Tighten dependency lower bounds to their compatibility floors#2756
Merged
Conversation
Danger ReportNo issues found. |
ericproulx
force-pushed
the
chore/raise-dependency-lower-bounds
branch
from
cee8cbb to
889d7ec
Compare
Grape's dependency floors were loose (zeitwerk and dry-configurable were unpinned, rack was >= 2). Raise them to the lowest versions Grape is actually compatible with on its Ruby 3.3 / Rails 7.2 baseline -- not the latest: - rack: >= 2 -> >= 2.2.4 (Rails 7.2's floor; avoids rack CVEs < 2.2.4) - zeitwerk: unpinned -> >= 2.6 (mirrors Rails 7.2's `zeitwerk ~> 2.6`) - dry-configurable: unpinned -> >= 1.0 (the `setting ..., default:` keyword API) dry-types stays at >= 1.1. Floors only, no upper bounds; resolved versions are unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ericproulx
force-pushed
the
chore/raise-dependency-lower-bounds
branch
from
889d7ec to
9ed3bcb
Compare
ericproulx
changed the title
dblock
approved these changes
Jun 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Tighten Grape's loose dependency floors to the lowest versions Grape is actually compatible with — not the latest. Grape is a library (a dependency in other apps' bundles), so a floor should be the minimum compatible version; pinning higher just causes downstream resolution conflicts for no benefit.
rack>= 2>= 2.2.4zeitwerk>= 2.6zeitwerk ~> 2.6; Grape uses only long-stable zeitwerk APIdry-configurable>= 1.0setting …, default:keyword API Grape relies on (0.x differs)dry-typesis left at>= 1.1(unchanged), andmustermannis handled separately in #2755.Notes
zeitwerk >= 2.6matches what Rails 7.2/8.0 themselves allow rather than being stricter.🤖 Generated with Claude Code