Repository navigation
build(deps): Bump stripe from 5.5.0 to 16.0.0 - #6370
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [stripe](https://github.com/stripe/stripe-python) from 5.5.0 to 16.0.0. - [Release notes](https://github.com/stripe/stripe-python/releases) - [Changelog](https://github.com/stripe/stripe-python/blob/master/CHANGELOG.md) - [Commits](stripe/stripe-python@v5.5.0...v16.0.0) --- updated-dependencies: - dependency-name: stripe dependency-version: 16.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
🟢 ReviewingLast updated: 2026-11-01 00:53 UTC |
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #6370: Stripe 16 breaks all three webhook handlers. CI stays green. Recommend closing this PR and tracking the upgrade in an issue.
- Package:
stripe5.5.0 → 16.0.0 - Risk: major (11 majors)
- Type: production (
views/subscription.py) - CI: passing. The webhook tests mock
construct_eventwith plain dicts. They never build a realStripeObject. - Breaking change: 15.0.0 (#1762).
StripeObjectno longer subclassesdict. See the inline comment. - Other breaking changes: none affect Studio. Python ≥3.9 is required.
StripeObject.request()andstripe.Reversalare removed. Studio uses neither.stripe.error.*,api_keyandapi_versionall remain. - Security fixes: none
- Peer deps: none.
typing-extensionsis already pinned. Re-compiling drops the[grpc]labels inrequirements.txt.grpciostays pinned.
Written by rtibblesbot, an LLM-based coding agent.
| latex2mathml==3.78.1 | ||
| markdown-it-py==4.0.0 | ||
| stripe>=5.0.0,<6.0.0 | ||
| stripe>=16.0.0,<17.0.0 |
There was a problem hiding this comment.
blocking: On stripe ≥15, stripe_webhook rejects every real event. subscription.py:279 passes the event's data object to a DRF serializer. On 15+ that object is no longer a dict. A probe with 16.0.0 and DRF 3.15.1 on stripe.Event.construct_from(...) gave this result:
valid: False {'non_field_errors': [... 'Invalid data. Expected a dictionary, but got Subscription.']}
The same probe passes on 5.5.0. The view logs a warning and returns 200. Stripe therefore doesn't retry. Paid checkouts never grant storage. Cancellations never revoke it.
The upgrade PR needs these changes:
- Pass
event["data"]["object"].to_dict()to the serializer. - Build the test events in
tests/views/test_subscription.pywithstripe.Event.construct_from(...)so that they fail without the fix.
|
Tracked in #6374. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
|
Quick check on rtibblesbot's review of this PR: react 👍 helpful · 😕 mixed · 👎 not helpful. Reply with anything specific. |
Bumps stripe from 5.5.0 to 16.0.0.
Release notes
Sourced from stripe's releases.
... (truncated)
Changelog
Sourced from stripe's changelog.
... (truncated)
Commits
2936309Bump version to 16.0.0797b959Add v16 migration guidance links (#1935)4848f6fMerge pull request #1932 from stripe/latest-codegen-master000b6f2Update generated code for v2526 and 588801ef34f7b5f7d6a784d3354f5f93d2a26ffb78aebc7Update generated code for v2526 and adad04916772f880317eac10d8c026b401863f1d ...b48375aPin stripe-mock to the SDK OpenAPI version (#1927)b7ba58eMerge pull request #1917 from stripe/sdk-release/next-major8427c15Revise migration guide for SDK v16 API changes6529349Make remaining overloaded method args positional only and remove unecessary s...872b1aeRename Reversal to TransferReversal (#1915)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)