[GitHub] [iceberg] Fokko commented on a diff in pull request #7376: Python: Provide version ranges for each dependency

["Fokko (via GitHub)" <gi...@apache.org>]

Fokko commented on code in PR #7376:
URL: https://github.com/apache/iceberg/pull/7376#discussion_r1173396152


##########
python/pyproject.toml:
##########
@@ -43,25 +43,25 @@ include = [{ path = "dev", format = "sdist" }]
 
 [tool.poetry.dependencies]
 python = "^3.8"
-mmhash3 = "3.0.1"
-requests = ">=2.28.1,<=2.28.2"
-click = "8.1.3"
-rich = ">=13.0.0,<=13.3.4"
-pyyaml = ">=5.4.0,<=6.0.0"
-pydantic = "1.10.7"
-fsspec = ">=2022.8.2,<=2023.3.0"
-pyparsing = "3.0.9"
-zstandard = "0.20.0"
-pyarrow = { version = ">=8.0.0,<=11.0.0", optional = true }
-pandas = { version = ">=1.4.4,<=1.5.3", optional = true }
-duckdb = { version = ">=0.6.0,<=0.7.1", optional = true }
-ray = { version = ">=2.0.0,<=2.3.1", optional = true }
-python-snappy = { version = "0.6.1", optional = true }
-thrift = { version = "0.16.0", optional = true }
-boto3 = { version = "1.24.59", optional = true }
-# The versions of the fsspec implementations should run in sync with fsspec above
-s3fs = { version = ">=2022.8.2,<=2023.3.0", optional = true }
-adlfs = { version = ">=2022.8.2,<=2023.3.0", optional = true }
+mmhash3 = "^3" # JUST: Unless 3.0.0's lack of Python 3.10/3.11 builds means it's a broken release, in which case ">=3.0.1, <4.0.0" may make sense, but it seems tests pass with 3.0.0.
+requests = "^2.20" # JUST: Tests pass with 2.22 (lower versions aren't compatible with some other strictly-pinned dependencies); picked nearby 2.20 as the most recent version without security risks.

Review Comment:
   Can you make sure that all the bound also have upper bounds?
   ```suggestion
   requests = "^2.20,<3" # JUST: Tests pass with 2.22 (lower versions aren't compatible with some other strictly-pinned dependencies); picked nearby 2.20 as the most recent version without security risks.
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org