chore(devops): 抬高后端依赖下界至 lockfile 主次版本，保可复现（CR-D1）

2026-07-08 13:34:36 +02:00
parent 05f49d0b7f
commit a039a1e5d9
10 changed files with 45 additions and 44 deletions
--- a/PROGRESS.md
+++ b/PROGRESS.md
@@ -37,7 +37,7 @@
 | CR-M4 🟡 前端 key/a11y/cleanup 批 | ⬜ | @frontend | — | 可编辑列表去 index-key（`CharacterGenerator.tsx:135`/`GeneratorRunner.tsx:178`/`ForeshadowCard.tsx:68`）；SSE `KNOWN_EVENTS` 补 `stop`（核对 `memory/contracts.md`）；ARIA 补全（AppShell nav label / NavDrawer aria-controls / ForeshadowCard `<dl>` 结构）；ProjectWizard 步骤焦点；`ReviewReport.tsx:301` setTimeout 卸载清理 |
 | CR-M5 🟡 前端 TS 边界类型收紧 | ⬜ | @frontend | — | `lib/api/server.ts:34` `parseJsonBody` 加最小结构校验；`useAccept.ts:60` `ApiErrorEnvelope` 从生成 schema 派生；`applyFix.ts` `hasApplicableFix` 改类型谓词去 `as string` |
 | CR-L1 🟢 LOW 清理批 | 🔵 后端片 ✅ | @backend·@llm·@frontend | — | **@backend 片 done**：`49e3cb6` SSE draft/rewrite/review 补 OpenAPI `text/event-stream` 声明（共享 `_SSE_RESPONSE`，export_openapi 通过、schema 现 3 处）；`print`→logging **无需改**：owned 目录唯一 `print(` 是 `export_openapi.py` 的 CLI stdout 输出（前端 gen:api 管道消费，非诊断打印），改则断管道。**@llm 片 done**：`c9ffada` 续写链前一章无已验收终稿发 `chain_prior_accepted_missing` warning（`chain/nodes.py` `_read_prior_accepted`；静默丢前文引子可观测，首章前一章号<1 属预期不告警）。**待 @frontend**：冗余 `as`/`.valueOf()` cast 清理 |
-| CR-D1 🟡 抬高后端依赖下界（可选升级评估） | ⬜ | @devops | — | `pyproject.toml` 下界过旧（`langgraph>=0.2.40`/`anthropic>=0.34`），抬到接近 lockfile 实锁版本保可复现；后端实锁版本均当前。可选评估 vitest 3.x / tailwind 4.x |
+| CR-D1 🟡 抬高后端依赖下界（可选升级评估） | ✅ | @devops | — | 8 个 pyproject 后端运行时下界抬到 lockfile 主次版本（`langgraph>=1.2`/`anthropic>=0.111`/`openai>=2.43`/`pydantic>=2.13`/`fastapi>=0.137`/`cryptography>=49` 等，每条 ≤ 实锁）；`uv.lock` **纯元数据刷新**（仅 `requires-dist` specifier，零 pinned 版本变动）；`uv lock --check` 绿、pytest **971**、ruff 干净。root dev 工具下界 + 前端 vitest/tailwind 升级评估未纳入（超范围） |

 > **[2026-07-08] CRITICAL + HIGH 全部 ✅ 落地**（14 项 + 4 项低危收尾），多 agent 并行开发（@llm/@backend/@devops/@frontend 四簇串行整合，各 TDD 红→绿、逐项补回归测试）。**门禁全绿**：后端 ruff/format 干净 · mypy **229** · alembic **无漂移** · pytest **934**；前端 lint/tsc 干净 · vitest **669** · build OK · coverage **95.41%**。**14 项对抗式复核 0 problem**（skeptic 逐条实证 test 非 vacuous）。落地含 3 处前提证伪（C2 非实活崩溃/H4 sync-SSE 已由 contextvars 贯通/H11 行为本分支已修）。**MEDIUM/LOW（CR-M1..M5 / L1 / D1）按计划择批后清理，暂 ⬜。**
 >
@@ -192,6 +192,7 @@ T0.1 monorepo 骨架 ✅ @devops · T0.2 16 MVP 表迁移（无漂移，users st

 > 格式：`- [YYYY-MM-DD] @skill 完成/进展 Txx — 一句话结果 + 影响的契约/文件`

+- [2026-07-08] @devops — **✅ QA-CR CR-D1 抬高后端依赖下界至 lockfile 主次版本（保可复现）**。8 个 pyproject（`apps/api` + `packages/{core,agents,config,db,llm_gateway,shared,skills}`）的后端运行时依赖下界从过旧值抬到实锁 MAJOR.MINOR：`langgraph>=1.2`/`langgraph-checkpoint-postgres>=3.1`/`openai>=2.43`/`anthropic>=0.111`/`google-genai>=2.9`/`instructor>=1.15`/`tenacity>=9.1`/`pydantic>=2.13`/`pydantic-settings>=2.14`/`structlog>=26.1`/`asyncpg>=0.31`/`alembic>=1.18`/`fastapi>=0.137`/`uvicorn>=0.49`/`cryptography>=49`（每条 ≤ lockfile 实锁，同小版本线的 sqlalchemy/psycopg 留原样）。`uv.lock` 变动为**纯元数据刷新**——仅各 workspace 成员 `[package.metadata].requires-dist` 的 specifier 字符串随下界更新，**零 pinned `version=` 变动、零 re-resolve、零第三方版本 bump**。root dev 工具下界（pytest/ruff/mypy/httpx）+ 前端 vitest 3.x/tailwind 4.x 升级评估**明确不纳入**（非运行时可复现关键，超范围）。**门禁**：`uv lock --check` 绿（元数据刷新后一致）· `uv run ruff check .` 干净 · pytest **971 passed**（与基线一致，无回归）。无源码/测试改动。
 - [2026-07-08] @llm — **✅ QA-CR MEDIUM/LOW 网关+链整改批（CR-M2/M3/L1@llm/M1.4，TDD 逐项提交）**。**完成 6**：`32451a9` pricing 未知 model 发 `pricing_unknown_model` warning（成本仍 0）；`9439b97` 三 adapter 瞬时错误消息经 `provider_error_summary(exc)` 只留类名+status（不泄 vendor 响应体）；`832ab7d` `OpenAICompatAdapter.probe_connection()` 公开探测 + provider_deps 弃私有 `_client` 反手（CR-M1.4）；`c9ffada` 续写链前一章无已验收终稿发 `chain_prior_accepted_missing` warning（CR-L1）；`ec91c8f` 链 runner 改用公开 `graph.aget_state(config).interrupts` 判暂停（弃私有 `__interrupt__`）；`6a739ca` review 节点五审 `asyncio.gather` 并行扇出（复用主图 add-only 记账并发范式 T3.8，collect 一次落库）。**SKIP 2**：CR-M2 `is_open()` CQS（惰性半开转移是唯一转半开点、拆分漏发命令会致熔断永不复位，风险>收益）；CR-M3 `run_overdue_scan` 幂等（`scan_overdue` 本已是原子 `UPDATE...RETURNING`+`NOT IN[CLOSED,OVERDUE]`+commit-only-if-changed，且下一章 current+1 扫描自愈漏标，再动会触碰验收事务边界）。**门禁全绿**：后端 ruff/format 干净 · mypy **232 文件** · pytest **971 passed**（+11 新测：pricing 2 / 错误脱敏 4 / probe 2 / 续写缺前文告警 2 / 并行审 1）· 无 DDL/无迁移。守不变量 #1/#3/#4（熔断/验收事务/add-only 记账 sink 未动）。
 - [2026-07-08] @llm/@backend/@devops/@frontend — **✅ QA-CR CRITICAL + HIGH 整改批全部落地**（14 项 + 4 低危收尾）。多 agent 工作流：先 14 个只读 agent 逐项**扎根真实代码**产精确修复+测试规格（纠出 3 处台账前提漂移），再按 owner 四簇**串行整合**入单工作树（避免并发写树 + repo 级 `ruff format .` 竞态），各 TDD 红→绿、逐项补回归测试、逐 fix 小步提交，末尾 14 个 skeptic **对抗式复核**（实证每条 test 非 vacuous，0 problem）。**关键落地/纠偏**：C1 next 15.1.3→**15.5.20**+react **19.2.7**（`pnpm audit` 清、`dependencyFloors.ts` 下界守卫，**CVE 号无法对真库核验+密钥轮换为用户运维事项**）；C2 **前提证伪**（langgraph 默认上限 10007 非 25，无实活崩溃）仍加显式顶层 `recursion_limit`；H4 request_id **条件透传**（否则覆盖 contextvars 反退化）；H2 修请求级 httpx 泄漏时**揪出 E2E 会误触真网**（override 跟随修）；H9 全文本字段上限+2 MiB body 中间件 413 兜底（契约 C3，`gen:api` 无漂移）；H8 `.env.example` 换不可用占位符（**真 key 仍在 git 历史，曾用环境须轮换**）。**门禁全绿**：后端 mypy 229/pytest **934**/alembic 无漂移；前端 vitest **669**/build/coverage 95.41%。契约 C1-扩（LlmRequest.request_id）+ C3（H9 caps）。**MEDIUM/LOW 择批后清理。** 提交 `cb8fddf`→`dd6d2fc`（19 提交）。

--- a/apps/api/pyproject.toml
+++ b/apps/api/pyproject.toml
@@ -3,10 +3,10 @@ name = "ww-api"
 version = "0.0.0"
 requires-python = ">=3.12"
 dependencies = [
-  "fastapi>=0.111",
-  "uvicorn[standard]>=0.30",
-  "structlog>=24.1",
-  "cryptography>=43",
+  "fastapi>=0.137",
+  "uvicorn[standard]>=0.49",
+  "structlog>=26.1",
+  "cryptography>=49",
  "ww-shared",
  "ww-config",
  "ww-db",
--- a/packages/agents/pyproject.toml
+++ b/packages/agents/pyproject.toml
@@ -3,7 +3,7 @@ name = "ww-agents"
 version = "0.0.0"
 requires-python = ">=3.12"
 dependencies = [
-  "pydantic>=2.7",
+  "pydantic>=2.13",
  "ww-shared",
  "ww-llm-gateway",
 ]
--- a/packages/config/pyproject.toml
+++ b/packages/config/pyproject.toml
@@ -2,7 +2,7 @@
 name = "ww-config"
 version = "0.0.0"
 requires-python = ">=3.12"
-dependencies = ["pydantic>=2.7", "pydantic-settings>=2.3", "ww-shared"]
+dependencies = ["pydantic>=2.13", "pydantic-settings>=2.14", "ww-shared"]

 [build-system]
 requires = ["hatchling"]
--- a/packages/core/pyproject.toml
+++ b/packages/core/pyproject.toml
@@ -3,10 +3,10 @@ name = "ww-core"
 version = "0.0.0"
 requires-python = ">=3.12"
 dependencies = [
-  "langgraph>=0.2.40",
-  "langgraph-checkpoint-postgres>=2.0",
-  "pydantic>=2.7",
-  "structlog>=24.1",
+  "langgraph>=1.2",
+  "langgraph-checkpoint-postgres>=3.1",
+  "pydantic>=2.13",
+  "structlog>=26.1",
  "ww-shared",
  "ww-config",
  "ww-db",
--- a/packages/db/pyproject.toml
+++ b/packages/db/pyproject.toml
@@ -4,9 +4,9 @@ version = "0.0.0"
 requires-python = ">=3.12"
 dependencies = [
  "sqlalchemy[asyncio]>=2.0",
-  "asyncpg>=0.29",
+  "asyncpg>=0.31",
  "psycopg[binary]>=3.2",
-  "alembic>=1.13",
+  "alembic>=1.18",
  "ww-shared",
  "ww-config",
 ]
--- a/packages/llm_gateway/pyproject.toml
+++ b/packages/llm_gateway/pyproject.toml
@@ -3,13 +3,13 @@ name = "ww-llm-gateway"
 version = "0.0.0"
 requires-python = ">=3.12"
 dependencies = [
-  "openai>=1.40",
-  "anthropic>=0.34",
-  "google-genai>=0.3",
-  "instructor>=1.5",
-  "pydantic>=2.7",
-  "tenacity>=8.2",
-  "structlog>=24.1",
+  "openai>=2.43",
+  "anthropic>=0.111",
+  "google-genai>=2.9",
+  "instructor>=1.15",
+  "pydantic>=2.13",
+  "tenacity>=9.1",
+  "structlog>=26.1",
  "ww-shared",
  "ww-config",
  "ww-db",
--- a/packages/shared/pyproject.toml
+++ b/packages/shared/pyproject.toml
@@ -2,7 +2,7 @@
 name = "ww-shared"
 version = "0.0.0"
 requires-python = ">=3.12"
-dependencies = ["pydantic>=2.7"]
+dependencies = ["pydantic>=2.13"]

 [build-system]
 requires = ["hatchling"]
--- a/packages/skills/pyproject.toml
+++ b/packages/skills/pyproject.toml
@@ -3,7 +3,7 @@ name = "ww-skills"
 version = "0.0.0"
 requires-python = ">=3.12"
 dependencies = [
-  "pydantic>=2.7",
+  "pydantic>=2.13",
  "sqlalchemy>=2.0",
  "ww-shared",
  "ww-db",
--- a/uv.lock
+++ b/uv.lock
@@ -2496,7 +2496,7 @@ dependencies = [

 [package.metadata]
 requires-dist = [
-    { name = "pydantic", specifier = ">=2.7" },
+    { name = "pydantic", specifier = ">=2.13" },
    { name = "ww-llm-gateway", editable = "packages/llm_gateway" },
    { name = "ww-shared", editable = "packages/shared" },
 ]
@@ -2519,10 +2519,10 @@ dependencies = [

 [package.metadata]
 requires-dist = [
-    { name = "cryptography", specifier = ">=43" },
-    { name = "fastapi", specifier = ">=0.111" },
-    { name = "structlog", specifier = ">=24.1" },
-    { name = "uvicorn", extras = ["standard"], specifier = ">=0.30" },
+    { name = "cryptography", specifier = ">=49" },
+    { name = "fastapi", specifier = ">=0.137" },
+    { name = "structlog", specifier = ">=26.1" },
+    { name = "uvicorn", extras = ["standard"], specifier = ">=0.49" },
    { name = "ww-config", editable = "packages/config" },
    { name = "ww-core", editable = "packages/core" },
    { name = "ww-db", editable = "packages/db" },
@@ -2542,8 +2542,8 @@ dependencies = [

 [package.metadata]
 requires-dist = [
-    { name = "pydantic", specifier = ">=2.7" },
-    { name = "pydantic-settings", specifier = ">=2.3" },
+    { name = "pydantic", specifier = ">=2.13" },
+    { name = "pydantic-settings", specifier = ">=2.14" },
    { name = "ww-shared", editable = "packages/shared" },
 ]

@@ -2564,10 +2564,10 @@ dependencies = [

 [package.metadata]
 requires-dist = [
-    { name = "langgraph", specifier = ">=0.2.40" },
-    { name = "langgraph-checkpoint-postgres", specifier = ">=2.0" },
-    { name = "pydantic", specifier = ">=2.7" },
-    { name = "structlog", specifier = ">=24.1" },
+    { name = "langgraph", specifier = ">=1.2" },
+    { name = "langgraph-checkpoint-postgres", specifier = ">=3.1" },
+    { name = "pydantic", specifier = ">=2.13" },
+    { name = "structlog", specifier = ">=26.1" },
    { name = "ww-config", editable = "packages/config" },
    { name = "ww-db", editable = "packages/db" },
    { name = "ww-llm-gateway", editable = "packages/llm_gateway" },
@@ -2589,8 +2589,8 @@ dependencies = [

 [package.metadata]
 requires-dist = [
-    { name = "alembic", specifier = ">=1.13" },
-    { name = "asyncpg", specifier = ">=0.29" },
+    { name = "alembic", specifier = ">=1.18" },
+    { name = "asyncpg", specifier = ">=0.31" },
    { name = "psycopg", extras = ["binary"], specifier = ">=3.2" },
    { name = "sqlalchemy", extras = ["asyncio"], specifier = ">=2.0" },
    { name = "ww-config", editable = "packages/config" },
@@ -2616,13 +2616,13 @@ dependencies = [

 [package.metadata]
 requires-dist = [
-    { name = "anthropic", specifier = ">=0.34" },
-    { name = "google-genai", specifier = ">=0.3" },
-    { name = "instructor", specifier = ">=1.5" },
-    { name = "openai", specifier = ">=1.40" },
-    { name = "pydantic", specifier = ">=2.7" },
-    { name = "structlog", specifier = ">=24.1" },
-    { name = "tenacity", specifier = ">=8.2" },
+    { name = "anthropic", specifier = ">=0.111" },
+    { name = "google-genai", specifier = ">=2.9" },
+    { name = "instructor", specifier = ">=1.15" },
+    { name = "openai", specifier = ">=2.43" },
+    { name = "pydantic", specifier = ">=2.13" },
+    { name = "structlog", specifier = ">=26.1" },
+    { name = "tenacity", specifier = ">=9.1" },
    { name = "ww-config", editable = "packages/config" },
    { name = "ww-db", editable = "packages/db" },
    { name = "ww-shared", editable = "packages/shared" },
@@ -2637,7 +2637,7 @@ dependencies = [
 ]

 [package.metadata]
-requires-dist = [{ name = "pydantic", specifier = ">=2.7" }]
+requires-dist = [{ name = "pydantic", specifier = ">=2.13" }]

 [[package]]
 name = "ww-skills"
@@ -2654,7 +2654,7 @@ dependencies = [

 [package.metadata]
 requires-dist = [
-    { name = "pydantic", specifier = ">=2.7" },
+    { name = "pydantic", specifier = ">=2.13" },
    { name = "sqlalchemy", specifier = ">=2.0" },
    { name = "ww-agents", editable = "packages/agents" },
    { name = "ww-db", editable = "packages/db" },