Skip to content

Dependency cleanup#1967

Merged
thealligatorking merged 4 commits intoopentensor:stagingfrom
backend-developers-ltd:deps_cleanup
Jun 3, 2024
Merged

Dependency cleanup#1967
thealligatorking merged 4 commits intoopentensor:stagingfrom
backend-developers-ltd:deps_cleanup

Conversation

@mjurbanski-reef
Copy link
Contributor

@mjurbanski-reef mjurbanski-reef commented Jun 1, 2024

Changes:

  • Remove pytest, black dependencies from bittensor package requirements. They are now installed only if bittensor[dev] extras group is requested.
  • Loosen up production dependency requirements.
  • Configure Dependabot to detect outdated (in terms of security patches) production dependencies
  • support ~= version specifier in check_compatiblity.sh

Dependabot has to be enabled in https://github.com/opentensor/bittensor/settings/security_analysis (please note config file has to be present in default branch for it to be considered by Dependabot).

It is recommended that applications use tools allowing for proper dependency locking e.g. pdm, pip-tools, poetry.

This change is still rather conservative, as it mostly unblocks only .patch versions to be updated.
In some packages with strong semver support (e.g. aiohttp) I opted to constrain only major version already.
In future we should be able to do just >=MAJOR.MINOR for most package that declare semver use and without known vulnerabilities, but for now I opted for safer route of taking one step at a time.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants