pulp-glue 0.39.x pins pydantic<2.13 but pydantic 2.13.x is released and compatible

[Odilhao]

Summary

pulp-glue 0.39.1 and 0.39.2 declare pydantic<2.13,>=2.9.2 in pyproject.toml, but pydantic 2.13.x has been released and appears to be compatible. This upper bound is now blocking downstream RPM packaging that includes both pulp-glue 0.39.x and pydantic 2.13.x in the same repository.

Context

In the theforeman/pulpcore-packaging RPM repository, both pulp-glue 0.39.1 and pydantic 2.13.4 land in the same nightly staging repository. The pulp-glue RPM is built with pyproject_rpm_macros which generates Requires: python3.12-pydantic < 2.13 from the wheel metadata. This causes dnf repoclosure to fail:

package: python3.12-pulp-glue-0.39.1-1.el9.noarch
  unresolved deps:
    (python3.12dist(pydantic) < 2.13 with python3.12dist(pydantic) >= 2.9.2)
    python3.12-pydantic < 2.13

Request

Please relax the pydantic upper bound to <2.14 (or <3.0 if upstream testing confirms broader compatibility) in the next pulp-glue release.

Workaround

Until a new pulp-glue release ships with a relaxed bound, the RPM spec is patching pyproject.toml in %prep:

sed -i 's/pydantic<2\.13/pydantic<2.14/g' pyproject.toml

Affected versions

• pulp-glue 0.39.1 — pydantic<2.13,>=2.9.2
• pulp-glue 0.39.2 — pydantic<2.13,>=2.9.2 (same constraint)
• pydantic 2.13.4 — released, in use downstream