Skip to content

feat/chore: pin solana, solders, dexscreener and tenacity dependencies - #233

Open
lgrawet wants to merge 1 commit into
hummingbot:mainfrom
lgrawet:chore/pin-solana-dexscreener-deps
Open

lgrawet wants to merge 1 commit into
hummingbot:mainfrom
lgrawet:chore/pin-solana-dexscreener-deps

Conversation

@lgrawet

@lgrawet lgrawet commented Sep 4, 2026

Copy link
Copy Markdown

Summary

Adds four version-bounded direct dependencies to pyproject.toml:

  • solana>=0.40,<0.41 and solders>=0.29,<0.30 — the Solana
    RPC/WebSocket client stack (AsyncClient, websocket_api, solders 0.29).
    solana-py is pre-1.0, so a minor bump can break the API.
  • dexscreener>=1.3,<2 — the DexScreener client for live DEX pool data
    (TokenPair.price_usd, volume.h6, get_token_pair_list_async). The
    1.x model surface is what the code relies on.
  • tenacity>=9.1,<10 — retry/backoff for rate-limited external APIs.
    Already present transitively; promoted to a direct dependency so it can be
    used explicitly.

Why

The lockfile alone pins versions but does not protect against an accidental
regeneration (uv lock, uv add). Declaring the bounds in pyproject.toml
keeps API assumptions explicit and stable across environments and CI.

Test plan

  • uv lock resolves cleanly (223 packages)
  • uv sync installs without warnings
  • import solana, import solders, import dexscreener, import tenacity all succeed
  • No existing package was upgraded or removed — the lock diff is purely additive (4 new direct deps + their transitive deps)

@greptile-apps

greptile-apps Bot commented Sep 4, 2026 •

Copy link
Copy Markdown

RetriggerView in GreptileConfidence Score: 5/5

[Medium impact] The PR appears safe to merge, with a remaining non-blocking concern about unrelated dependency upgrades.

Findings

  1. P2 Unrelated lockfile upgrades ▶

Summary

Adds bounded direct dependencies for solana, solders, dexscreener, and tenacity.

  • Project dependencies now keep four libraries inside stated release ranges.

Reviews (2) · Last reviewed commit: "chore: pin solana, solders, dexscreener ..." · Reviewed by Greptile

Comment thread uv.lock Outdated
[[package]]
name = "cohere"
version = "6.0.0"
version = "7.1.1"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Unrelated lockfile upgrades

The regenerated lockfile upgrades cohere from 6.0.0 to 7.1.1, idna from 3.11 to 3.19, pydantic from 2.12.5 to 2.13.5, and pydantic-core from 2.41.5 to 2.46.5. These changes contradict the stated additive scope and unnecessarily expand the compatibility surface of this dependency-pinning PR.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rebased and re-locked against current main.

  • cohere and idna are no longer touched: cohere is gone from the lock
    upstream and idna stays at upstream's 3.20.
  • pydantic 2.12.5 → 2.13.5 (and pydantic-core with it) is required, not
    drift: solana>=0.40,<0.41 resolves to 0.40.3, which declares
    pydantic>=2.13.4. Staying on 2.12.5 is unsatisfiable — solana 0.40.1/0.40.2
    require solders<0.29, which contradicts the solders>=0.29,<0.30 pin.

The lock diff is now purely additive plus that forced bump.

Adds version-bounded direct dependencies for Solana tooling:

- solana>=0.40,<0.41 and solders>=0.29,<0.30: the Solana RPC/WebSocket
  client stack (AsyncClient, websocket_api, solders 0.29). solana-py is
  pre-1.0, so a minor bump can break the API; the code is developed and
  tested against 0.40.x.
- dexscreener>=1.3,<2: the DexScreener client for live DEX pool data
  (TokenPair.price_usd, volume.h6, get_token_pair_list_async). The 1.x
  model surface is what the code relies on.
- tenacity>=9.1,<10: retry/backoff for rate-limited external APIs.

The lockfile alone pins versions but does not protect against an
accidental regeneration; declaring the bounds in pyproject.toml keeps
API assumptions explicit and stable.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@lgrawet
lgrawet force-pushed the chore/pin-solana-dexscreener-deps branch from 72740b6 to 29a4492 Compare November 2, 2026 22:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant