fix: repair uv install, drop Python 3.9/3.10, add 3.13 - #154
Conversation
uv backtracked numba to 0.53.1 (dragging in llvmlite 0.36.0, which has no Python 3.13 wheel and fails to build), so add a numba>=0.60 floor. Also raise the minimum Python to 3.11, add 3.13 to the test matrix and classifiers, refresh pinned dependency floors, and add geolibre and geolibre-wasm.
|
Warning Review limit reached
Next review available in: 6 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThis PR upgrades GitHub Actions versions (checkout, setup-uv, docker/build-push-action, actions-netlify) across CI workflows, expands Python version support matrices (adding 3.13/3.14, dropping 3.9/3.10), raises the minimum supported Python to 3.11 in pyproject.toml, and bumps several package version constraints in requirements files. ChangesCI/tooling and dependency version updates
Estimated code review effort: 2 (Simple) | ~10 minutes Related issues: Fixes an install failure caused by attempting to build Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The committed uv.lock could not be parsed by newer uv, breaking CI, so regenerate it against the updated requirements. Also bump the workflow actions (checkout v7, setup-uv v8, build-push-action v7, actions-netlify v4) to their latest major versions.
astral-sh/setup-uv does not publish a floating v8 major tag, so pin the full release version to resolve the action.
|
🚀 Deployed on https://6a4c7c77e031639445c9fb2e--opengeos.netlify.app |
The full dependency tree resolves cleanly on 3.14 with modern numba/llvmlite, so add it to the classifiers and Ubuntu test matrix.
This reverts commit c09ed19.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
♻️ Duplicate comments (5)
.github/workflows/docs-build.yml (1)
16-23: 🔒 Security & Privacy | 🔵 Trivial | ⚖️ Poor tradeoffSame unpinned-action concern as docker-image.yml.
Also applies to: 54-54
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/docs-build.yml around lines 16 - 23, The workflow still uses unpinned third-party actions, so update the actions in the docs build job to pinned commit SHAs instead of floating tags. Apply this to the checkout and setup-uv steps in the workflow, matching the same pinning approach used elsewhere, and keep the existing step names and configuration while only changing the action references.Source: Linters/SAST tools
.github/workflows/macos.yml (1)
22-27: 🔒 Security & Privacy | 🔵 Trivial | ⚖️ Poor tradeoffSame unpinned-action concern as docker-image.yml.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/macos.yml around lines 22 - 27, The workflow uses a floating action reference for actions/checkout, so pin it to a specific immutable version or commit like the other workflow fix. Update the checkout step in the macos workflow to use a fixed release/sha, and keep the existing setup-uv pin as-is; use the action names actions/checkout and astral-sh/setup-uv to locate the steps.Source: Linters/SAST tools
.github/workflows/pypi.yml (1)
12-12: 🔒 Security & Privacy | 🔵 Trivial | ⚖️ Poor tradeoffSame unpinned-action concern as docker-image.yml.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pypi.yml at line 12, The workflow is using an unpinned GitHub Action in the checkout step, which should be fixed the same way as in docker-image.yml. Update the actions/checkout reference in the pypi workflow to a specific pinned release or commit so the job is reproducible and not tied to a moving tag.Source: Linters/SAST tools
.github/workflows/docs.yml (1)
16-23: 🔒 Security & Privacy | 🔵 Trivial | ⚖️ Poor tradeoffSame unpinned-action concern as docker-image.yml.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/docs.yml around lines 16 - 23, The workflow still uses floating action references, so pin the external actions in the docs workflow to immutable versions instead of tag-based refs. Update the actions used in the checkout/setup steps, specifically actions/checkout and astral-sh/setup-uv, to fixed commit SHAs (and keep their configuration the same) so the workflow is reproducible and consistent with the docker-image workflow.Source: Linters/SAST tools
.github/workflows/windows.yml (1)
18-23: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueConsider pinning actions to commit SHA.
Same unpinned-action concern raised for ubuntu.yml applies here for
actions/checkout@v7andastral-sh/setup-uv@v8.3.0.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/windows.yml around lines 18 - 23, Pin the workflow actions in this job to immutable commit SHAs instead of version tags. Update the uses entries for actions/checkout and astral-sh/setup-uv in the windows workflow to reference their specific commit hashes, keeping the same action behavior while removing the unpinned dependency risk.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/docker-image.yml:
- Line 21: Pin the third-party GitHub Actions references in the workflow instead
of using tag-based versions. Update the action usages for actions/checkout and
docker/build-push-action to full commit SHAs, and keep the version tag in a
comment for readability so the workflow remains tied to a specific reviewed
revision.
In @.github/workflows/ubuntu.yml:
- Around line 19-24: The workflow job uses mutable action tags for
actions/checkout and astral-sh/setup-uv, so update the references in the ubuntu
workflow to pinned commit SHAs instead of version tags. Locate the checkout step
and the Install uv step in the workflow, replace each action version with its
immutable SHA pin, and keep the setup-uv version input unchanged.
In @.github/workflows/windows.yml:
- Around line 15-16: The Windows workflow currently only tests Python 3.13, so
the minimum supported version is not covered on that platform. Update the matrix
in the windows workflow so the job also runs with Python 3.11, keeping the
existing setup around the python-version matrix and the Windows CI job intact.
In `@requirements.txt`:
- Around line 50-51: Update the Numba dependency floor in requirements so it
requires Python 3.13 support; the current numba>=0.60 constraint still permits
0.60.x, so change the version guard in the requirements entry for numba to
numba>=0.61.
---
Duplicate comments:
In @.github/workflows/docs-build.yml:
- Around line 16-23: The workflow still uses unpinned third-party actions, so
update the actions in the docs build job to pinned commit SHAs instead of
floating tags. Apply this to the checkout and setup-uv steps in the workflow,
matching the same pinning approach used elsewhere, and keep the existing step
names and configuration while only changing the action references.
In @.github/workflows/docs.yml:
- Around line 16-23: The workflow still uses floating action references, so pin
the external actions in the docs workflow to immutable versions instead of
tag-based refs. Update the actions used in the checkout/setup steps,
specifically actions/checkout and astral-sh/setup-uv, to fixed commit SHAs (and
keep their configuration the same) so the workflow is reproducible and
consistent with the docker-image workflow.
In @.github/workflows/macos.yml:
- Around line 22-27: The workflow uses a floating action reference for
actions/checkout, so pin it to a specific immutable version or commit like the
other workflow fix. Update the checkout step in the macos workflow to use a
fixed release/sha, and keep the existing setup-uv pin as-is; use the action
names actions/checkout and astral-sh/setup-uv to locate the steps.
In @.github/workflows/pypi.yml:
- Line 12: The workflow is using an unpinned GitHub Action in the checkout step,
which should be fixed the same way as in docker-image.yml. Update the
actions/checkout reference in the pypi workflow to a specific pinned release or
commit so the job is reproducible and not tied to a moving tag.
In @.github/workflows/windows.yml:
- Around line 18-23: Pin the workflow actions in this job to immutable commit
SHAs instead of version tags. Update the uses entries for actions/checkout and
astral-sh/setup-uv in the windows workflow to reference their specific commit
hashes, keeping the same action behavior while removing the unpinned dependency
risk.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 588bde28-8bf0-4881-b0bb-453a1e58d37c
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (10)
.github/workflows/docker-image.yml.github/workflows/docs-build.yml.github/workflows/docs.yml.github/workflows/macos.yml.github/workflows/pypi.yml.github/workflows/ubuntu.yml.github/workflows/windows.ymlpyproject.tomlrequirements.txtrequirements_docs.txt
- Raise numba floor to >=0.61; 0.60.x does not support Python 3.13, and 0.61.0 is the first release with 3.13 support. Refresh uv.lock.
1 participant
Summary
uv add geospatialfailed buildingllvmlite==0.36.0because the resolver backtrackednumbato0.53.1(it caps numpy below the latest, so an ancient numba got chosen), and that old llvmlite has no Python 3.13 wheel. Anumba>=0.60floor keeps numba/llvmlite modern (numba==0.66.0,llvmlite==0.48.0, both ship cp313 wheels).requires-python, classifiers, and the Ubuntu test matrix (3.11,3.12,3.13); bumped the Windows and macOS smoke tests to 3.13.geemap>=0.36.0,leafmap>=0.55.0,pygis>=0.9.0,mkdocs-jupyter>=0.25.1, and thesetup-uvpin from0.4.12to0.11.27.geolibreandgeolibre-wasmto the curated package set.Test plan
uv pip compile requirements.txtresolves cleanly on Python 3.11 and 3.13numba==0.66.0/llvmlite==0.48.0(cp313 wheels available) instead of the failingllvmlite==0.36.0pre-commit run --all-filespassesSummary by CodeRabbit
New Features
Chores