Skip to content

[Feature]: Monitor dependency lower bounds in CI #457

Closed

Description

@harryswift01

Feature Request

Problem / Motivation

Runtime dependencies in pyproject.toml are declared as ranges, but nothing checks that the lower bounds (floors) still work. A floor can be too low, because the code uses a newer API, or an older release may not install on every supported platform and Python version.

A local check with uv pip compile --resolution lowest-direct found two problems:

  • With lowest-direct, numpy resolves to 2.3.5, not the declared floor of 2.3.2. Something else pulls it up, so the floor is not exercised by any test.
  • On Python 3.15 the current ranges cannot resolve to wheels. numpy has no 3.15 wheels below 2.5.0 and rdkit has none below 2026.x, so one floor cannot cover every Python version.

Proposed Solution

Add a dependency-floors.yaml workflow that runs on PRs touching pyproject.toml, weekly, and on demand:

  • Resolve job: uv pip compile --resolution lowest-direct --only-binary :all: for each platform (Linux, macOS, Windows) and Python version, to catch floors with no installable wheels.
  • Test job: uv pip install --resolution lowest-direct -e ".[testing]", then the unit tests, on Linux, macOS and Windows for Python 3.12–3.14.
  • Python 3.15: included as non-blocking until the numpy and rdkit ceilings are widened.

Add a "Dependency Policy" section to the developer guide: floors are raised only when the code needs a newer release or the support window says so, and ceilings are widened by Renovate.

Expected Impact

  • A floor that does not install or pass the tests is caught on the PR that introduces it, or within a week.
  • Platform- and Python-specific wheel gaps are visible before users hit them.
  • Python 3.15 readiness is tracked without blocking merges.
  • Adds a Linux, macOS and Windows test matrix to PRs that change pyproject.toml, and a weekly run.

Additional Context

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

dependenciesPull requests that update a dependency filefeature requestNew feature or request

Type

Projects

No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions