Skip to content

fix(deps): update dependency reflex to >=0.9.3#54

Open
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/reflex-0.x
Open

fix(deps): update dependency reflex to >=0.9.3#54
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/reflex-0.x

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Feb 17, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
reflex >=0.8.26 → >=0.9.3 age confidence

Release Notes

reflex-dev/reflex (reflex)

v0.9.3

Compare Source

Breaking Changes

  • Lifespan tasks will now be passed an rx.App instance instead of a Starlette instance

New Features

Persistent Frontend Dep Locking

Projects should commit the new reflex.lock directory which includes package.json and bun.lock. This helps avoid accidentally introducing upstream changes and helps protect against supply chain attacks.

reflex cloud deploy --gcp
EmbedPlugin

With the EmbedPlugin, a Reflex frontend can now be mounted into an existing DOM element in a custom HTML page by simply including the entry point javascript.

frontend_compression_formats

The build process now produces .gz sidecar files during export and serves them to supported clients for reflex run --env prod.

Improvements

Bug Fixes

Compiler
CLI
Other Areas

Doc / Web

Telemetry Improvements

Other Changes

New Contributors

Full Changelog: reflex-dev/reflex@v0.9.2.post1...v0.9.3

v0.9.2.post1

Compare Source

Full Changelog: reflex-dev/reflex@v0.9.2...v0.9.2.post1

v0.9.2

Compare Source

Release Notes

Rewriting the frontend compiler to be plugin-based

Drop JSON5 frontend dependency

Deprecate rx.Model

Use sqlAlchemy/sqlmodel directly.

Bugfxies

Docs

Chores

New Contributors

Full Changelog: reflex-dev/reflex@v0.9.1...v0.9.2

v0.9.1: 0.9.1

Compare Source

Release Notes

Bugfixes

Docs

Chores

Full Changelog: reflex-dev/reflex@v0.9.0...v0.9.1

v0.9.0

Release Notes

BREAKING CHANGES

reflex-enterprise must upgrade to >= 0.7.0.post1

Due to internal changes detailed below, reflex-enterprise has been updated to use the new event queuing mechanism. The latest reflex-enterprise package retains compatibility with reflex >= 0.8.23.

Database support is now opt-in (#​6293)

pydantic, sqlmodel, and alembic have been removed from Reflex's base dependencies. If your app uses rx.Model, rx.session, database migrations, or any other DB feature, you must now:

  1. Install the DB extra: pip install 'reflex[db]~=0.9.0'
  2. Set db_url in your rxconfig.py, for example:
config = rx.Config(
    app_name="my_app",
    db_url="sqlite:///reflex.db",
)

Apps that do not use the database can drop these dependencies entirely.

Event processing moved to the backend (#​6267)

The primary responsibility for chaining and queueing events has moved from the frontend to the backend. This removes an extra client round-trip when chaining events with yield, but it requires changes for anyone reaching into the internals.

Removed / renamed (Python):

  • App.process_background and rx.app.process are removed — use the new app.event_processor (a BaseStateEventProcessor / EventProcessor) which owns the full event lifecycle, including background tasks.
  • App._background_tasks replaced by App.event_processor._tasks.
  • State.class_substates is removed — use State.get_substates() instead.
  • AppHarness state helpers removed (reflex/testing.py): state_manager, get_state(token), set_state(token, **kwargs), modify_state(token), poll_for_clients(), and _reset_backend_state_manager() are all gone. Tests should drive state changes through the app's event processor / in-app assertions instead.
  • Event.token field removed — the token now lives on EventContext.
  • Event.substate_token replaced by the Event.state_cls property (resolved via the new registry).
  • Delta type refined from dict[str, Any] to dict[str, dict[str, Any]] (nested by substate name).
  • StateManager.create() no longer accepts a state= argument — state classes are discovered from the registry.
  • StateToken (reflex/istate/manager/token.py) replaces raw "client_token_substate" strings across all state managers (disk / memory / redis). StateToken and BaseStateToken are exported from reflex.
  • EventHandlerSetVar.state_cls renamed to .state (to match EventHandler).
  • fix_events removed from the semi-public event API — use Event.from_event_type().
  • get_hydrate_event removed — hydration is now handled internally; simulated pre-hydrated states are gone.

Frontend (state.js):

  • applyEvent() now returns void (previously returned bool); the internal event_processing flag was removed.
  • StateUpdate only includes non-empty fields to reduce bytes over the wire.
  • Params are passed around as a ref instead of inline.
Production mode runs on a single port (#​6297)

Production deployments now always serve the frontend and backend on the same port (what used to be --single-port). Consequences:

  • You cannot pass different --frontend-port and --backend-port values in --env PROD.
  • The frontend is now served via Starlette StaticFiles through granian/uvicorn instead of a separate sirv process.
  • The sirv-cli npm dependency has been removed.
  • prerequisites.check_running_mode() now returns a RunningMode enum (FRONTEND_ONLY, BACKEND_ONLY, FULLSTACK) instead of a (bool, bool) tuple.
state_auto_setters default is now False (#​6292)

Auto-generated setters (set_<var>) are no longer created by default. Define explicit event handlers for setting state vars, e.g.:

class MyState(rx.State):
    count: int = 0

    @&#8203;rx.event
    def set_count(self, value: int):
        self.count = value

Existing apps can opt back in temporarily with rx.Config(state_auto_setters=True, ...), but the option is now deprecated and will be removed in 1.0. Explicitly setting state_auto_setters (either value) will emit a deprecation warning.

Other removed deprecations (#​6292)
  • PydanticV1 support got deleted (along rx.Base). Please migrate to either dataclasses or PydanticV2.
  • App.overlay_component removed — use extra_app_wraps to inject an overlay component.
  • rx.Model default primary key override: defining your own primary key no longer silently drops the built-in id field. If you need custom PKs on a registered SQLModel class, register it via @rx.ModelRegistry.register and declare the table explicitly.
  • MutableProxy keys in State.get_value(...) are no longer accepted — pass a str key.
  • codeblock in rx.markdown component_map removed — use pre instead to customize code-block rendering.
  • 'string-name' entries in disable_plugins are still supported in 0.9.0 but now targeted for removal in 1.0 (pass Plugin classes directly, e.g. disable_plugins=[SitemapPlugin]).
  • RouterData.page deprecation has been pushed out to 1.0 — still works in 0.9.0, use RouterData.url going forward.

What's Changed

Performance Improvements

Bugfixes

Docs

Chores

New Contributors

Full Changelog: reflex-dev/reflex@v0.8.28...v0.9.0

v0.8.28

Compare Source

Bugfixes

Performance Improvements

Chores

Full Changelog: reflex-dev/reflex@v0.8.27...v0.8.28

v0.8.27

Compare Source

Release Notes

Components Improvements

Bugfixes

Performance Improvements

Chores

New Contributors

Full Changelog: reflex-dev/reflex@v0.8.26...v0.8.27

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@semanticdiff-com
Copy link
Copy Markdown

semanticdiff-com Bot commented Feb 17, 2026

Review changes with  SemanticDiff

@gitnotebooks
Copy link
Copy Markdown

gitnotebooks Bot commented Feb 17, 2026

Review these changes at https://app.gitnotebooks.com/AlphaSphereDotAI/AlphaSphereDotAI.github.io/pull/54

@deepsource-io
Copy link
Copy Markdown
Contributor

deepsource-io Bot commented Feb 17, 2026 •
edited
Loading

DeepSource Code Review

We reviewed changes in 8096ed9...fb7a192 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade   Security  

Reliability  

Complexity  

Hygiene  

Code Review Summary

Analyzer Status Updated (UTC) Details
Secrets Apr 21, 2026 12:55a.m. Review ↗
Python Apr 21, 2026 12:55a.m. Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

@mergify
Copy link
Copy Markdown
Contributor

mergify Bot commented Feb 17, 2026 •
edited
Loading

🧪 CI Insights

Here's what we observed from your CI run for 611095f.

🟢 All jobs passed!

But CI Insights is watching 👀

@renovate renovate Bot force-pushed the renovate/reflex-0.x branch from 71a439d to ba7532a Compare March 17, 2026 02:01
@renovate renovate Bot changed the title fix(deps): update dependency reflex to >=0.8.27 fix(deps): update dependency reflex to >=0.8.28 Mar 17, 2026
@renovate renovate Bot force-pushed the renovate/reflex-0.x branch from 611095f to 8778392 Compare March 19, 2026 21:56
@renovate renovate Bot changed the title fix(deps): update dependency reflex to >=0.8.28 fix(deps): update dependency reflex to >=0.8.28.post1 Mar 19, 2026
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented Mar 19, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@renovate renovate Bot changed the title fix(deps): update dependency reflex to >=0.8.28.post1 fix(deps): update dependency reflex to >=0.9.0 Apr 21, 2026
@renovate renovate Bot force-pushed the renovate/reflex-0.x branch from 952bb51 to 20d7c2d Compare April 21, 2026 00:53
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 21, 2026 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedreflex@​0.8.26 ⏵ 0.9.391 +6100100100100

View full report

@renovate renovate Bot force-pushed the renovate/reflex-0.x branch from fb7a192 to 6933126 Compare April 27, 2026 23:03
@renovate renovate Bot force-pushed the renovate/reflex-0.x branch from 38c5ed0 to 7f9c864 Compare May 7, 2026 01:36
@renovate renovate Bot changed the title fix(deps): update dependency reflex to >=0.9.1 fix(deps): update dependency reflex to >=0.9.2 May 7, 2026
@renovate renovate Bot had a problem deploying to code_quality May 7, 2026 01:37 Failure
@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 7, 2026 •
edited
Loading

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

@renovate renovate Bot force-pushed the renovate/reflex-0.x branch from e00d818 to eef6a29 Compare May 11, 2026 17:51
@renovate renovate Bot changed the title fix(deps): update dependency reflex to >=0.9.2 fix(deps): update dependency reflex to >=0.9.2.post1 May 11, 2026
@renovate renovate Bot force-pushed the renovate/reflex-0.x branch from cbdbecc to 765aa70 Compare May 18, 2026 12:50
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented May 18, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@renovate renovate Bot force-pushed the renovate/reflex-0.x branch from ba59ca4 to fadca80 Compare May 23, 2026 01:47
@renovate renovate Bot changed the title fix(deps): update dependency reflex to >=0.9.2.post1 fix(deps): update dependency reflex to >=0.9.3 May 23, 2026
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented May 23, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies PyProject

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@MH0386