Skip to content

Commit b2e495c

Browse files
committed
Loosen dependency constraints to researched minimum versions
Replace Poetry caret ranges (^) and requirements.txt exact pins (==) with flexible lower-bound constraints (>=) so patch/minor/major updates aren't blocked. Minimum versions were verified against actual API usage rather than just relaxing the previously pinned version: - TM1py >=2.0.4: tm1.sessions.get_threads_for_current() (used by the `threads` command) was only introduced in TM1py 2.0; 2.0.4 also fixes an uncaught-exception-on-logout bug in TM1Service.__exit__ that the `with TM1Service(...) as tm1:` pattern relies on. - typer >=0.9.3: Annotated-based Option/Argument declarations (used throughout tm1cli) were introduced in typer 0.9.0, but 0.9.0-0.9.2 have a bug evaluating annotations on Python 3.10 specifically, which is this project's minimum supported Python version. - pyyaml >=5.4: yaml.FullLoader (used in tm1yaml.py to load process dumps) exists since 5.1, but 5.4 is the first release without the arbitrary-code-execution issue (CVE-2020-14343) relevant since `process load` deserializes user-supplied YAML files. Dev-only tools (isort, pytest, pylint, pytest-mock) and transitive packages in requirements.txt keep their previously pinned version as the floor, since they aren't part of the published package's API surface and don't warrant the same investigation. Verified the mocked test suite, pylint, and the CLI itself against a fresh install resolving to the latest available versions of every dependency (TM1py 2.3.1, typer 0.26.8, pyyaml 6.0.3, rich 15.0.0). poetry.lock was refreshed accordingly; it still resolves to the same previously locked versions since Poetry keeps existing compatible versions rather than force-upgrading.
1 parent a4eb6de commit b2e495c

3 files changed

Lines changed: 80 additions & 36 deletions

File tree

poetry.lock

Lines changed: 50 additions & 6 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

pyproject.toml

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -9,15 +9,15 @@ repository = "https://github.com/onefloid/tm1cli"
99

1010
[tool.poetry.dependencies]
1111
python = "^3.10"
12-
TM1py = "^2.0.4"
13-
typer = "^0.13.1"
14-
pyyaml = "^6.0.2"
12+
TM1py = ">=2.0.4"
13+
typer = ">=0.9.3"
14+
pyyaml = ">=5.4"
1515

1616
[tool.poetry.group.dev.dependencies]
17-
isort = "^5.13.2"
18-
pytest = "^8.3.3"
19-
pylint = "^3.3.1"
20-
pytest-mock = "^3.14.0"
17+
isort = ">=5.13.2"
18+
pytest = ">=8.3.3"
19+
pylint = ">=3.3.1"
20+
pytest-mock = ">=3.14.0"
2121

2222
[tool.poetry.scripts]
2323
tm1cli = "tm1cli.main:app"

0 commit comments

Comments
 (0)