Skip to content

chore(deps): Bump virtualenv from 20.23.0 to 20.36.1 in /sdk/python/requirements #5848

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: master
Choose a base branch
from
Open

chore(deps): Bump virtualenv from 20.23.0 to 20.36.1 in /sdk/python/requirements #5848

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions sdk/python/requirements/py3.10-ci-requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6076,9 +6076,9 @@ uvloop==0.22.1 \
--hash=sha256:ef6f0d4cc8a9fa1f6a910230cd53545d9a14479311e87e3cb225495952eb672c \
--hash=sha256:fe94b4564e865d968414598eea1a6de60adba0c040ba4ed05ac1300de402cd42
# via uvicorn
virtualenv==20.23.0 \
--hash=sha256:6abec7670e5802a528357fdc75b26b9f57d5d92f29c5462ba0fbe45feacc685e \
--hash=sha256:a85caa554ced0c0afbd0d638e7e2d7b5f92d23478d05d17a76daeac8f279f924
virtualenv==20.36.1 \
--hash=sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f \
--hash=sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba
Comment on lines +6079 to +6081
Copy link
Contributor

@devin-ai-integration devin-ai-integration bot Jan 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Version constraint mismatch: requirements files updated to virtualenv 20.36.1 but setup.py/pyproject.toml still constrain to <20.24.2

The PR updates virtualenv to version 20.36.1 in the CI requirements files, but the setup.py and pyproject.toml files still have conflicting version constraints that would prevent this version from being installed.

Click to expand

Conflicting constraints in setup.py and pyproject.toml

Both setup.py:201 and pyproject.toml:139 pin:

"virtualenv==20.23.0",

And both setup.py:242 and pyproject.toml:182 have an upper bound:

"virtualenv<20.24.2",

Impact

The updated version 20.36.1 violates both constraints:

  • It is not equal to 20.23.0
  • It is greater than 20.24.2

This creates an inconsistency where:

  1. Installing via pip install feast[ci] would use the constraints from setup.py/pyproject.toml (getting 20.23.0)
  2. Installing via the requirements files directly would get 20.36.1

This could lead to:

  • CI failures if the requirements files are regenerated from setup.py
  • Inconsistent behavior between different installation methods
  • The security fixes in virtualenv 20.36.1 (TOCTOU vulnerabilities) not being applied when installing via setup.py

Recommendation

The setup.py and pyproject.toml files should also be updated to allow virtualenv 20.36.1, for example by changing the constraints to virtualenv>=20.36.1,<21 or simply virtualenv==20.36.1.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

# via
# feast (setup.py)
# pre-commit
Expand Down
6 changes: 3 additions & 3 deletions sdk/python/requirements/py3.11-ci-requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6316,9 +6316,9 @@ uvloop==0.22.1 \
--hash=sha256:ef6f0d4cc8a9fa1f6a910230cd53545d9a14479311e87e3cb225495952eb672c \
--hash=sha256:fe94b4564e865d968414598eea1a6de60adba0c040ba4ed05ac1300de402cd42
# via uvicorn
virtualenv==20.23.0 \
--hash=sha256:6abec7670e5802a528357fdc75b26b9f57d5d92f29c5462ba0fbe45feacc685e \
--hash=sha256:a85caa554ced0c0afbd0d638e7e2d7b5f92d23478d05d17a76daeac8f279f924
virtualenv==20.36.1 \
--hash=sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f \
--hash=sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba
# via
# feast (setup.py)
# pre-commit
Expand Down
6 changes: 3 additions & 3 deletions sdk/python/requirements/py3.12-ci-requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6304,9 +6304,9 @@ uvloop==0.22.1 \
--hash=sha256:ef6f0d4cc8a9fa1f6a910230cd53545d9a14479311e87e3cb225495952eb672c \
--hash=sha256:fe94b4564e865d968414598eea1a6de60adba0c040ba4ed05ac1300de402cd42
# via uvicorn
virtualenv==20.23.0 \
--hash=sha256:6abec7670e5802a528357fdc75b26b9f57d5d92f29c5462ba0fbe45feacc685e \
--hash=sha256:a85caa554ced0c0afbd0d638e7e2d7b5f92d23478d05d17a76daeac8f279f924
virtualenv==20.36.1 \
--hash=sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f \
--hash=sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba
# via
# feast (setup.py)
# pre-commit
Expand Down