[schloerke]

Python apps have been getting anyio 4.4.0 instead of the 4.9.0 that Pyodide 0.27.7 ships.

anyio was never pinned. It isn't in shinylive_requirements.json; it entered shinylive_lock.json as a dependency of starlette in 896a740 (posit-dev/shinylive#161, 2024-07-24), when Pyodide (0.26.x) didn't ship it. Pyodide added anyio and sniffio later, but make all only refreshes the local packages in the lockfile (update_lockfile_local), so the PyPI entries never moved. Lockfile entries replace Pyodide's, so the old anyio has replaced the newer one since then.

This removes the anyio and sniffio entries from shinylive_lock.json, which is what a full make update_packages_lock would do, since it skips dependencies Pyodide already ships. Pyodide's anyio 4.9.0 meets starlette's >=3.4.0,<5. sniffio is the same version in both (1.3.1); it goes too because it was only there for anyio. make all won't add them back, because _recurse_dependencies_lockfile skips packages in Pyodide's lock.

altair and narwhals also appear in both files, but the lockfile copies are newer than Pyodide's, so they are left alone.

[github-actions]

Unit tests only — the pure-logic modules in src/. The React components, hooks, engine proxies and service worker are covered by the pytest + Playwright suites in tests/, which are not measured here.

Coverage report

St.❔	Category	Percentage	Covered / Total
🟢	Statements	100%	1994/1994
🟢	Branches	100%	400/400
🟢	Functions	100%	96/96
🟢	Lines	100%	1994/1994

Test suite run success

342 tests passing in 20 suites.

Report generated by 🧪jest coverage report action from a2d6400