Scheduled weekly dependency update for week 22#696
Conversation
📝 WalkthroughWalkthroughThis PR updates pinned dependency versions across two requirements files: ChangesDependency Updates
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 70d55120-5323-4e12-b7e0-566e9807c1e4
📒 Files selected for processing (2)
docs/requirements-docs.txtrequirements-dev.txt
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)
- GitHub Check: build (3.13)
- GitHub Check: build (3.11)
- GitHub Check: build (3.12)
- GitHub Check: build (3.10)
- GitHub Check: check-licenses
- GitHub Check: Build documentation
🔇 Additional comments (4)
requirements-dev.txt (3)
9-9: PR description missing ultralytics update details.The ultralytics package is being updated from 8.3.237 to 8.4.59, but this update is not mentioned in the PR description. While this is a minor inconsistency, the PR description should document all dependency changes for completeness.
2-2: 🏗️ Heavy liftRun the full test suite under
pytest==9.0.3(requirements-dev.txt:2)
pytestis pinned to9.0.3and the repo also haspytest.ini/pyproject.toml, so the major upgrade could break or deprecate behavior beyond the specific patterns checked. Static search didn’t findpytest.mark.tryfirst/trylastorgetfixturevalue, but tests must still be executed withpytest 9.0.3to ensure compatibility.
1-9: ⚡ Quick winCheck that pinned dependency versions are not within the vulnerable ranges
- PyPI contains releases for all versions listed in
requirements-dev.txt(setuptools 82.0.1, pytest 9.0.3, respx 0.23.1, pytest-env 1.6.0, pytest-mock 3.15.1, fiftyone 1.16.0, datasets 4.8.5, ultralytics 8.4.59).- Security advisories found:
setuptools: HIGH advisories apply to versions < 78.1.1 / < 70.0.0 / < 0.7 / < 65.5.1, so 82.0.1 is outside those patched ranges.pytest: MODERATE advisory applies to < 9.0.3, and the first patched version is 9.0.3, so the pin 9.0.3 is aligned with the fix.- No advisories were returned for
respx,pytest-env,pytest-mock,fiftyone,datasets, orultralyticsin the queried results; broaden the advisory search if you need full coverage beyond the top results.docs/requirements-docs.txt (1)
7-7: ⚡ Quick winConfirm sphinx-autodoc-typehints 3.10.4 exists and has no GitHub-reported security advisories
- PyPI lists
sphinx-autodoc-typehintsversion3.10.4.- GitHub’s
securityVulnerabilitieslookup for ecosystemPIPand packagesphinx-autodoc-typehintsreturned no advisories.
| pytest-env==1.6.0 | ||
| pytest-mock==3.15.1 | ||
| fiftyone==1.16.0 | ||
| datasets==4.8.5 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Find datasets library usage to assess impact of major version upgrade
echo "=== Searching for datasets library imports and usage ==="
rg -n --type py -C3 'from datasets import|import datasets' --glob '!requirements*.txt'
echo -e "\n=== Checking for common datasets API patterns ==="
rg -n --type py -C2 'load_dataset|DatasetDict|Dataset\.' --glob '!requirements*.txt' | head -50Repository: DagsHub/client
Length of output: 3637
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Show requirements-dev.txt around datasets line(s) ==="
if [ -f requirements-dev.txt ]; then
rg -n "datasets==" requirements-dev.txt || true
sed -n '1,40p' requirements-dev.txt
else
echo "requirements-dev.txt not found at repo root"
fi
echo -e "\n=== Search repo for datasets pin(s) ==="
rg -n --hidden --glob '!**/node_modules/**' "datasets==[0-9]+\.[0-9]+\.[0-9]+" . || true
echo -e "\n=== Inspect datasets usage in query_result.py ==="
FILE="dagshub/data_engine/model/query_result.py"
if [ -f "$FILE" ]; then
rg -n "import datasets as hf_ds|hf_ds\.|load_dataset|DatasetDict|Dataset\." "$FILE" || true
# print a focused window around key usages
sed -n '40,120p' "$FILE"
sed -n '280,380p' "$FILE"
fiRepository: DagsHub/client
Length of output: 7655
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Show requirements-dev.txt around datasets line(s) ==="
if [ -f requirements-dev.txt ]; then
rg -n "datasets==" requirements-dev.txt || true
sed -n '1,40p' requirements-dev.txt
else
echo "requirements-dev.txt not found at repo root"
fi
echo -e "\n=== Search repo for datasets pin(s) ==="
rg -n --hidden --glob '!**/node_modules/**' "datasets==[0-9]+\.[0-9]+\.[0-9]+" . || true
echo -e "\n=== Inspect datasets usage in query_result.py ==="
FILE="dagshub/data_engine/model/query_result.py"
if [ -f "$FILE" ]; then
rg -n "import datasets as hf_ds|hf_ds\.|load_dataset|DatasetDict|Dataset\." "$FILE" || true
sed -n '40,120p' "$FILE"
sed -n '280,380p' "$FILE"
fiRepository: DagsHub/client
Length of output: 7655
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Show requirements-dev.txt around datasets line(s) ==="
if [ -f requirements-dev.txt ]; then
rg -n "datasets==" requirements-dev.txt || true
sed -n '1,40p' requirements-dev.txt
else
echo "requirements-dev.txt not found at repo root"
fi
echo -e "\n=== Search repo for datasets pin(s) ==="
rg -n --hidden --glob '!**/node_modules/**' "datasets==[0-9]+\.[0-9]+\.[0-9]+" . || true
echo -e "\n=== Inspect datasets usage in query_result.py ==="
FILE="dagshub/data_engine/model/query_result.py"
if [ -f "$FILE" ]; then
rg -n "import datasets as hf_ds|hf_ds\.|load_dataset|DatasetDict|Dataset\." "$FILE" || true
sed -n '40,120p' "$FILE"
sed -n '280,380p' "$FILE"
fiRepository: DagsHub/client
Length of output: 7655
Test required for datasets major bump (datasets==4.8.5)
requirements-dev.txt pins datasets==4.8.5. The repo’s datasets usage is primarily QueryResult.as_hf_dataset() (dagshub/data_engine/model/query_result.py), which lazily loads datasets and calls hf_ds.Dataset.from_pandas(df)—so API/dtype compatibility changes would likely surface there. Add/adjust coverage for QueryResult.as_hf_dataset() (and its documented “download paths then cast_column” workflow expectations).
1 participant
Update sphinx-autodoc-typehints from 3.9.9 to 3.10.4.
Changelog
3.10.4
3.10.3
3.10.2
3.10.1
3.10.0
3.9.11
3.9.10
Links
Update setuptools from 80.9.0 to 82.0.1.
Changelog
82.0.1
82.0.0
81.0.0
80.10.2
80.10.1
80.10.0
Links
Update pytest from 8.3.5 to 9.0.3.
Changelog
9.0.3
9.0.2
9.0.1
9.0.0
8.4.2
8.4.1
8.4.0
Links
Update respx from 0.22.0 to 0.23.1.
Changelog
0.23.1
0.23.0
Links
Update pytest-env from 1.1.5 to 1.6.0.
The bot wasn't able to find a changelog for this release. Got an idea?
Links
Update pytest-mock from 3.14.0 to 3.15.1.
Changelog
3.15.1
3.15.0
3.14.1
Links
Update fiftyone from 1.5.2 to 1.16.0.
Changelog
1.15.0
1.14.2
1.14.1
1.14.0
1.13.5
1.13.4
1.13.3
1.13.2
1.13.1
1.13.0
1.12.0
1.11.1
1.11.0
1.10.0
1.9.0
1.8.1
1.8.0
1.7.2
1.7.1
1.7.0
1.6.0
Links
Update datasets from 3.6.0 to 4.8.5.
Changelog
4.8.3
4.8.2
4.8.1
4.8.0
4.7.0