deps(deps): update python-dotenv requirement from >=1.0.0 to >=1.2.1#25
deps(deps): update python-dotenv requirement from >=1.0.0 to >=1.2.1#25dependabot[bot] wants to merge 1 commit into
Conversation
Updates the requirements on [python-dotenv](https://github.com/theskumar/python-dotenv) to permit the latest version. - [Release notes](https://github.com/theskumar/python-dotenv/releases) - [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md) - [Commits](theskumar/python-dotenv@v1.0.0...v1.2.1) --- updated-dependencies: - dependency-name: python-dotenv dependency-version: 1.2.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| "psutil>=5.9.0", | ||
| "jsonpath-ng>=1.5.3", | ||
| "python-dotenv>=1.0.0", | ||
| "python-dotenv>=1.2.1", |
There was a problem hiding this comment.
🔴 python-dotenv >=1.2.1 requires Python >=3.9, breaking declared Python 3.8 support
The minimum version of python-dotenv was bumped from >=1.0.0 to >=1.2.1, but python-dotenv 1.2.1 declares Requires-Python: >=3.9. This project declares requires-python = ">=3.8" at pyproject.toml:12 and lists Python 3.8 in its classifiers at pyproject.toml:18. Users on Python 3.8 will encounter a dependency resolution failure because pip cannot find a python-dotenv version that satisfies both >=1.2.1 and Python 3.8 compatibility (the last Python 3.8-compatible release was 1.0.1). Additionally, requirements.txt:7 still has the old >=1.0.0 constraint, creating an inconsistency between the two dependency specifications.
Prompt for agents
The python-dotenv version bump to >=1.2.1 is incompatible with the project's declared Python 3.8 support. python-dotenv 1.1.0+ dropped Python 3.8 support (requires Python >=3.9). There are two approaches to fix this:
1. If Python 3.8 support must be maintained: revert the minimum version back to >=1.0.0 (or use a version constraint like >=1.0.0,<1.1.0 to cap at the last 3.8-compatible release if a specific feature from newer versions is not needed).
2. If Python 3.8 support can be dropped: update requires-python to >=3.9 in pyproject.toml:12, remove the Python 3.8 classifier from pyproject.toml:18, and update the mypy python_version at pyproject.toml:102 and the black target-version at pyproject.toml:77 accordingly.
Also ensure requirements.txt:7 is updated to be consistent with whichever choice is made in pyproject.toml.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Updates the requirements on python-dotenv to permit the latest version.
Release notes
Sourced from python-dotenv's releases.
Changelog
Sourced from python-dotenv's changelog.
... (truncated)
Commits
eaf2a91Do not remove .coverage file8716196Bump version: 1.2.0 → 1.2.1b87807fUpdate changelog3af77d3Support reading .env from FIFOs (Unix) (#586)467ee22Fix test failures after moving config to pyproject.toml76999e7Move more config pyproject.toml222ce2cUpdate to use trusted publisher on pypi8ed4f79Update docs requirements5bf8822Bump version: 1.1.1 → 1.2.01fe11ccupadate changelogDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)