From 81d2493476173c1f5a7d7e38b366e3162cfc51e2 Mon Sep 17 00:00:00 2001 From: Krzysztof kuhy Rudnicki Date: Fri, 28 Aug 2026 13:37:25 +0200 Subject: [PATCH] gatelock + crdt-sync: exact-pin every Python dependency Sixteen `>=` floors become exact pins across the two Python packages, taking five majors with them: mypy 1.13 -> 2.3.1, pylint 3.3 -> 4.0.7, pytest 8 -> 9, pytest-cov 5 -> 7, bandit 1.7 -> 1.9.4, plus ruff 0.15 -> 0.16.5 and requests/types-requests. A `>=` floor is satisfied by everything newer, so it told a checker nothing about whether these repos were actually current. Verified in a clean venv per repo, which is what both CI workflows do (`pip install -r requirements.txt`): gatelock 389 tests at 100% coverage under xvfb, crdt-sync 432 tests at 100%. No test change was needed for any of the five majors. **Open, and deliberately not in this commit:** `.pre-commit-config.yaml` pins these same tools AGAIN via `rev:` (ruff v0.15.2, mypy v1.13.0, pylint v3.3.2), independently of requirements.txt, and the gate does not read `rev:` pins at all -- so the linters CI actually runs are still on the old majors. Bumping them is a separate and much larger job: ruff 0.16 raises 71 findings here (CPY001 alone accounts for many, since this repo selects ALL) and mypy 2.x raises 60, mostly stricter implicit-re-export rules. One major per commit, and that is several. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK --- crdt-sync/pyproject.toml | 2 +- crdt-sync/requirements.txt | 21 ++++++++++++--------- gatelock/pyproject.toml | 2 +- gatelock/requirements.txt | 17 ++++++++++------- 4 files changed, 24 insertions(+), 18 deletions(-) diff --git a/crdt-sync/pyproject.toml b/crdt-sync/pyproject.toml index ea28ccd..44411ec 100644 --- a/crdt-sync/pyproject.toml +++ b/crdt-sync/pyproject.toml @@ -3,7 +3,7 @@ name = "crdt-sync" version = "0.9.0" description = "Shared CRDT merge scheme + GitHub-Contents-API sync transport for cross-device apps" requires-python = ">=3.10" -dependencies = ["requests"] +dependencies = ["requests==2.34.2"] # Ship only the library. `tool/` is a package too (it has an __init__.py so # its scripts import cleanly), and setuptools' flat-layout auto-discovery diff --git a/crdt-sync/requirements.txt b/crdt-sync/requirements.txt index 2e554ba..cdad590 100644 --- a/crdt-sync/requirements.txt +++ b/crdt-sync/requirements.txt @@ -1,9 +1,12 @@ -bandit[toml]>=1.7 -mypy>=1.13 -pre-commit>=4.0 -pylint>=3.3 -pytest>=8.0 -pytest-cov>=5.0 -requests>=2.31 -ruff>=0.15 -types-requests>=2.31 +# Exact pins, enforced by the shared dependency-freshness gate: a `>=` +# floor is satisfied by anything newer, so it tells a checker nothing +# about whether this repo is actually current. +bandit[toml]==1.9.4 +mypy==2.3.1 +pre-commit==4.6.2 +pylint==4.0.7 +pytest==9.1.1 +pytest-cov==7.1.0 +requests==2.34.2 +ruff==0.16.5 +types-requests==2.33.0.20260712 diff --git a/gatelock/pyproject.toml b/gatelock/pyproject.toml index 93608e9..fce82d1 100644 --- a/gatelock/pyproject.toml +++ b/gatelock/pyproject.toml @@ -15,7 +15,7 @@ dependencies = [] # pure stdlib — tkinter is bundled with Python # promptly — so this must stay OPTIONAL: a locker that refuses to start # because a dependency is missing is itself a way to end up unlocked. # Consumers' install scripts install it unconditionally all the same. -randr = ["python-xlib>=0.33"] +randr = ["python-xlib==0.33"] [tool.setuptools.packages.find] include = ["gatelock*"] diff --git a/gatelock/requirements.txt b/gatelock/requirements.txt index 6cd88cc..2222fa1 100644 --- a/gatelock/requirements.txt +++ b/gatelock/requirements.txt @@ -1,7 +1,10 @@ -bandit[toml]>=1.7 -mypy>=1.13 -pre-commit>=4.0 -pylint>=3.3 -pytest>=8.0 -pytest-cov>=5.0 -ruff>=0.15 +# Exact pins, enforced by the shared dependency-freshness gate: a `>=` +# floor is satisfied by anything newer, so it tells a checker nothing +# about whether this repo is actually current. +bandit[toml]==1.9.4 +mypy==2.3.1 +pre-commit==4.6.2 +pylint==4.0.7 +pytest==9.1.1 +pytest-cov==7.1.0 +ruff==0.16.5