From b6e8381247e1bc55bd8a9dde9a81f303dc9e2fd4 Mon Sep 17 00:00:00 2001 From: Cameron Dawson Date: Sun, 23 Aug 2026 10:25:59 -0700 Subject: [PATCH] Stabilize the pip check lint step - Bump pip-tools 7.5.3 -> 7.6.1 (7.5.x cannot run under pip >= 26, which removed pip._internal.utils.compat.stdlib_pkgs) - Recompile requirements/dev.txt with --allow-unsafe so pip and setuptools stay pinned. Without the flag, pip-compile silently drops the setuptools pin; since CI installs with --no-deps into a Python 3.13 venv (where virtualenv no longer seeds setuptools), zope-* and pip-tools then fail pip check with 'requires setuptools, which is not installed'. The flag is recorded in the file header, so dependabot keeps it on future bumps. - Replace the grep-filtered pip check in tox.ini with a plain pip check. The mozdetect/pyqt5 suppression is stale: PyQt5 5.15.11 ships cp38-abi3 wheels that install fine on Python 3.13, and pyqt5 is pinned in common.txt. With no suppression needed, the exit-code-driven pip check replaces the fragile output-emptiness bash construct (which had already needed one fix to ignore the 'No broken requirements found.' message). --- requirements/common.txt | 2 +- requirements/dev.in | 2 +- requirements/dev.txt | 40 ++++++++++++++++++++-------------------- tox.ini | 9 +++------ 4 files changed, 25 insertions(+), 28 deletions(-) diff --git a/requirements/common.txt b/requirements/common.txt index 45ce2f65a2d..aad378292a4 100644 --- a/requirements/common.txt +++ b/requirements/common.txt @@ -2,7 +2,7 @@ # This file is autogenerated by pip-compile with Python 3.13 # by the following command: # -# pip-compile --generate-hashes --output-file=requirements/common.txt requirements/common.in +# pip-compile --allow-unsafe --generate-hashes --output-file=requirements/common.txt requirements/common.in # aiohappyeyeballs==2.6.1 \ --hash=sha256:c3f9d0113123803ccadfdf3f0faa505bc78e6a72d1cc4806cbd719826e943558 \ diff --git a/requirements/dev.in b/requirements/dev.in index 2e44c98853c..3977e48820b 100644 --- a/requirements/dev.in +++ b/requirements/dev.in @@ -33,7 +33,7 @@ pytest-freezer==0.4.9 vcrpy==8.1.1 # pip-compile for pinning versions -pip-tools==7.5.3 +pip-tools==7.6.1 requests==2.32.5 urllib3==2.0.3 diff --git a/requirements/dev.txt b/requirements/dev.txt index 3d25e1b1b76..9e7bfe742fd 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -2,11 +2,11 @@ # This file is autogenerated by pip-compile with Python 3.13 # by the following command: # -# pip-compile --generate-hashes --output-file=requirements/dev.txt requirements/dev.in +# pip-compile --allow-unsafe --generate-hashes --output-file=requirements/dev.txt requirements/dev.in # asgiref==3.11.1 \ - --hash=sha256:e8667a091e69529631969fd45dc268fa79b99c92c5fcdda727757e52146ec133 \ - --hash=sha256:5f184dc43b7e763efe848065441eac62229c9f7b0475f41f80e207a114eda4ce + --hash=sha256:5f184dc43b7e763efe848065441eac62229c9f7b0475f41f80e207a114eda4ce \ + --hash=sha256:e8667a091e69529631969fd45dc268fa79b99c92c5fcdda727757e52146ec133 # via django attrs==23.2.0 \ --hash=sha256:935dc3b529c262f6cf76e50877d35a4bd3c1de194fd41f47a2b7ae8f19971f30 \ @@ -324,9 +324,9 @@ pathspec==0.12.1 \ --hash=sha256:a0d503e138a4c123b27490a4f7beda6a01c6f288df0e4a8b79c7eb0dc7b4cc08 \ --hash=sha256:a482d51503a1ab33b1c67a6c3813a26953dbdc71c31dacaef9a838c4e29f5712 # via black -pip-tools==7.5.3 \ - --hash=sha256:3aac0c473240ae90db7213c033401f345b05197293ccbdd2704e52e7a783785e \ - --hash=sha256:8fa364779ebc010cbfe17cb9de404457ac733e100840423f28f6955de7742d41 +pip-tools==7.6.1 \ + --hash=sha256:6111c8b4b07fd14b7223ca921485b0e96cf66e20bf94da95eeed9845f510cb8f \ + --hash=sha256:695556edeb647eb94ee8345cc7108657fdb7fb16b3876623a399b4f61bbede01 # via -r requirements/dev.in platformdirs==4.3.6 \ --hash=sha256:357fb2acbc885b0419afd3ce3ed34564c13c9b95c89360cd9563f73aa5e2b907 \ @@ -510,15 +510,6 @@ shellcheck-py==0.11.0.1 \ --hash=sha256:784156289ecb17e91c692cd783ab5152333309588cabb10032a047331c63e759 \ --hash=sha256:b6a3fee28efda2e16e38d6e6d59faf7224300256456639727370d404730849e8 # via -r requirements/dev.in -setuptools==80.9.0 \ - --hash=sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922 \ - --hash=sha256:f36b47402ecde768dbfafc46e8e4207b4360c654f1f3bb84475f0a28628fb19c - # via - # pip-tools - # zope-component - # zope-event - # zope-hookable - # zope-interface six==1.16.0 \ --hash=sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926 \ --hash=sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254 @@ -783,8 +774,17 @@ zope-interface==6.1 \ # pypom # zope-component -# WARNING: The following packages were not pinned, but pip requires them to be -# pinned when the requirements file includes hashes and the requirement is not -# satisfied by a package already installed. Consider using the --allow-unsafe flag. -# pip -# setuptools +# The following packages are considered to be unsafe in a requirements file: +pip==26.2.1 \ + --hash=sha256:71138adf1f4ca900cdb7d289c21b7494329f2332b6d85f0e1c42108c0384ed3e \ + --hash=sha256:f6ad667e89a1fe78046c8f13232b247200f5258d7828f3f7883d660878e0813f + # via pip-tools +setuptools==80.9.0 \ + --hash=sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922 \ + --hash=sha256:f36b47402ecde768dbfafc46e8e4207b4360c654f1f3bb84475f0a28628fb19c + # via + # pip-tools + # zope-component + # zope-event + # zope-hookable + # zope-interface diff --git a/tox.ini b/tox.ini index e8cd9f671df..f49ae306f25 100644 --- a/tox.ini +++ b/tox.ini @@ -27,13 +27,10 @@ commands_pre = pip install --upgrade pip pip install --no-deps -r {toxinidir}/requirements/dev.txt pip install --no-deps -r {toxinidir}/requirements/common.txt -allowlist_externals = - bash commands = - # mozdetect declares pyqt5 as a dependency but PyQt5 has no Python 3.13 wheels - # and Treeherder doesn't use PyQt5. Filter out this known incompatibility, - # but fail if any OTHER broken requirements exist. - bash -c "output=$(pip check 2>&1 | grep -v 'mozdetect .* requires pyqt5' | grep -v '^No broken requirements found\.$'); [ -z \"$output\" ] || (echo \"$output\" && exit 1)" + # Requirements are installed with --no-deps, so pip check is what verifies + # the compiled requirements files are complete and mutually consistent. + pip check # This ensures that we don't loose the ability of installing locally pre-commit checks pre-commit run --all-files commands_post =