Add pip dependency lock file for supply chain protection#290
Open
kaggle-agent wants to merge 6 commits into
Open
Add pip dependency lock file for supply chain protection#290kaggle-agent wants to merge 6 commits into
kaggle-agent wants to merge 6 commits into
Conversation
Generate requirements.lock from pyproject.toml using pip-compile to pin all transitive dependencies to exact versions. This protects against supply chain attacks by ensuring reproducible installs. Also add .claude/settings.local.json and .kagent-context/** to .gitignore. Co-authored-by: kaggle-agent <kaggle-agent@users.noreply.github.com>
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Complement the lock file with major-version caps on requests, tqdm, and pyyaml in pyproject.toml to prevent unexpected major version upgrades. Regenerated requirements.lock to reflect the updated constraints (same resolved versions, no downgrades). Co-authored-by: kaggle-agent <kaggle-agent@users.noreply.github.com>
This comment was marked as resolved.
This comment was marked as resolved.
erdalsivri
reviewed
Apr 2, 2026
erdalsivri
reviewed
Apr 2, 2026
Replace version upper bounds with uv's exclude-newer setting, which prevents resolving packages published after a cutoff date. This is cleaner than per-dependency caps and covers all transitive deps. Regenerated the lock file with uv pip compile. Co-authored-by: kaggle-agent <kaggle-agent@users.noreply.github.com>
erdalsivri
reviewed
Apr 2, 2026
Set exclude-newer to 2 days before today so newly published (and potentially malicious) packages have time to be detected and pulled before they can be resolved. Updated both the date value and the upgrade instructions. Co-authored-by: kaggle-agent <kaggle-agent@users.noreply.github.com>
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
The S603 rule was deprecated in newer ruff versions, making these suppression comments trigger RUF100 (unused noqa) lint failures. Co-authored-by: kaggle-agent <kaggle-agent@users.noreply.github.com>
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
CI uses a ruff version that still enforces S603, so the suppression is needed to keep the build green. Co-authored-by: kaggle-agent <kaggle-agent@users.noreply.github.com>
|
@rosbo couldn't get the integration-tests to succeed. Is this something you can take a look? I think it is important to lock our dependencies and use the lock file during restores if we are not already doing so. I don't know much about the build pipeline of these projects. exclude-newer is a good protection too but that is up-to-you. Feel free to close this PR if it is not in a good state. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Generate requirements.lock from pyproject.toml using pip-compile to pin
all transitive dependencies to exact versions. This protects against
supply chain attacks by ensuring reproducible installs.
Also add .claude/settings.local.json and .kagent-context/** to
.gitignore.
Co-authored-by: kaggle-agent kaggle-agent@users.noreply.github.com
Task: erdalsivri-20260401152738-79d37875
Context: https://chat.kaggle.net/kaggle/pl/o3rrqgcf5fy3jjsjkbuhdp7ifh