Repository navigation
deps: add upper bounds to remaining runtime dependencies - #268
Open
hamid-digitalmarketer wants to merge 1 commit into
Open
hamid-digitalmarketer wants to merge 1 commit into
hamid-digitalmarketer wants to merge 1 commit into
Conversation
Add upper bounds to the remaining runtime dependencies in pyproject.toml following the precedent set in Dpro-at#64. - Cap post-1.0 packages (pydantic, pydantic-settings, sqlalchemy, alembic, argon2-cffi, cryptography, websockets) at their next major version to prevent unreviewed breaking upgrades from arriving unannounced. - Cap pre-1.0 packages (uvicorn, aiosqlite, asyncpg, httpx) at <1.0 where minor positions carry breaking shifts. - Document the bounds rationale directly in pyproject.toml. Closes Dpro-at#65
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #65
Following up on #64, which added upper bounds for FastAPI and declared Starlette directly, this PR sets deliberate upper bounds for the remaining runtime dependencies in
pyproject.toml.Rationale
cryptography(<51): Currently resolves to 50.x (seven majors ahead of the 43.0 floor). Because cryptography provides audited AES-GCM primitives for customer credentials at rest, capping before the next major release prevents unreviewed cryptographic API shifts from landing unattended.<1.0): Foruvicorn[standard],aiosqlite,asyncpg, andhttpx, the minor position carries breaking shifts. Capping before1.0protects against unreviewed breaking changes while retaining flexibility within the current zero-major stream.<next major>):pydantic(<3),pydantic-settings(<3),sqlalchemy(<3),alembic(<2),argon2-cffi(<26), andwebsockets(<15) are bounded at their respective next major releases, ensuring semver breaking releases do not silently turn self-hoster installs or CI red.pyproject.tomlso future contributors understand the constraints.Contributor Direct Contact
For direct communication regarding this contribution, technical questions, collaboration, or follow-up:
Direct Contact / WhatsApp: +923167417135
Please feel free to contact me directly to discuss the implementation or coordinate further improvements.