Skip to content

Pin Python dependencies in requirements.txt #2110

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Dec 28, 2024

Conversation

yvsvarma
Copy link
Contributor

@yvsvarma yvsvarma commented Dec 21, 2024

User description

Summary

  • Pinned the following Python dependencies in requirements.txt:
    • pytest==8.3.4
    • trio==0.27.0
    • pytest-trio==0.8.0
    • pytest-rerunfailures==14.0
    • flake8==7.1.1
    • requests==2.32.3

Justification

  • Ensures consistent behavior across environments.
  • Prevents unexpected issues from dependency updates or breaking changes.
  • Improves reproducibility and maintainability.

Verification

  • Verified with pytest:
    • 137 passed, 16 skipped (platform-specific).

PR Type

Enhancement


Description

  • Added version pinning for all Python dependencies in requirements.txt to ensure consistent behavior:
    • Testing: pytest==8.3.4, pytest-trio==0.8.0, pytest-rerunfailures==15.0
    • Development: flake8==7.1.1
    • Core dependencies: trio==0.27.0, requests==2.32.3
  • Improves reproducibility by preventing unexpected updates or breaking changes
  • Verified compatibility with existing test suite (137 passing tests)

Changes walkthrough 📝

Relevant files
Configuration changes
requirements.txt
Pin Python test and development dependencies                         

examples/python/requirements.txt

  • Pinned specific versions for 6 Python dependencies:
    - pytest
    (7.3.0), trio (0.22.0), pytest-trio (0.8.0)
    - pytest-rerunfailures
    (10.2), flake8 (6.1.0), requests (2.32.3)
  • Replaced unpinned dependencies with exact versions
  • +6/-6     

    💡 PR-Agent usage: Comment /help "your question" on any pull request to receive relevant information

    Copy link

    netlify bot commented Dec 21, 2024

    👷 Deploy request for selenium-dev pending review.

    Visit the deploys page to approve it

    Name Link
    🔨 Latest commit b218303

    @CLAassistant
    Copy link

    CLAassistant commented Dec 21, 2024

    CLA assistant check
    All committers have signed the CLA.

    Copy link
    Contributor

    PR Reviewer Guide 🔍

    Here are some key observations to aid the review process:

    ⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪
    🧪 No relevant tests
    🔒 No security concerns identified
    ⚡ Recommended focus areas for review

    Version Compatibility

    Verify that the pinned versions are compatible with each other and with the selenium version 4.27.1. Incompatible versions could cause runtime issues.

    selenium==4.27.1
    pytest==7.3.0
    trio==0.22.0
    pytest-trio==0.8.0
    pytest-rerunfailures==10.2
    flake8==6.1.0
    requests==2.32.3
    

    Copy link
    Contributor

    PR Code Suggestions ✨

    Explore these optional code suggestions:

    CategorySuggestion                                                                                                                                    Score
    Security
    Use flexible version constraints for test dependencies to ensure compatibility with security updates while maintaining stability

    Consider using compatible release specifiers (^) or greater-than-or-equal (>=) for
    test dependencies like pytest and flake8 to allow for patch and minor version
    updates that include bug fixes and security patches.

    examples/python/requirements.txt [2-6]

    -pytest==7.3.0
    -flake8==6.1.0
    +pytest>=7.3.0,<8.0.0
    +flake8>=6.1.0,<7.0.0
    • Apply this suggestion
    Suggestion importance[1-10]: 7

    Why: Using flexible version constraints for test dependencies is a good security practice as it allows for automatic updates of patch and minor versions that include bug fixes and security patches, while still maintaining compatibility through upper bounds.

    7

    @yvsvarma yvsvarma force-pushed the pin-python-dependencies branch from 9b31456 to 92f8c38 Compare December 23, 2024 17:10
    @VietND96
    Copy link
    Member

    VietND96 commented Dec 27, 2024

    It looks like pytest-rerunfailures==14.0 will be fine for CI using py3.8

    ERROR: Ignored the following versions that require a different python version: 0.28.0 Requires-Python >=3.9; 15.0 Requires-Python >=3.9
    ERROR: Could not find a version that satisfies the requirement pytest-rerunfailures==15.0 (from versions: 0.3, 0.5, 1.0.0, 1.0.1, 1.0.2, 2.0.0, 2.0.1, 2.1.0, 2.2, 3.0, 3.1, 4.0, 4.1, 4.2, 5.0, 6.0, 7.0, 8.0, 9.0, 9.1, 9.1.1, 10.0, 10.1, 10.2, 10.3, 11.0, 11.1, 11.1.1, 11.1.2, 12.0, 13.0, 14.0)
    ERROR: No matching distribution found for pytest-rerunfailures==15.0
    

    @yvsvarma yvsvarma force-pushed the pin-python-dependencies branch from 92f8c38 to b218303 Compare December 28, 2024 05:35
    @yvsvarma
    Copy link
    Contributor Author

    Hi @VietND96 , Thank you for pointing this out! I have updated the dependency to use pytest-rerunfailures==14.0, which is compatible with Python 3.8 and suitable for the CI environment. Please let me know if any additional changes are required. Thanks again for your feedback!

    @VietND96 VietND96 merged commit 21bab0f into SeleniumHQ:trunk Dec 28, 2024
    1 check passed
    @VietND96
    Copy link
    Member

    Thank you @yvsvarma! I merged your PR
    2 CI failed on macOS runners are not related to this change.

    @yvsvarma
    Copy link
    Contributor Author

    yvsvarma commented Jan 1, 2025

    Thank you @yvsvarma! I merged your PR 2 CI failed on macOS runners are not related to this change.

    Thank you @VietND96, for your time and efforts in reviewing this! 🙏🏻

    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Projects
    None yet
    Development

    Successfully merging this pull request may close these issues.

    3 participants