Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Loosen version requirements to compatibility operator ~= #162

Merged
merged 1 commit into from
Jun 22, 2024

Conversation

lukasschwab
Copy link
Owner

Description

Does what it says on the tin for the two ==-pinned non-development dependencies, requests and feedparser.

Deserves some thought on risk: what if one of these dependencies incorrectly labels breaking changes in a patch version?

Breaking changes

List any changes that break the API usage supported on master.

None.

Relevant issues

List GitHub issues relevant to this change.

Closes #161.

Checklist

  • [-] (If appropriate) README.md example usage has been updated.

Resolve #161. Deserves some thought on risk: what if one of these
dependencies incorrectly labels breaking changes in a patch version?
@kgleba
Copy link
Contributor

kgleba commented Jun 22, 2024

@lukasschwab Merging this pull request would be very desirable, as the locked requests version 2.32.0 is a yanked version (as is 2.32.1) due to "conflicts with CVE-2024-35195 mitigation"

@lukasschwab
Copy link
Owner Author

Will do today.

@lukasschwab lukasschwab merged commit 4eac1c1 into master Jun 22, 2024
6 checks passed
@lukasschwab lukasschwab deleted the loosen-requirements-compatibility branch June 22, 2024 23:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Maybe the requests dependency should be marked as >= instead of ==
2 participants