Regenerate requirements.txt from the declared dependencies - #457
Merged
Merged
Conversation
The lock had drifted from pyproject.toml: it was assembled by hand and by dependabot bumping individual entries, so it pinned some packages that are not dependencies while omitting transitive ones that are. Resolve it properly instead - install the project and the tools CI needs (pytest for the runner, openapi-spec-validator for tests/unit/openapi_test, pyflakes and build for build.sh) into a clean environment and freeze it. The environment is Python 3.11, the lowest version HSDS supports. A flat lock has to hold for every interpreter in the test matrix, and pins resolved on a newer one do not necessarily exist for an older: numpy 2.5.2 requires >= 3.12, so freezing on 3.12 produces a file that cannot install on 3.11 at all. Verified the result installs on 3.11, 3.12 and 3.13. setuptools is left out deliberately: it is build-environment tooling rather than a dependency of HSDS. h5json stays pointed at master rather than the commit pip freeze resolved, since pyproject declares @master and pinning a SHA here would silently override it. Verified by running the unit tests in the regenerated environment on 3.11: 87 passed.
mattjala
force-pushed
the
deps/regen-lockfile
branch
from
September 2, 2026 21:19
638481f to
b690674
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #456 — the regenerated lock resolves
requestsabove the cap that PR removes, so it cannot merge first.The lock had drifted from
pyproject.toml: assembled by hand and by dependabot bumping individual entries, it pinned packages that are not dependencies while omitting transitive ones that are. Regenerated by installing the project plus the tools CI needs (pytest,openapi-spec-validatorfortests/unit/openapi_test,pyflakes/buildforbuild.sh) into a clean environment and freezing.Adds 16 transitive packages the file never listed; drops
wheel.setuptoolsis left out as build tooling rather than a dependency, andh5jsonstays on@masterrather than the SHA freeze resolved, matchingpyproject.toml.Verified: 87 unit tests pass in the regenerated environment.
Two major-version moves worth a look —
aiobotocore2.13.0 → 3.0.0 andwrapt1.17.3 → 2.4.0. Both satisfy the rangespyproject.tomldeclares (aiobotocore >= 2.13.0, no bound on wrapt). HSDS only usesget_sessionandAioConfigfrom aiobotocore and both still import, but the S3 path is thinly covered by CI, so if you would rather stay on 2.x that belongs as an upper bound inpyproject.toml.