Pin transitive dependencies to avoid dependabot uv.lock-only PRs - #312
Conversation
These are transitive deps of matplotlib (benchmark group) and pytest (test group). Pinning them directly avoids repeated dependabot uv.lock-only PRs and lets us own the version bumps explicitly. - pillow==12.2.0 (Python >= 3.10 only; 12.x dropped 3.9 support, so Python 3.9 continues to resolve pillow 11.3.0 via matplotlib) - fonttools==4.60.2 - pygments==2.20.0 https://claude.ai/code/session_016PmmThgtWzGhjy1aQZa9kC
Relaxes the pins added in the previous commit to minimum-version constraints so the resolver can still pick newer versions without requiring a pyproject.toml edit. https://claude.ai/code/session_016PmmThgtWzGhjy1aQZa9kC
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates several dependencies and adds explicit pins for transitive dependencies in pyproject.toml to manage dependency updates. My review identified a version mismatch for datasketch in uv.lock that lacks a corresponding update in pyproject.toml. Additionally, I recommend removing the explicit pins for transitive dependencies like pillow, fonttools, and pygments, as this practice over-constrains the environment and is better handled through Dependabot configuration.
| [[package]] | ||
| name = "datasketch" | ||
| version = "1.8.0" | ||
| version = "1.9.0" |
There was a problem hiding this comment.
The datasketch version was bumped to 1.9.0 in the lockfile, but no corresponding change appears in pyproject.toml. This inconsistency should be resolved by either updating the version in pyproject.toml or reverting the change in uv.lock.
version = "1.8.0"
| # Transitive deps of matplotlib listed to avoid dependabot uv.lock-only PRs. | ||
| "pillow>=12.2.0; python_version >= '3.10'", | ||
| "fonttools>=4.60.2", |
There was a problem hiding this comment.
Pinning transitive dependencies like pillow and fonttools to manage Dependabot noise is discouraged for libraries. This practice over-constrains the environment for downstream users and adds maintenance overhead, as these versions must be manually kept in sync with the requirements of the actual parent dependency (matplotlib). Consider using Dependabot's grouped-updates or ignore rules in .github/dependabot.yml instead.
| # Transitive dep of pytest listed to avoid dependabot uv.lock-only PRs. | ||
| "pygments>=2.20.0", |
There was a problem hiding this comment.
Explicitly listing pygments here as a workaround for Dependabot noise is an anti-pattern for libraries. It is better to manage this via Dependabot configuration to avoid unnecessary constraints on the test environment and potential conflicts with other packages.
2 participants
What does this PR do?
matplotlibandpytestinpyproject.tomlto prevent dependabot from creating uv.lock-only PRspillow>=12.2.0(for Python 3.10+) andfonttools>=4.60.2to benchmark dependenciespygments>=2.20.0to test dependenciesThese transitive dependencies are now explicitly listed to ensure they are tracked in version control and prevent unnecessary dependabot PRs that only update the lockfile.
Checklist
https://claude.ai/code/session_016PmmThgtWzGhjy1aQZa9kC