Skip to content

Relax fireworks-ai dependency pin#429

Closed
benjibc wants to merge 1 commit intomainfrom
codex/relax-fireworks-ai-pin
Closed

Relax fireworks-ai dependency pin#429
benjibc wants to merge 1 commit intomainfrom
codex/relax-fireworks-ai-pin

Conversation

@benjibc
Copy link
Contributor

@benjibc benjibc commented Mar 6, 2026

Summary

  • replace the exact requirement with

Why

currently forces , which conflicts with downstream packages that need newer releases. In local validation this blocked installation alongside the cookbook training package, which requires for .

Relaxing the pin keeps the lower bound while allowing compatible newer 1.x releases.

Validation

  • confirmed the built metadata now contains

Note

Low Risk
Low risk: only adjusts a packaging dependency constraint, though allowing newer fireworks-ai releases could introduce behavior changes if upstream has breaking changes within the permitted range.

Overview
Relaxes the fireworks-ai requirement in pyproject.toml from an exact ==1.0.0a20 pin to a bounded range (>=1.0.0a20,<2) to reduce downstream dependency conflicts while still preventing major-version upgrades.

Written by Cursor Bugbot for commit f2ae018. This will update automatically on new commits. Configure here.

Copy link

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

"peewee>=3.18.2",
"backoff>=2.2.0",
"fireworks-ai==1.0.0a20",
"fireworks-ai>=1.0.0a20,<2",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lockfile not updated to match relaxed dependency specifier

Medium Severity

The uv.lock file still contains specifier = "==1.0.0a20" for fireworks-ai, which is inconsistent with the updated pyproject.toml specifier of >=1.0.0a20,<2. Without regenerating the lockfile, uv sync will either error on the mismatch or continue resolving the old pinned version, undermining the intent of the relaxed pin.

Fix in Cursor Fix in Web

@benjibc
Copy link
Contributor Author

benjibc commented Mar 7, 2026

Superseded by #432, which is now merged and released in v0.3.23.

@benjibc benjibc closed this Mar 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant