Repository navigation
Conversation
[Medium impact] The PR appears safe to merge, with a remaining non-blocking concern about unrelated dependency upgrades. Findings
SummaryAdds bounded direct dependencies for
Reviews (2) · Last reviewed commit: "chore: pin solana, solders, dexscreener ..." · Reviewed by Greptile |
| [[package]] | ||
| name = "cohere" | ||
| version = "6.0.0" | ||
| version = "7.1.1" |
There was a problem hiding this comment.
The regenerated lockfile upgrades cohere from 6.0.0 to 7.1.1, idna from 3.11 to 3.19, pydantic from 2.12.5 to 2.13.5, and pydantic-core from 2.41.5 to 2.46.5. These changes contradict the stated additive scope and unnecessarily expand the compatibility surface of this dependency-pinning PR.
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
There was a problem hiding this comment.
Rebased and re-locked against current main.
cohereandidnaare no longer touched:cohereis gone from the lock
upstream andidnastays at upstream's 3.20.pydantic2.12.5 → 2.13.5 (andpydantic-corewith it) is required, not
drift:solana>=0.40,<0.41resolves to 0.40.3, which declares
pydantic>=2.13.4. Staying on 2.12.5 is unsatisfiable —solana0.40.1/0.40.2
requiresolders<0.29, which contradicts thesolders>=0.29,<0.30pin.
The lock diff is now purely additive plus that forced bump.
Adds version-bounded direct dependencies for Solana tooling: - solana>=0.40,<0.41 and solders>=0.29,<0.30: the Solana RPC/WebSocket client stack (AsyncClient, websocket_api, solders 0.29). solana-py is pre-1.0, so a minor bump can break the API; the code is developed and tested against 0.40.x. - dexscreener>=1.3,<2: the DexScreener client for live DEX pool data (TokenPair.price_usd, volume.h6, get_token_pair_list_async). The 1.x model surface is what the code relies on. - tenacity>=9.1,<10: retry/backoff for rate-limited external APIs. The lockfile alone pins versions but does not protect against an accidental regeneration; declaring the bounds in pyproject.toml keeps API assumptions explicit and stable. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
72740b6 to
29a4492
Compare
Summary
Adds four version-bounded direct dependencies to
pyproject.toml:solana>=0.40,<0.41andsolders>=0.29,<0.30— the SolanaRPC/WebSocket client stack (
AsyncClient,websocket_api,solders 0.29).solana-py is pre-1.0, so a minor bump can break the API.
dexscreener>=1.3,<2— the DexScreener client for live DEX pool data(
TokenPair.price_usd,volume.h6,get_token_pair_list_async). The1.xmodel surface is what the code relies on.tenacity>=9.1,<10— retry/backoff for rate-limited external APIs.Already present transitively; promoted to a direct dependency so it can be
used explicitly.
Why
The lockfile alone pins versions but does not protect against an accidental
regeneration (
uv lock,uv add). Declaring the bounds inpyproject.tomlkeeps API assumptions explicit and stable across environments and CI.
Test plan
uv lockresolves cleanly (223 packages)uv syncinstalls without warningsimport solana,import solders,import dexscreener,import tenacityall succeed