Loosen dependency constraints to researched minimum versions#7
Merged
Conversation
Replace Poetry caret ranges (^) and requirements.txt exact pins (==) with flexible lower-bound constraints (>=) so patch/minor/major updates aren't blocked. Minimum versions were verified against actual API usage rather than just relaxing the previously pinned version: - TM1py >=2.0.4: tm1.sessions.get_threads_for_current() (used by the `threads` command) was only introduced in TM1py 2.0; 2.0.4 also fixes an uncaught-exception-on-logout bug in TM1Service.__exit__ that the `with TM1Service(...) as tm1:` pattern relies on. - typer >=0.9.3: Annotated-based Option/Argument declarations (used throughout tm1cli) were introduced in typer 0.9.0, but 0.9.0-0.9.2 have a bug evaluating annotations on Python 3.10 specifically, which is this project's minimum supported Python version. - pyyaml >=5.4: yaml.FullLoader (used in tm1yaml.py to load process dumps) exists since 5.1, but 5.4 is the first release without the arbitrary-code-execution issue (CVE-2020-14343) relevant since `process load` deserializes user-supplied YAML files. Dev-only tools (isort, pytest, pylint, pytest-mock) and transitive packages in requirements.txt keep their previously pinned version as the floor, since they aren't part of the published package's API surface and don't warrant the same investigation. Verified the mocked test suite, pylint, and the CLI itself against a fresh install resolving to the latest available versions of every dependency (TM1py 2.3.1, typer 0.26.8, pyyaml 6.0.3, rich 15.0.0). poetry.lock was refreshed accordingly; it still resolves to the same previously locked versions since Poetry keeps existing compatible versions rather than force-upgrading.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
^) inpyproject.tomland exact pins (==) inrequirements.txtwith flexible lower-bound constraints (>=), so patch/minor/major updates aren't blocked.TM1py >=2.0.4—tm1.sessions.get_threads_for_current()(used by thethreadscommand) was only introduced in TM1py 2.0; 2.0.4 also fixes an uncaught-exception-on-logout bug inTM1Service.__exit__that thewith TM1Service(...) as tm1:pattern used throughout the codebase relies on.typer >=0.9.3—Annotated-based Option/Argument declarations (used throughouttm1cli) were introduced in typer 0.9.0, but 0.9.0–0.9.2 have a bug evaluating annotations specifically on Python 3.10, which is this project's minimum supported Python version.pyyaml >=5.4—yaml.FullLoader(used intm1yaml.pyto load process dumps) exists since 5.1, but 5.4 is the first release without the arbitrary-code-execution issue (CVE-2020-14343), relevant sinceprocess loaddeserializes user-supplied YAML files.requirements.txtkeep their previously pinned version as the floor, since they aren't part of the published package's API surface.poetry.lockwas refreshed to match the new constraints; it resolves to the same previously locked versions since Poetry keeps existing compatible versions rather than force-upgrading.Test plan
pytest tests/test_cmd_cubes.py tests/test_cmd_dimension.py tests/test_cmd_subset.py tests/test_cmd_view.py) against a fresh install resolving to the latest available dependency versions (TM1py 2.3.1, typer 0.26.8, pyyaml 6.0.3, rich 15.0.0) — all 13 tests pass.pylintagainsttm1cli/**/*.pywith the same fresh install — 10.00/10.--helpat top level and for a subcommand) to confirm Typer still renders correctly with the newest resolvable typer version.Generated by Claude Code