Feat: Unbounded Dependency Pins in requirements.txt (Closes #47)#53
Feat: Unbounded Dependency Pins in requirements.txt (Closes #47)#53bradjin8 wants to merge 2 commits into
requirements.txt (Closes #47)#53Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds bounded Pillow constraints (>=12.2.0,<13), a pip-compile-generated ChangesDeterministic dependency management via lock file
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/update-lock.yml:
- Line 50: Replace the floating tag for the GitHub Action usage of
peter-evans/create-pull-request (currently "uses:
peter-evans/create-pull-request@v7") with a specific immutable commit SHA;
locate the "uses: peter-evans/create-pull-request@v7" line in the workflow, find
the latest verified commit SHA for that action (from the action's repository
tags or the marketplace), and update the string to "uses:
peter-evans/create-pull-request@<commit-sha>" so the workflow is pinned to a
specific commit instead of the v7 tag.
In `@requirements-lock.txt`:
- Line 16: The lockfile currently pins pillow==10.4.0 which contains multiple
high-severity vulnerabilities; update the upstream constraint that produced this
lock (the requirement spec "pillow>=10.3.0,<11") to allow Pillow 12.x (e.g.,
change to "pillow>=12.1.1" or "pillow>=12.2.0") after verifying that dependent
packages (notably fpdf2) are compatible with Pillow 12.2.0, then regenerate the
lock file (re-run your dependency lock/compile step) so the lock reflects
pillow==12.2.0 (or the chosen 12.x release) and ensure CI/tests pass.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 67859c4b-d312-4b72-b22c-53f21ba2fc9c
📒 Files selected for processing (6)
.github/dependabot.yml.github/workflows/tests.yml.github/workflows/update-lock.ymlpyproject.tomlrequirements-lock.txtrequirements.txt
|
README.md — Document lock-file workflow for contributors: CI uses requirements-lock.txt; how to regenerate (pip-compile command from the lock header); Dependabot + “Update dependency lock file” Actions. (Issue #47 asks for a documented update process; it lives only in YAML comments today.) .github/workflows/tests.yml (new step) — Add a lock freshness check, e.g. run pip-compile with the same flags as update-lock.yml and fail if requirements-lock.txt differs (git diff --exit-code). (Prevents requirements.txt / pyproject.toml edits without regenerating the lock while CI still passes.) .github/workflows/update-lock.yml:42-46 — Fix the “Restore header comment” step: HEADER is single-quoted, so \n is literal, not newline; printf '%s\n' "$HEADER" will write one malformed line when the workflow prepends the header after pip-compile --no-header. (The committed lock file is correct today; the first automated lock refresh will corrupt the header.) .github/dependabot.yml + update-lock.yml — Clarify the two-path maintenance model: Dependabot pip PRs may bump bounds in requirements.txt but do not refresh the lock; merging those should trigger (or be followed by) the lock workflow. (Reduces drift between bounds and pinned CI installs.) requirements.txt / pyproject.toml — Consider compiling from pyproject.toml (pip-compile pyproject.toml) or adding a CI check that [project.dependencies] matches requirements.txt. (Single source of truth; today sync is comment-only.) requirements-lock.txt — colorama is pinned as a transitive dep (Windows-oriented); harmless for reproducibility on Linux CI but matches the eval’s portability note. (No action required unless you want platform-specific lock files.) |
2 participants
Summary
Closes #47 — Unbounded Dependency Pins in
requirements.txtChanges
Bounded specifiers
requirements.txt: added missing upper bound onpillow(>=10.3.0,<11).flaskandfpdf2already had upper bounds from Missing pyproject.toml / No Python Packaging #45; now all three runtime deps are fully bounded.pyproject.toml: samepillowupper bound applied to[project.dependencies]to keep both files in sync.Lock file (
requirements-lock.txt, new)pip-compile(pip-tools) from the boundedrequirements.txt.flask==3.1.3,fpdf2==2.8.7,pillow==10.4.0, plusblinker,click,colorama,defusedxml,fonttools,itsdangerous,jinja2,markupsafe,werkzeug.pip-compileinvocation to regenerate it.CI (
.github/workflows/tests.yml)unittestandtypecheckjobs now install fromrequirements-lock.txtfirst, then layer the dev-only dep (pytest>=8,<9/mypy>=1.10,<2) on top.pip install 'flask>=3.0' 'fpdf2>=2.7' ...invocations.Dependabot (
.github/dependabot.yml, new)github-actions(keeps the pinned SHA actions current) andpip(opens PRs for new versions within the bounded ranges inrequirements.txt).Scheduled lock-file refresh (
.github/workflows/update-lock.yml, new)pip-compile --upgradeevery Monday at 08:00 UTC.peter-evans/create-pull-requestwith the refreshedrequirements-lock.txtfor review before merging.Acceptance criteria checklist
requirements.txthave both lower and upper boundsrequirements-lock.txtgenerated and committedSummary by CodeRabbit