fix(ci): update constraint deps script to handle missing and regular dependencies#5865
Merged
Merged
Conversation
…dependencies The Dependabot constraint-update workflow was skipping dependencies not already in constraint-dependencies (e.g. google-genai). The script now follows a three-way lookup: constraint-dependencies first (authoritative), then regular dependency arrays in-place, then adds new entries to constraint-dependencies in alphabetical order if not found anywhere. Signed-off-by: Sébastien Han <[email protected]> Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> Signed-off-by: Sébastien Han <[email protected]>
leseb
requested review from
bbrowning,
cdoern,
franciscojavierarceo,
mattf and
raghotham
as code owners
May 18, 2026 07:39
franciscojavierarceo
approved these changes
May 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
The Dependabot constraint-update workflow was silently skipping dependencies not already listed in
constraint-dependencies(e.g.google-genai), causing Dependabot PRs to miss version floor updates inpyproject.toml. See CI run for theSKIP: google-genai not found in constraint-dependenciesoutput.This PR teaches the
update_constraint_deps.pyscript a three-way lookup strategy:>=floor there. Upper-bound constraints like<2.12.0are respected.[project] dependencies,[project.optional-dependencies],[dependency-groups]) — if found with a>=floor, update all occurrences in place.constraint-dependenciesin alphabetical order.Also adds
find_dependency_lines()to search all non-constraint dependency arrays, andinsert_constraint()for alphabetically-ordered insertion.Test Plan
Unit tests expanded from 31 to 42, covering all three lookup paths, alphabetical insertion edge cases, and the fall-through behavior when a bare dep (no
>=floor) exists in regular deps but a floor exists in constraint-deps.Output:
Pre-commit:
uv run pre-commit run --all-files # All hooks passed