What's the issue?
google.auth is not used at runtime, and it is an optional dependency in the python kubernetes client. Can it be removed as a required dependency in pyproject.toml from dagster-k8s?
This came up as an issue when a transitive dependency of google-auth (pyasn1) had a CVE which blocked a release pipeline for an application which has dagster-k8s as a dependency.
|
# exclude a google-auth release that added an overly restrictive urllib3 pin |
|
# that confuses dependency resolvers |
|
"google-auth!=2.23.1", |
^ Originates in a 3 year old commit 66b7d2d.
The approach to constraining transitive dependencies now might be to use [tool.uv.constraint-dependencies]
Message from the maintainers
Impacted by this issue? Give it a 👍! We factor engagement into prioritization.
What's the issue?
google.auth is not used at runtime, and it is an optional dependency in the python kubernetes client. Can it be removed as a required dependency in pyproject.toml from dagster-k8s?
This came up as an issue when a transitive dependency of google-auth (pyasn1) had a CVE which blocked a release pipeline for an application which has dagster-k8s as a dependency.
dagster/python_modules/libraries/dagster-k8s/pyproject.toml
Lines 15 to 17 in 84b7fb3
^ Originates in a 3 year old commit 66b7d2d.
The approach to constraining transitive dependencies now might be to use
[tool.uv.constraint-dependencies]Message from the maintainers
Impacted by this issue? Give it a 👍! We factor engagement into prioritization.