Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
71 changes: 52 additions & 19 deletions .konflux/requirements-build.txt
Original file line number Diff line number Diff line change
Expand Up @@ -2,18 +2,27 @@
# This file is autogenerated by pip-compile with Python 3.13
# by the following command:
#
# pybuild-deps compile --output-file=requirements-build.txt requirements.source.txt
# pybuild-deps compile --output-file=.konflux/requirements-build.txt .konflux/requirements.source.txt
#
calver==2025.10.20
# via trove-classifiers
cython==3.2.4
coherent-licensed==0.5.2
# via
# importlib-metadata
# zipp
cython==3.2.5
# via oracledb
dunamai==1.26.1
# via uv-dynamic-versioning
expandvars==1.1.2
# via propcache
flit-core==3.12.0
# via
# click
# coherent-licensed
# idna
# jinja2
# markdown-it-py
# packaging
# pathspec
# pypdf
Expand All @@ -23,11 +32,14 @@ hatch-fancy-pypi-readme==25.1.0
# attrs
# llama-stack-client
# openai
# pydantic
# structlog
hatch-vcs==0.5.0
# via
# attrs
# chardet
# filelock
# structlog
hatchling==1.26.3
# via
# hatch-fancy-pypi-readme
Expand All @@ -38,6 +50,8 @@ hatchling==1.29.0
# a2a-sdk
# attrs
# chardet
# docstring-parser
# expandvars
# filelock
# hatch-fancy-pypi-readme
# hatch-vcs
Expand All @@ -52,84 +66,98 @@ hatchling==1.29.0
# opentelemetry-proto
# opentelemetry-sdk
# opentelemetry-semantic-conventions
# pydantic
# pydantic-settings
# pygments
# pythainlp
# python-multipart
# starlette
# structlog
# uv-dynamic-versioning
# uvicorn
# wcwidth
jinja2==3.1.6
# via uv-dynamic-versioning
markupsafe==3.0.3
# via jinja2
maturin==1.10.2
# via fastuuid
packaging==26.0
maturin==1.13.3
# via
# fastuuid
# pydantic-core
# rpds-py
# uv-build
packaging==26.2
# via
# dunamai
# hatchling
# setuptools-scm
# vcs-versioning
# wheel
pathspec==1.0.4
pathspec==1.1.1
# via hatchling
pdm-backend==2.4.8
# via fastapi
pkgconfig==1.6.0
# via aiohttp
pluggy==1.6.0
# via hatchling
poetry-core==2.3.2
poetry-core==2.4.1
# via
# aiohappyeyeballs
# dunamai
# litellm
# pkgconfig
# rich
# tomlkit
semantic-version==2.10.0
# via setuptools-rust
setuptools-rust==1.12.1
# via maturin
# via
# maturin
# tiktoken
setuptools-scm==10.0.5
# via
# cachetools
# hatch-vcs
# importlib-metadata
# llama-stack
# llama-stack-api
# pluggy
# setuptools-rust
# tenacity
tomlkit==0.14.0
# zipp
tomlkit==0.15.0
# via uv-dynamic-versioning
trove-classifiers==2026.1.14.14
trove-classifiers==2026.5.22.10
# via hatchling
uv-build==0.11.8
# via litellm
uv-dynamic-versioning==0.14.0
# via
# a2a-sdk
# mcp
vcs-versioning==1.1.1
# via setuptools-scm
wheel==0.46.3
wheel==0.47.0
# via
# authlib
# azure-core
# azure-identity
# cachetools
# litellm
# oci
# oracledb
# sentence-transformers
# tiktoken
# tornado
# tzdata
# wrapt

# The following packages are considered to be unsafe in a requirements file:
setuptools==78.1.1
# via oci
setuptools==82.0.1
Comment on lines +153 to 155
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify duplicate package pins with conflicting versions in build lockfile
python - <<'PY'
import re
from collections import defaultdict

path = ".konflux/requirements-build.txt"
pins = defaultdict(set)

with open(path, "r", encoding="utf-8") as f:
    for i, line in enumerate(f, 1):
        m = re.match(r'^([A-Za-z0-9_.-]+)==([^\s]+)\s*$', line.strip())
        if m:
            pins[m.group(1).lower()].add((m.group(2), i))

conflicts = {k: v for k, v in pins.items() if len({ver for ver, _ in v}) > 1}
if not conflicts:
    print("No conflicting duplicate pins found.")
else:
    print("Conflicting duplicate pins:")
    for pkg, versions in sorted(conflicts.items()):
        details = ", ".join(f"{ver} (Line {ln})" for ver, ln in sorted(versions, key=lambda x: x[1]))
        print(f"  {pkg}: {details}")
PY

Repository: lightspeed-core/lightspeed-stack

Length of output: 203


🏁 Script executed:

#!/bin/bash
set -euo pipefail

file=".konflux/requirements-build.txt"

echo "=== File head (first 80 lines) ==="
nl -ba "$file" | head -n 80

echo
echo "=== Lines 120-190 ==="
nl -ba "$file" | sed -n '120,190p'

Repository: lightspeed-core/lightspeed-stack

Length of output: 172


🏁 Script executed:

#!/bin/bash
set -euo pipefail

file=".konflux/requirements-build.txt"

echo "=== Lines 1-80 ==="
cat -n "$file" | sed -n '1,80p'

echo
echo "=== Lines 140-175 ==="
cat -n "$file" | sed -n '140,175p'

echo
echo "=== Lines mentioning setuptools/hatchling (all occurrences) ==="
rg -n "^(setuptools|hatchling)==|setuptools==|hatchling==" "$file" || true

Repository: lightspeed-core/lightspeed-stack

Length of output: 3577


Fix conflicting exact pins in .konflux/requirements-build.txt (autogenerated)

The file contains incompatible == pins for the same packages:

  • hatchling==1.26.3 (line 43) and hatchling==1.29.0 (line 48)
  • setuptools==78.1.1 (line 153) and setuptools==82.0.1 (line 155, “unsafe” section)

With two different == requirements for the same distribution, the requirements input is inherently conflicting (pip can’t satisfy both exact versions), breaking deterministic builds.

Also ensure regeneration/compatibility with the actual build Python version, since the header states it was generated with Python 3.13 (lines 2-6).

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.konflux/requirements-build.txt around lines 153 - 155, Resolve the
conflicting exact pins by removing or consolidating duplicate requirements for
the same package (specifically reconcile hatchling==1.26.3 vs hatchling==1.29.0
and setuptools==78.1.1 vs setuptools==82.0.1): pick the intended single version
(or replace with a compatible range like >= and < if truly needed) and update
the autogenerated requirements file so only one entry per distribution remains;
after editing, regenerate the requirements file with the correct build Python
version (the header currently says Python 3.13) to ensure compatibility and
deterministic builds.

# via
# aiohttp
# authlib
# azure-core
# azure-identity
# blobfile
# cachetools
# calver
# certifi
Expand All @@ -140,6 +168,7 @@ setuptools==82.0.1
# googleapis-common-protos
# greenlet
# grpc-google-iam-v1
# importlib-metadata
# joserfc
# llama-stack
# llama-stack-api
Expand All @@ -150,12 +179,12 @@ setuptools==82.0.1
# pathspec
# pluggy
# polyleven
# prometheus-client
# propcache
# proto-plus
# psutil
# pyasn1
# pycryptodomex
# pyjwt
# python-dotenv
# regex
# requests
# semver
Expand All @@ -164,8 +193,12 @@ setuptools==82.0.1
# setuptools-scm
# sse-starlette
# tenacity
# tiktoken
# tornado
# trl
# trove-classifiers
# tzdata
# vcs-versioning
# vcs-versioning
# wrapt
# xxhash
# zipp
Loading
Loading