Skip to content

TST: Pin test dependencies to exact versions; add dependabot pip monitoring #2230

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mdboom wants to merge 4 commits into
base: main
Choose a base branch
from
+66 −17
Open

TST: Pin test dependencies to exact versions; add dependabot pip monitoring #2230

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
54a4a2b
TST: Pin test dependencies to exact versions; add dependabot pip moni…
mdboom Jun 16, 2026
6681e6a
Move matplotlib down
mdboom Jun 16, 2026
d38fc9a
Move numpy back for Python 3.10 compat
mdboom Jun 16, 2026
adc0e10
Loosen Numpy because of broad range of Python support required
mdboom Jun 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 43 additions & 1 deletion .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,51 @@
# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
#
# SPDX-License-Identifier: Apache-2.0

version: 2
updates:
# Python test-dependency updates for cuda_bindings
- package-ecosystem: pip
directory: /cuda_bindings
schedule:
interval: "monthly"
time: "09:00"
timezone: "America/Los_Angeles"
open-pull-requests-limit: 5
groups:
test-deps:
applies-to: version-updates
patterns: ["*"]
update-types: ["major", "minor", "patch"]

# Python test-dependency updates for cuda_core
- package-ecosystem: pip
directory: /cuda_core
schedule:
interval: "monthly"
time: "09:00"
timezone: "America/Los_Angeles"
open-pull-requests-limit: 5
groups:
test-deps:
applies-to: version-updates
patterns: ["*"]
update-types: ["major", "minor", "patch"]

# Python test-dependency updates for cuda_pathfinder
- package-ecosystem: pip
directory: /cuda_pathfinder
schedule:
interval: "monthly"
time: "09:00"
timezone: "America/Los_Angeles"
open-pull-requests-limit: 5
groups:
test-deps:
applies-to: version-updates
patterns: ["*"]
update-types: ["major", "minor", "patch"]

# GitHub Actions updates targeting the default branch (main)
- package-ecosystem: github-actions
directory: /
Expand Down
16 changes: 8 additions & 8 deletions cuda_bindings/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,15 +45,15 @@ all = [
[dependency-groups]
test = [
"cython>=3.2,<3.3",
"setuptools>=77.0.0",
"setuptools>=80.0.0",
# TODO: remove the Python 3.15 guard once 3.15 is officially supported
"matplotlib>=3.5.0; python_version < '3.15'",
"numpy>=1.21.1",
"pytest>=6.2.4",
"pytest-benchmark>=3.4.1",
"pytest-repeat",
"pytest-randomly",
"pyglet>=2.1.9",
"matplotlib; python_version < '3.15'",
"numpy",
Comment on lines +50 to +51

@rwgk rwgk Jun 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we keep the previous lower bounds here rather than making these bare dependencies?

What I would do:

  • Restore the lower bounds, because they encode the minimum supported/tested floor.
  • Add upper bounds to prevent surprise future releases from breaking CI.
  • Split NumPy by Python version if one cap cannot span the full Python matrix.
  • Add a short comment for any Python-version split so it is clear this is compatibility-driven, not arbitrary.

Policy-wise, I think lower bounds and upper bounds serve different purposes: lower bound = minimum supported/tested floor; upper bound or exact pin = CI stability cap. I do not think we should lose the former while adding the latter.

For example, roughly this shape, informed by the CI/branch history so far:

"matplotlib>=3.5.0,<=3.10.9; python_version < '3.15'",
"numpy>=1.21.1,<=2.2.6; python_version < '3.11'",
"numpy>=1.21.1,<=2.4.6; python_version >= '3.11'",

"pytest==9.1.0",
"pytest-benchmark==5.2.3",
"pytest-repeat==0.9.4",
"pytest-randomly==4.1.0",
"pyglet==2.1.14",
]

[project.urls]
Expand Down
15 changes: 11 additions & 4 deletions cuda_core/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,11 +59,18 @@ cu13 = ["cuda-bindings[all]==13.*", "cuda-toolkit==13.*"]

[dependency-groups]
test = [
"cython>=3.2,<3.3", "setuptools", "pytest>=6.2.4", "pytest-benchmark",
"pytest-randomly", "pytest-repeat", "pytest-rerunfailures", "pytest-timeout",
"cloudpickle", "psutil",
"cython>=3.2,<3.3",
"setuptools>=80",
"pytest==9.1.0",
"pytest-benchmark==5.2.3",
"pytest-randomly==4.1.0",
"pytest-repeat==0.9.4",
"pytest-rerunfailures==16.3",
"pytest-timeout==2.4.0",
"cloudpickle==3.1.2",
"psutil==7.2.2",
# TODO: remove the Python 3.15 guard once 3.15 is officially supported
"cffi; python_version < '3.15'",
"cffi==2.0.0; python_version < '3.15'",
]
ml-dtypes = ["ml-dtypes>=0.5.4,<0.6.0"]
test-cu12 = [ {include-group = "ml-dtypes" }, {include-group = "test" }, "cupy-cuda12x; python_version < '3.14'", "cuda-toolkit[cudart]==12.*"] # runtime headers needed by CuPy
Expand Down
8 changes: 4 additions & 4 deletions cuda_pathfinder/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,10 @@ dependencies = []

[dependency-groups]
test = [
"pytest>=6.2.4",
"pytest-mock",
"pytest-repeat",
"pytest-randomly",
"pytest==9.1.0",
"pytest-mock==3.15.1",
"pytest-repeat==0.9.4",
"pytest-randomly==4.1.0",
]
# Internal organization of test dependencies.
cu12 = [
Expand Down
Loading