fixing lock/dependabot min-python-supported-in-dev issues

Author: phfaist

.github/workflows/tests-ci.yml

@@ -9,18 +9,15 @@ on:
 #    - cron: "13 20 * * 3"
 
 jobs:
+
+  # Python 3.10 and later, running against the development tooling that
+  # 'uv.lock' pins.  These runs are fully reproducible.
   tests-ci:
 
     strategy:
       #fail-fast: true
       matrix:
-        # These should span the range declared by 'requires-python' in
-        # pyproject.toml.  uv downloads whichever interpreter is missing from
-        # the runner, so testing older pythons no longer needs an old (and by
-        # now unavailable) runner image.
         python-version:
-          - "3.8"
-          - "3.9"
           - "3.10"
           - "3.11"
           - "3.12"
@@ -41,3 +38,52 @@ jobs:
 
       - name: 'Run tests'
         run: uv run --frozen pytest
+
+
+  # Older pythons, down to the oldest one that the GitHub-hosted runners can
+  # still provide.  'uv.lock' deliberately covers python 3.10 and later only
+  # (see [tool.uv.dependency-groups] in pyproject.toml), so pytest is resolved
+  # on the fly here and uv picks whichever release still supports the
+  # interpreter.  These runs are therefore not pinned; a pytest release could
+  # in principle break them without any change on our side.
+  #
+  # The library is pure python and has no runtime dependencies, so there is
+  # nothing to build: it is used straight from the source tree via PYTHONPATH.
+  tests-ci-oldpy:
+
+    strategy:
+      #fail-fast: true
+      matrix:
+        python-version:
+          - "3.7"
+          - "3.8"
+          - "3.9"
+
+    # 'ubuntu-22.04' is the newest runner image for which 'actions/setup-python'
+    # still provides python 3.7.  uv's own python downloads only start at 3.8,
+    # which is why the interpreter comes from 'actions/setup-python' here and
+    # from 'astral-sh/setup-uv' in the job above.
+    runs-on: 'ubuntu-22.04'
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: 'Set up python ${{ matrix.python-version }}'
+        uses: actions/setup-python@v5
+        with:
+          python-version: '${{ matrix.python-version }}'
+
+      - name: 'Set up uv'
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      # '--no-project' keeps uv from consulting uv.lock (which does not describe
+      # this interpreter); '$(which python)' is the interpreter that
+      # 'actions/setup-python' just put on the PATH.
+      - name: 'Run tests (pytest resolved outside of uv.lock)'
+        env:
+          PYTHONPATH: '.'
+        run: >-
+          uv run --no-project --python "$(which python)" --with pytest
+          pytest

CLAUDE.md

@@ -69,11 +69,22 @@ Dependency groups (PEP 735, in `[dependency-groups]`): `dev` (pytest) is
 installed by a plain `uv sync`; `builddoc` (Sphinx) and `buildjslib`
 (Transcrypt, PyYAML) are opt-in via `--group`.
 
+All three groups are locked for python 3.10 and later only, via
+`[tool.uv.dependency-groups]` in `pyproject.toml`.  This concerns the
+development environment alone — the library keeps advertising python 3.6 and
+has no runtime dependencies — and it is what keeps `uv.lock` on current
+releases of the development tooling.  Without that restriction uv has to
+resolve the groups for python 3.6 as well, and locks one package set per python
+version, reaching back to releases that are long unmaintained and carry
+published vulnerabilities.  Do not widen it back without a good reason.
+
 The supported python range is declared once, by `requires-python` in
-`pyproject.toml` (currently `>=3.6`).  The `tests-ci` workflow matrix actually
-exercises 3.8 through 3.13, so the oldest declared versions (3.6 and 3.7) are
-not covered by continuous integration.  Python 2 is not supported; do not
-reintroduce compatibility shims for it.
+`pyproject.toml` (currently `>=3.6`).  The `tests-ci` workflow exercises 3.7
+through 3.13, in two jobs: 3.10 and later run against the locked tooling, while
+the older ones resolve pytest outside of `uv.lock` (and are correspondingly not
+reproducible).  Only python 3.6 is left uncovered, because the GitHub-hosted
+runners no longer provide an interpreter that old.  Python 2 is not supported;
+do not reintroduce compatibility shims for it.
 
 
 ## Constraints when editing

pyproject.toml

@@ -58,6 +58,22 @@ buildjslib = [
     "PyYAML>=5.0",
 ]
 
+# The development tooling does not have to run on every python version that the
+# library itself supports.  Restricting the groups to python 3.10 and later lets
+# uv lock current releases of pytest, Sphinx and their dependencies.  Without
+# this restriction the resolution has to accommodate python 3.6 (the
+# 'requires-python' value above), and uv then locks one set of packages per
+# python version, down to long-unmaintained releases for the oldest ones.
+#
+# This only concerns the development environment described by 'uv.lock'; the
+# library itself keeps advertising python 3.6 and has no runtime dependencies at
+# all.  The test suite still runs on older pythons, with pytest resolved outside
+# of the lock file; see '.github/workflows/tests-ci.yml'.
+[tool.uv.dependency-groups]
+dev = { requires-python = ">=3.10" }
+builddoc = { requires-python = ">=3.10" }
+buildjslib = { requires-python = ">=3.10" }
+
 [tool.uv]
 # Only "dev" is installed by a plain `uv sync`; "builddoc" and "buildjslib" are
 # opt-in via `--group`.