Skip to content

Pin v2 dependency versions for reproducibility #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
conorbronsdon wants to merge 1 commit into from
Closed

Pin v2 dependency versions for reproducibility #14

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 19 additions & 19 deletions v2/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,19 +1,19 @@
galileo
langchain
langchain_anthropic
langchain_baseten
langchain_openai
langchain_mistralai
langchain_google_genai
langchain_together
langchain_fireworks
langchain_writer
langchain_deepseek
langchain_aws
langchain_nvidia_ai_endpoints
langchain_cohere
colorama
pandas
langchain-xai
tqdm
pydantic
galileo>=1.49.0
langchain>=1.2.0
langchain-anthropic>=1.3.0
langchain-baseten>=0.1.9
langchain-openai>=1.1.0
langchain-mistralai>=1.1.0
langchain-google-genai>=4.2.0
langchain-together>=0.3.0
langchain-fireworks>=1.1.0
langchain-writer>=0.3.5
langchain-deepseek>=1.0.0
langchain-aws>=1.4.0
Comment on lines +1 to +12
Copy link
Copy Markdown

@baz-reviewer baz-reviewer Bot Mar 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

v2 requirements use minimum-bound specifiers (e.g. galileo>=1.49.0) instead of exact pins, so pip can install newer/unbounded versions and installs remain non-deterministic; the PR's reproducibility goal is not met. Can we pin each dependency with == or add a lockfile/constraints file?

Finding type: Logical Bugs | Severity: 🔴 High

Want Baz to fix this for you? Activate Fixer

Other fix methods

Fix in Cursor

Prompt for AI Agents:

In v2/requirements.txt around lines 1-19, the dependencies are currently specified with
minimum bounds (e.g., >=) which does not provide reproducible installs. Replace each >=
specifier with an exact pin (==) using the resolved versions from a reproducible lock
step (for example run pip freeze in a controlled environment or use pip-tools to compile
a constraints file) so each line becomes package==<exact_version>. Alternatively, if you
prefer a constraints file, create v2/constraints.txt with exact versions and update
v2/requirements.txt to reference the constraints file (or document how to install using
--constraint), and ensure there are no duplicate or inconsistent package names and that
formatting remains one package per line. Return the updated v2/requirements.txt and the
generated lock/constraints file.

Copy link
Copy Markdown
Contributor Author

@conorbronsdon conorbronsdon Mar 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Intentionally using >= rather than == here. The previous requirements had zero version constraints, so >= is already a big improvement. Exact pins in requirements.txt cause unnecessary dependency conflicts for contributors and downstream users. If the project adopts uv or pip-tools later, a lockfile can layer on top of these minimum bounds for CI reproducibility without constraining end users.

Copy link
Copy Markdown

@baz-reviewer baz-reviewer Bot Mar 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Understood on preferring minimum bounds with >= here to reduce conflicts and rely on a future lockfile for reproducibility; I’ll save this preference to memory after the PR is merged.

langchain-nvidia-ai-endpoints>=1.2.0
langchain-cohere>=0.5.0
langchain-xai>=1.2.0
colorama>=0.4.6
pandas>=2.2.0
tqdm>=4.67.0
pydantic>=2.10.0