Artifact Manager

pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "squirrel-core"
-version = "0.19.6"
+version = "0.19.7"
 description = "Squirrel is a Python library that enables ML teams to share, load, and transform data in a collaborative, flexible and efficient way."
 authors = ["Merantix Momentum"]
 license = "Apache 2.0"
@@ -21,69 +21,88 @@ classifiers = [
 
 [tool.poetry.dependencies]
 python = "^3.8"
+aiohttp = ">=3.8.4"    # dependabot: GHSA-q3qx-c6g2-7pw2
 fsspec = ">=2021.7.0"
-msgpack = "^1.0.4"
-msgpack-numpy = "^0.4.8"
-more-itertools = "^9.0.0"
-pluggy = "^1.0.0"
-ruamel-yaml = "^0.17.21"
-tqdm = "^4.64.1"
-numpy = "^1.23.5"
-pyjwt = "^2.4.0"
-mako = "^1.2.2"
-oauthlib = "^3.2.1"
-aiohttp = "^3.7.4"
-numba = {version = "^0.56.4", optional = true}
+mako = ">=1.2.4"    # dependabot: GHSA-v973-fxgf-6xhp
+msgpack = ">=1.0.4"
+msgpack-numpy = ">=0.4.8"
+more-itertools = ">=9.0.0"
+numpy = ">=1.23.5"
+oauthlib = ">=3.2.2"   # dependabot: GHSA-3pgj-pg6c-r5p7
+pandas = "<=1.5.3"    # pin for dask compatibility (afterwards core.strings.Stringmethods is not available anymore)
+pluggy = ">=1.0.0"
+pyjwt = ">=2.6.0"   # dependabot: GHSA-ffqj-6fqr-9h24
+ruamel-yaml = ">=0.17.21"
+tqdm = ">=4.64.1"   # dependabot: GHSA-r7q7-xcjw-qx8q
+urllib3 = ">=1.25.4,<1.27" # workaround for: https://github.com/python-poetry/poetry-plugin-export/issues/183
+
 adlfs = {version = "<2021.10", optional = true}
-dask = {version = ">=2021.7.0", optional = true, extras = ["dataframe", "distributed"]}
-odfpy = {version = "^1.4.1", optional = true}
-openpyxl = {version = "^3.1.1", optional = true}
-pyxlsb = {version = "^1.0.10", optional = true}
-xlrd = {version = "^2.0.1", optional = true}
+dask = {version = ">=2021.10.0", optional = true, extras = ["dataframe", "distributed"]}  # dependabot: GHSA-hwqr-f3v9-hwxr
 gcsfs = {version = ">=2021.7.0", optional = true}
+numba = {version = ">=0.56.4", optional = true}
+odfpy = {version = ">=1.4.1", optional = true}
+openpyxl = {version = ">=3.1.1", optional = true}   # dependabot: GHSA-chqf-hx79-gxc6
+pyarrow = {version = ">=14.0.1", optional = true}  # dependabot: GHSA-5wvp-7f3h-6wmm
+pyxlsb = {version = ">=1.0.10", optional = true}
 s3fs = {version = ">=2021.7.0", optional = true}
-torch = {version = ">=1.13.1", optional = true}
-zarr = {version = "^2.10.3", optional = true}
-pyarrow = {version = "^10.0.1", optional = true}
+torch = {version = ">=1.13.1", optional = true}     # dependabot: GHSA-47fc-vmwq-366v
+wandb = {version = "*", optional = true}
+xlrd = {version = ">=2.0.1", optional = true}
+zarr = {version = ">=2.10.3", optional = true}
 
 [tool.poetry.group.dev.dependencies]
-twine = "^4.0.2"
-wheel = "^0.38.4"
-pytest = "^6.2.1"
-pytest-timeout = "^2.1.0"
-pytest-cov = "^4.0.0"
-pytest-xdist = "^3.2.0"
-wandb = "^0.13.10"
-mlflow = "^2.1.1"
-pre-commit = "^2.16.0"
-pip-tools = "^6.6.2"
-black = "22.8.0"
-autopep8 = "1.7.0"
-hypothesis = "^6.91.1"
-faker = "^20.1.0"
+# dev dependencies pinned for faster resolution
+autopep8 = "2.0.4"
+black = "23.12.0"
+faker = "21.0.0"
+hypothesis = "6.92.1"
+pip-tools = "7.3.0"
+pre-commit = "3.5.0"
+pytest = "7.4.3"
+pytest-timeout = "2.2.0"
+pytest-cov = "4.1.0"
+pytest-xdist = "3.5.0"
+scipy = "*"
+setuptools = "69.0.2"
+twine = "4.0.2"
+wheel = "0.42.0"
+mlflow = "2.9.2"
 
 [tool.poetry.group.doc.dependencies]
-sphinx = "<4.0.0"
-jinja2 = "<3.1"
-click = "<8.1"
-sphinx-versions = "^1.1.3"
-sphinx-rtd-theme = "^1.2.0"
-sphinx-autoapi = "^1.9.0"
-sphinxcontrib-mermaid = "^0.8"
-myst-nb = "^0.15.0"
+# doc dependencies are pinned for faster resolution
+sphinx = "3.5.4"
+astroid = "2.14.2"  # newer versions seem to break sphinx-autoapi
+jinja2 = "3.0.3"
+click = "8.0.4"
+sphinx-autoapi = "1.9.0"
+sphinx-versions = "1.1.3"
+sphinx-rtd-theme = "1.2.0"
+sphinxcontrib-jquery = "2.0.0"
+sphinxcontrib-mermaid = "0.8.1"
+myst-nb = "0.15.0"
+
+# updated doc dependencies for python >=3.9
+# sphinx = "6.2.1"
+# click = "<8.1.0"    # pin for faster resolution any between 8.0.0 and 8.1.0 should work
+# sphinx-autoapi = "3.0.0"    # pin for faster resolution - package does no longer seem to be maintained
+# sphinxcontrib-mermaid = "0.8.1"
+# sphinx-rtd-theme = "1.2.0"
+# sphinx-versions = "1.1.3"
+# myst-nb = "1.0.0"  # pin for faster resolution any <1.0.0 should work
 
 [tool.poetry.extras]
 azure = ["adlfs"]
 dask = ["dask"]
 excel = ["odfpy", "openpyxl", "pyxlsb", "xlrd"]
 feather = ["pyarrow"]
 gcp = ["gcsfs"]
+numba = ["numba"]
 parquet = ["pyarrow"]
 s3 = ["s3fs"]
 torch = ["torch"]
+wandb = ["wandb"]
 zarr = ["zarr"]
-all = ["adlfs", "dask", "odfpy", "openpyxl", "pyxlsb", "xlrd", "pyarrow", "gcsfs", "s3fs", "torch", "zarr"]
-numba = ["numba"]
+all = ["adlfs", "dask", "odfpy", "openpyxl", "pyxlsb", "xlrd", "pyarrow", "gcsfs", "s3fs", "torch", "zarr", "wandb", "numba"]
 
 [build-system]
 requires = ["poetry-core"]