kz930 opened a new issue, #8354:
URL: https://github.com/apache/texera/issues/8354
### What happened?
`amber/requirements.txt` pins `typing_extensions==4.14.1`. What CI installs
is 4.16.0.
The licence check is what made this visible, by failing the Python 3.12 leg
on 2 September once the recorded version no longer matched the installed one:
```
DRIFT (direct) Python packages — claimed versions differ from bundled:
~ typing-extensions: LICENSE-binary=4.14.1 bundled=4.16.0
ACTION REQUIRED
Direct deps always block CI — a version bump may carry license changes.
```
The dependencies are installed in three passes, each its own command:
```
uv pip install --system --index-strategy unsafe-best-match -r
amber/requirements.txt
uv pip install --system --index-strategy unsafe-best-match -r
amber/operator-requirements.txt
uv pip install --system --index-strategy unsafe-best-match -r
amber/dev-requirements.txt
```
A version pinned in the first file is not a constraint on the second.
Anything the later files pull in can raise it, and the pin stops meaning what
it says without anything reporting that it has.
Refreshing `LICENSE-binary-python` clears the check, which is what has been
done each time this surfaces (#7285, #8292). It leaves the pin as decoration.
This is not about one package. Any pin in the first file can drift the same
way, and only a check that happens to compare the two will notice.
### How to reproduce?
Install the three files in the order CI does, then ask pip which version of
typing_extensions is present. It reports 4.16.0, not the 4.14.1 the first file
pins.
### Version/Branch
main
### Commit Hash (Optional)
### What browsers are you seeing the problem on?
### Relevant log output
```
build / pyamber (ubuntu-latest, 3.12)
Step: Check installed Python packages against per-module LICENSE-binary files
https://github.com/apache/texera/actions/runs/33688978291/job/100443129847
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
