From d386e8aafe258bd190ca55462f03eac942e96232 Mon Sep 17 00:00:00 2001 From: Claudio Freire Date: Wed, 29 Apr 2026 12:04:45 -0300 Subject: [PATCH 1/5] FOUR-1974: Relax requirements To improve compatibility with older stacks, that require older versions of requests, we can't require gql[requests] because gql places a lower bound on requests that isn't really necessary for correctness, but just to avoid a CVE. While the CVE is important, enforcing it in a library dependency causes issues on older stacks that just can't bump requests to a newer version. So avoid pulling in that lower bound by requiring requests explicitly with a less strict requirement instead. --- CHANGELOG.rst | 9 ++++++++ MANIFEST.in | 1 + reporting_api_client/VERSION | 2 +- requirements.in | 4 +++- requirements.txt | 43 ++++-------------------------------- 5 files changed, 18 insertions(+), 41 deletions(-) diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 4e47b11..d0adb80 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -15,6 +15,15 @@ When major components get significant changes worthy of mention, they can be described in a Major section. +v0.3.1 - 2026-04-29 +=================== + +Changed +------- + +- Relax gql requirements to improve compatibility with older stacks + + v0.3.0 - 2022-09-12 =================== diff --git a/MANIFEST.in b/MANIFEST.in index 19c8072..661a01f 100644 --- a/MANIFEST.in +++ b/MANIFEST.in @@ -1,2 +1,3 @@ include CHANGELOG.rst include README.rst +include requirements.in diff --git a/reporting_api_client/VERSION b/reporting_api_client/VERSION index 0d91a54..9e11b32 100644 --- a/reporting_api_client/VERSION +++ b/reporting_api_client/VERSION @@ -1 +1 @@ -0.3.0 +0.3.1 diff --git a/requirements.in b/requirements.in index 69f31a5..88eb1ea 100644 --- a/requirements.in +++ b/requirements.in @@ -1,2 +1,4 @@ -gql[requests]>=3.0.0 +gql>=3.0.0 +requests<3 +requests_toolbelt>=1.0.0,<2 requests_oauthlib diff --git a/requirements.txt b/requirements.txt index 320e052..88eb1ea 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,39 +1,4 @@ -# -# This file is autogenerated by pip-compile with python 3.9 -# To update, run: -# -# pip-compile requirements.in -# -backoff==2.1.2 - # via gql -certifi==2022.6.15 - # via requests -charset-normalizer==2.1.0 - # via requests -gql[requests]==3.4.0 - # via -r requirements.in -graphql-core==3.2.1 - # via gql -idna==3.3 - # via - # requests - # yarl -multidict==6.0.2 - # via yarl -oauthlib==3.2.0 - # via requests-oauthlib -requests==2.28.1 - # via - # gql - # requests-oauthlib - # requests-toolbelt -requests-oauthlib==1.3.1 - # via -r requirements.in -requests-toolbelt==0.9.1 - # via gql -urllib3==1.26.10 - # via - # gql - # requests -yarl==1.7.2 - # via gql +gql>=3.0.0 +requests<3 +requests_toolbelt>=1.0.0,<2 +requests_oauthlib From 92da5ae9a9a752ce003d0239ac4f536802b9b03b Mon Sep 17 00:00:00 2001 From: Claudio Freire Date: Thu, 30 Apr 2026 15:29:01 -0300 Subject: [PATCH 2/5] FOUR-1974: Use requirements-dev.in As the compiled version is only valid for specific python versions --- MANIFEST.in | 1 + setup.py | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/MANIFEST.in b/MANIFEST.in index 661a01f..65dc831 100644 --- a/MANIFEST.in +++ b/MANIFEST.in @@ -1,3 +1,4 @@ include CHANGELOG.rst include README.rst include requirements.in +include requirements-dev.in diff --git a/setup.py b/setup.py index 2b76908..e8d8d07 100644 --- a/setup.py +++ b/setup.py @@ -54,7 +54,7 @@ def parse_requirements(filename): author_email="data-infra@jampp.com", install_requires=[parse_requirements("requirements.in")], extras_require={ - "dev": parse_requirements("requirements-dev.txt"), + "dev": parse_requirements("requirements-dev.in"), "pandas": ["pandas"], }, long_description=readme + "\n\n" + history, From 2ce6cdaacf9abe4790f447831b3ac3cba21c0bd2 Mon Sep 17 00:00:00 2001 From: Claudio Freire Date: Thu, 30 Apr 2026 15:32:30 -0300 Subject: [PATCH 3/5] FOUR-1974: Fix req parsing --- setup.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/setup.py b/setup.py index e8d8d07..3f7cbd9 100644 --- a/setup.py +++ b/setup.py @@ -17,7 +17,9 @@ def parse_requirements(filename): ] # Remove pip flags requirements = [ - line for line in requirements if not line.strip().startswith("--") + line for line in requirements + if not line.strip().startswith("--") + and not line.strip().startswith("-r") ] # Remove inline comments requirements = [ From 0932d241ab8d89553babe6aaf7ba6b760f6fe062 Mon Sep 17 00:00:00 2001 From: Claudio Freire Date: Thu, 30 Apr 2026 15:34:00 -0300 Subject: [PATCH 4/5] FOUR-1974: Update CI python versions --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 69639c0..073c19c 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - python-version: ["3.7", "3.8", "3.9", "3.10"] + python-version: ["3.8", "3.9", "3.10", "3.11"] steps: - uses: actions/checkout@v2 From 4530e1ffaea609ccd6cafa503abdd2fd7b8773a4 Mon Sep 17 00:00:00 2001 From: Claudio Freire Date: Thu, 30 Apr 2026 15:41:48 -0300 Subject: [PATCH 5/5] FOUR-1974: Revert compiled requirements changes The compiled requirements aren't used in setup.py so they can be left as they are --- requirements.txt | 43 +++++++++++++++++++++++++++++++++++++++---- 1 file changed, 39 insertions(+), 4 deletions(-) diff --git a/requirements.txt b/requirements.txt index 88eb1ea..320e052 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,4 +1,39 @@ -gql>=3.0.0 -requests<3 -requests_toolbelt>=1.0.0,<2 -requests_oauthlib +# +# This file is autogenerated by pip-compile with python 3.9 +# To update, run: +# +# pip-compile requirements.in +# +backoff==2.1.2 + # via gql +certifi==2022.6.15 + # via requests +charset-normalizer==2.1.0 + # via requests +gql[requests]==3.4.0 + # via -r requirements.in +graphql-core==3.2.1 + # via gql +idna==3.3 + # via + # requests + # yarl +multidict==6.0.2 + # via yarl +oauthlib==3.2.0 + # via requests-oauthlib +requests==2.28.1 + # via + # gql + # requests-oauthlib + # requests-toolbelt +requests-oauthlib==1.3.1 + # via -r requirements.in +requests-toolbelt==0.9.1 + # via gql +urllib3==1.26.10 + # via + # gql + # requests +yarl==1.7.2 + # via gql