Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dependency cleanup #1967

Merged

Conversation

mjurbanski-reef
Copy link
Contributor

@mjurbanski-reef mjurbanski-reef commented Jun 1, 2024

Changes:

  • Remove pytest, black dependencies from bittensor package requirements. They are now installed only if bittensor[dev] extras group is requested.
  • Loosen up production dependency requirements.
  • Configure Dependabot to detect outdated (in terms of security patches) production dependencies
  • support ~= version specifier in check_compatiblity.sh

Dependabot has to be enabled in https://github.com/opentensor/bittensor/settings/security_analysis (please note config file has to be present in default branch for it to be considered by Dependabot).

It is recommended that applications use tools allowing for proper dependency locking e.g. pdm, pip-tools, poetry.

This change is still rather conservative, as it mostly unblocks only .patch versions to be updated.
In some packages with strong semver support (e.g. aiohttp) I opted to constrain only major version already.
In future we should be able to do just >=MAJOR.MINOR for most package that declare semver use and without known vulnerabilities, but for now I opted for safer route of taking one step at a time.

@gus-opentensor gus-opentensor merged commit 0cf372e into opentensor:staging Jun 3, 2024
12 checks passed
@gus-opentensor gus-opentensor mentioned this pull request Jun 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants