Skip to content

fix(deps): give the three unbounded dependencies a lower bound - #53

Merged
lesnik512 merged 1 commit into
mainfrom
fix/dependency-floors
Sep 20, 2026
Merged

lesnik512 merged 1 commit into
mainfrom
fix/dependency-floors

Conversation

@lesnik512

Copy link
Copy Markdown
Member

Closes #52.

tenacity, sqlalchemy[asyncio] and asyncpg were each declared as a bare name, so the declared range admitted every release ever published. SQLAlchemy resolved to 0.1.0, released in 2006:

Failed to build `sqlalchemy==0.1.0`

The package did not install at its own declared minimum on any supported Python.

The floors

Each bisected against the suite, not guessed:

dependency floor
tenacity >=8.4.1
sqlalchemy[asyncio] >=2.0.18, marked >=2.0.31 on 3.13+
asyncpg >=0.28, marked >=0.30 on 3.13 and >=0.31 on 3.14+

Two need marking per interpreter, both found by verifying the bisected floors on every supported Python rather than only the oldest:

  • SQLAlchemy below 2.0.31 fails its own TypingOnly check at import on 3.13+, against the __static_attributes__ and __firstlineno__ attributes Python 3.13 added.
  • asyncpg declares requires-python >=3.8 on every release but ships no cp313 wheel before 0.30 and no cp314 wheel before 0.31, so a resolver picks an sdist that cannot build rather than reporting a conflict.

Marked rather than raised outright, since 2.0.18 and 0.28 are genuinely fine on 3.11 and 3.12. Same shape as modern-python/faststream-outbox#186.

Verification

uv pip install --resolution lowest-direct . then the full suite against Postgres 17:

interpreter result
3.11 40 passed
3.12 40 passed
3.13 40 passed
3.14 40 passed

just lint-ci clean. Normal resolution: 40 passed.

Nothing changes at the top of the range, so this is inert for anyone not installing at the lower bound.

tenacity, sqlalchemy and asyncpg were declared as bare names, so the range
admitted every release ever published and sqlalchemy resolved to 0.1.0 from
2006, which does not build. Floors bisected against the suite.

sqlalchemy and asyncpg are marked per interpreter: sqlalchemy below 2.0.31
fails its own TypingOnly check at import on 3.13+, and asyncpg ships no
cp313 wheel before 0.30 or cp314 wheel before 0.31.

Closes #52
@lesnik512
lesnik512 merged commit af43bd4 into main Sep 20, 2026
7 checks passed
@lesnik512
lesnik512 deleted the fix/dependency-floors branch September 20, 2026 13:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

sqlalchemy is declared with no lower bound, so the declared minimum does not install

1 participant