Pin python dependencies

.github/workflows/ci-python.yml

@@ -73,7 +73,8 @@ jobs:
           python -m venv .venv
           .venv/Scripts/python -m pip install --upgrade pip
           test -f LICENSE || cp ../LICENSE LICENSE
-          .venv/Scripts/python -m pip install -e '.[dev]'
+          .venv/Scripts/python -m pip install -r requirements-dev.lock
+          .venv/Scripts/python -m pip install -e . --no-deps --no-build-isolation
           .venv/Scripts/python -m pytest --cov=zerobus --cov-report html --cov-report xml tests
 
   fmt:

python/Makefile

@@ -35,12 +35,14 @@ dev:
 	$(PYTHON) -m venv .venv
 	$(VENV) -m pip install --upgrade pip
 	@test -f LICENSE || cp ../LICENSE LICENSE
-	$(VENV) -m pip install -e '.[dev]'
+	$(VENV) -m pip install -r requirements-dev.lock
+	$(VENV) -m pip install -e . --no-deps --no-build-isolation
 
 lock-dev:
+	@test -d .venv39 || python3.9 -m venv .venv39
 	@test -f LICENSE || cp ../LICENSE LICENSE
-	$(VENV) -m pip install pip-tools
-	$(VENV) -m pip-compile --generate-hashes --output-file requirements-dev.lock requirements-dev.in
+	.venv39/bin/pip install --quiet --upgrade pip pip-tools
+	.venv39/bin/pip-compile --generate-hashes --strip-extras --no-emit-index-url --allow-unsafe --output-file requirements-dev.lock requirements-dev.in
 
 install:
 	$(VENV) -m pip install -e .
@@ -66,7 +68,7 @@ clean:
 	rm -rf dist *.egg-info .pytest_cache build htmlcov
 
 clean-all: clean clean-rust
-	rm -rf .venv
+	rm -rf .venv .venv39
 
 fmt:
 	$(VENV) -m black zerobus examples tests

python/pyproject.toml

@@ -29,7 +29,7 @@ dependencies = [
 
 [project.optional-dependencies]
 arrow = [
-    "pyarrow>=14.0.0",
+    "pyarrow>=14.0.0,<20.0",
 ]
 dev = [
     # Build tools
@@ -46,8 +46,8 @@ dev = [
     "pytest",
     "pytest-cov",
     "pytest-xdist>=3.6.1,<4.0",
-    "pytest-asyncio",
-    "pyarrow>=14.0.0",
+    "pytest-asyncio>=0.21,<1.0",
+    "pyarrow>=14.0.0,<20.0",
 ]
 
 [tool.maturin]

python/requirements-dev.in

@@ -1,4 +1,25 @@
-# Input file for pip-compile. Run `make lock-dev` to regenerate requirements-dev.lock.
-# The lock file pins every transitive dependency to an exact version with hashes,
-# so CI installs are reproducible and hash-verified.
--e .[dev]
+# Runtime dependencies (from pyproject.toml [project.dependencies])
+protobuf>=4.25.0,<7.0
+requests>=2.28.1,<3
+
+# Build system
+maturin>=1.5,<2.0
+
+# Dev dependencies (from pyproject.toml [project.optional-dependencies.dev])
+wheel
+build
+grpcio-tools>=1.60.0,<2.0
+pip-tools>=7.0,<8
+black
+pycodestyle
+autoflake
+isort
+pytest
+pytest-cov
+pytest-xdist>=3.6.1,<4.0
+pytest-asyncio>=0.21,<1.0
+pyarrow>=14.0.0,<20.0
+
+importlib-metadata<8.2
+tomli
+exceptiongroup