Pin major version of external dependencies (#40580)

* Pin major version of external dependencies

* Update sdk/ml/azure-ai-ml/setup.py

Co-authored-by: Copilot <[email protected]>

* Update CHANGELOG

* Remove constraint from azure-common as this is an internal dep

* Explicit constraints

---------

Co-authored-by: Amit Chauhan <[email protected]>
Co-authored-by: Copilot <[email protected]>

Author: 3 people

sdk/ml/azure-ai-ml/CHANGELOG.md

@@ -1,13 +1,17 @@
 # Release History
+
 ## 1.27.0 (unreleased)
 
 ### Bugs Fixed
- - Fix for compute Instance, disableLocalAuth property should be depend on ssh public access enabled.
- - Removing Git-related properties from job properties if a PAT token is detected in the repository URL.
- - Fix deployment creation for registry models
 
- ### Other Changes
-  - Hub and Project are officially GA'd and no longer experimental.
+- Fix for compute Instance, disableLocalAuth property should be depend on ssh public access enabled.
+- Removing Git-related properties from job properties if a PAT token is detected in the repository URL.
+- Fix deployment creation for registry models
+
+### Other Changes
+
+- Hub and Project are officially GA'd and no longer experimental.
+- Restrict major version auto updates for external dependencies to ensure stability and prevent build failures for breaking changes.
 
 ## 1.26.3 (2025-04-17)
 

sdk/ml/azure-ai-ml/setup.py

@@ -68,25 +68,25 @@
     python_requires=">=3.7",
     install_requires=[
         # NOTE: To avoid breaking changes in a major version bump, all dependencies should pin an upper bound if possible.
-        "pyyaml>=5.1.0",
-        "msrest>=0.6.18",
+        "pyyaml>=5.1.0,<7.0.0",
+        "msrest>=0.6.18,<1.0.0",
         "azure-core>=1.23.0",
         "azure-mgmt-core>=1.3.0",
         "marshmallow>=3.5,<4.0.0",
-        "jsonschema>=4.0.0",
-        "tqdm",
+        "jsonschema>=4.0.0,<5.0.0",
+        "tqdm<5.0.0",
         # Used for PR 825138
-        "strictyaml",
+        "strictyaml<2.0.0",
         # Used for PR 718512
-        "colorama",
-        "pyjwt",
+        "colorama<1.0.0",
+        "pyjwt<3.0.0",
         "azure-storage-blob>=12.10.0",
         "azure-storage-file-share",
         "azure-storage-file-datalake>=12.2.0",
-        "pydash>=6.0.0",
-        "isodate",
+        "pydash>=6.0.0,<9.0.0",
+        "isodate<1.0.0",
         "azure-common>=1.1",
-        "typing-extensions",
+        "typing-extensions<5.0.0",
         "azure-monitor-opentelemetry",
         # TODO: remove six after using new autorest
         "six>=1.11.0",