusting every caller. Set the secret on your GitHub App and in your config before upgrading. The same PR escapes attacker-controlled webhook fields that were interpolated into CLI command strings.
  • Dependency management migrated to uv (#2509): requirements.txt, requirements-dev.txt, and the legacy setup.py are gone — dependencies now live in pyproject.toml with a committed uv.lock. Set up a dev environment with uv sync and run tools via uv run. Optional features are now extras (lambda, langchainuv sync --extra <name>) or a dependency group (similar-issueuv sync --group similar-issue), and Docker images install from the lockfile with uv sync --frozen. Installing from PyPI with pip install pr-agent still works.
  • Linting consolidated on Ruff (#2880): flake8 and the standalone isort pre-commit hook were removed. Contributors should run uv run ruff check --fix on touched files before committing.
  • Dependency pins relaxed to patched ranges (#2881): exact pins were loosened so downstream consumers can pick up security updates; LiteLLM was also upgraded to v1.98.0 (#2794).

🚀 Features

🐛 Bug Fixes

... (truncated)

Commits
  • ab6ec54 fix(pr_agent/servers/gerrit_server.py): requiring credentials on the webhook ...
  • f876eed ci: smoke-start github_app container so a broken launcher fails CI (#2825)
  • 3edc06f feat(models): add OpenRouter router model support (#2893)
  • 6b7fbf9 chore(deps): Upgrade vulnerable transitive dependencies (#2891)
  • a16c993 docs: avoid duplicating the pre-commit hook list (#2892)
  • 872dacf fix: harden webhook auth and CLI argument injection vectors (#2595)
  • f879d4f fix: preserve YAML keys and values during fallback parsing (#2877)
  • ceae34b fix: surface the triggering workflow's conclusion in workflow_run reviews (#2...
  • 240e0e1 fix(improve): avoid false failure after inline publish (#2886)
  • c03f7b4 chore: unify ruff version in pre-commit and deps (#2889)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [The-PR-Agent/pr-agent](https://github.com/the-pr-agent/pr-agent) from 0.41.0 to 0.44.0.
- [Release notes](https://github.com/the-pr-agent/pr-agent/releases)
- [Changelog](https://github.com/The-PR-Agent/pr-agent/blob/main/CHANGELOG.md)
- [Commits](The-PR-Agent/pr-agent@570f67e...ab6ec54)

---
updated-dependencies:
- dependency-name: The-PR-Agent/pr-agent
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Failed to generate code suggestions for PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants