💅📦 Split transitive dep constraints

This is a structural change allowing for better placement of direct dependencies and limiting the transitive ones.
pypa · Dec 7, 2024 · 43caae4 · 43caae4
1 parent f371c3d
commit 43caae4
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 6 deletions.
diff --git a/requirements/runtime-constraints.in b/requirements/runtime-constraints.in
@@ -0,0 +1,20 @@
+###############################################################################
+#                                                                             #
+# This file is only meant to exclude broken dependency versions, not feature  #
+# dependencies.                                                               #
+#                                                                             #
+# GUIDELINES:                                                                 #
+#   1. Only list PyPI project versions that need to be excluded using `!=`    #
+#      and `<`.                                                               #
+#   2. It is allowed to have transitive dependency limitations in this file.  #
+#   3. Apply bare minimum constraints under narrow conditions, use            #
+#      environment markers if possible. E.g.  `; python_version < "3.12"`.    #
+#   4. Whenever there are no constraints, let the file and this header        #
+#      remain in Git.                                                         #
+#                                                                             #
+###############################################################################
+
+# NOTE: 1.12.0 and later enable support for metadata 2.4
+# NOTE: This can be dropped once twine stops using pkginfo
+# Ref: https://github.com/pypa/twine/pull/1180
+pkginfo ~= 1.12.0
diff --git a/requirements/runtime.in b/requirements/runtime.in
@@ -1,9 +1,6 @@
-twine ~= 6.0
+-c runtime-constraints.in  # limits known broken versions
 
-# NOTE: 1.12.0 and later enable support for metadata 2.4
-# NOTE: This can be dropped once twine stops using pkginfo
-# Ref: https://github.com/pypa/twine/pull/1180
-pkginfo ~= 1.12.0
+twine ~= 6.0
 
 # NOTE: Used to detect an ambient OIDC credential for OIDC publishing,
 # NOTE: as well as PEP 740 attestations.

diff --git a/requirements/runtime.txt b/requirements/runtime.txt
@@ -68,7 +68,7 @@ packaging==24.1
     #   twine
 pkginfo==1.12.0
     # via
-    #   -r runtime.in
+    #   -c runtime-constraints.in
     #   twine
 platformdirs==4.2.2
     # via sigstore