Repository navigation
chore(deps): update pyiceberg-core requirement from <0.8,>=0.7 to >=0.7,<0.11 - #245
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
the
dependencies
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
DORA Metrics
|
Dependabot has re-proposed both ceilings since 2026-08-23 (#244, #245) and both PRs sat unmergeable for sixteen days. Each pin had a one-line reason in a comment; neither reason was checkable without doing the work, so nobody did, and the PRs stayed open. Checked now, recorded where the pin is, and taught Dependabot to stop asking. mcp<2 holds. mcp 2.2.0 still exports Server from mcp.server, but its lowlevel Server defines neither list_tools nor call_tool, and integrations/agentflow_integrations/mcp/server.py is built entirely out of @server.list_tools() and @server.call_tool(). #244 proposed <3; taking mcp 2 is a port of that module, not a range change. Both halves of the mirrored pin now say which decorators are missing and which file needs the port. pyiceberg-core<0.8 holds, for a reason the old comment only half stated. PyIceberg 0.11.1 declares pyiceberg-core>=0.5.1,<0.9.0, so 0.8.0 is the only step up inside the pairing upstream supports -- and 0.8.0 is the one release in the line published as requires-python <3.13, which the 3.11-3.13 `environments` in [tool.uv] rule out. 0.9.0/0.9.1 restored 3.13 but sit outside PyIceberg's window. So nothing above 0.7 is installable here, which #245's <0.11 does not change: widening alone leaves the lock on 0.7.0 (verified -- `uv lock` rewrites only the recorded specifier), and `uv lock --upgrade-package pyiceberg-core` under it jumps to 0.10.1, i.e. exactly the pairing PyIceberg says it does not support. The ceiling moves when PyIceberg raises its own, and that arrives as a pyiceberg PR. .github/dependabot.yml ignores mcp majors -- in the root and integrations ecosystems, since they own the two halves of the same pin -- and pyiceberg-core minors, each with the reason and the exit condition inline. The file's existing NOTE about `ignore` also suppressing security updates applies unchanged: safety and pip-audit scan both packages and fail on a CVE that only a blocked bump would fix. No resolution change: `uv lock --check` passes untouched (256 packages). test_security_tooling_policy.py, test_contract_dependencies.py, test_cross_package_install_contract.py and test_mcp_server.py pass (44 passed), scripts/validate_project_claims.py OK, docs ratchets pass (33 passed). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018ybRVCaL1Lyd9d5kFTndh3
908d395 to
4b6d185
Compare
Updates the requirements on [pyiceberg-core](https://rust.iceberg.apache.org/) to permit the latest version. --- updated-dependencies: - dependency-name: pyiceberg-core dependency-version: 0.10.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
4b6d185 to
91341ef
Compare
|
Closing per the decision now recorded in |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Updates the requirements on pyiceberg-core to permit the latest version.