Skip to content

Add pip dependency lock file for supply chain protection #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kaggle-agent wants to merge 2 commits into
base: main
Choose a base branch
from
+25 −0
Open

Add pip dependency lock file for supply chain protection #30

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b11106d
Add pip dependency lock file for supply chain protection
erdalsivri Apr 1, 2026
d3aecfa
Use uv exclude-newer for supply chain protection
erdalsivri Apr 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,4 @@
dist/
.idea
.claude/settings.local.json
.kagent-context/**
3 changes: 3 additions & 0 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,5 +29,8 @@ dependencies = [
"Homepage" = "https://github.com/Kaggle/kagglesdk"
"Bug Tracker" = "https://github.com/Kaggle/kagglesdk/issues"

[tool.uv]
exclude-newer = "2026-03-31"

Copy link
Copy Markdown
Contributor

@rosbo rosbo Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add a comment about why we should not use a newer version? Should we pin uv instead?

Copy link
Copy Markdown
Contributor

@rosbo rosbo Apr 10, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nevermind, I thought exclude-newer was for the uv tool itself but it is used for the package we install.

I would rather not have an exclude-newer that we need to bump manually and use a lock file instead.

Copy link
Copy Markdown
Contributor

@rosbo rosbo Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can look into ensuring hatch and our release pipeline use the lock file if you prefer?

[tool.hatch.version]
path = "kagglesdk/__init__.py"
20 changes: 20 additions & 0 deletions requirements.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
# Regenerate with: uv pip compile pyproject.toml -o requirements.lock
#
# To upgrade packages:
# 1. Update exclude-newer in pyproject.toml to 2 days before today
# 2. Run: uv pip compile pyproject.toml -o requirements.lock
#
# This file was autogenerated by uv via the following command:
# uv pip compile pyproject.toml -o requirements.lock
certifi==2026.2.25
# via requests
charset-normalizer==3.4.6
# via requests
idna==3.11
# via requests
protobuf==7.34.1
# via kagglesdk (pyproject.toml)
requests==2.33.1
# via kagglesdk (pyproject.toml)
urllib3==2.6.3
# via requests