Dependencies#

Version pinning#

Frequent issues such broken builds or inability to make a release have led us to freeze as many of our build dependencies as possible. Note that this does not imply that runtime dependencies of the final packages are frozen. There are a number of non-obvious dependencies that have led to surprising issues, so we attempt to document this below.

Places that define dependencies#

  • GitHub workflows define runs-on, i.e., VM image versions. We are not using the *-latest images but instead rely on specific ones such as ubuntu-24.04 or windows-2022. Unfortunately GitHub appears to make changes even to the non-latest images, e.g., we once experienced build breaks from a compiler update in the windows-2019 images. In other words, the VM image “versions” are not truly frozen.

  • Actions for GitHub workflows are frozen to specific versions. Dependabot is configured to update these regularely. Note one known issue: pypa/cibuildwheel updates may add support for new Python versions, but our pybind11 may not be supporting it. Make sure to run the release.yml workflow before accepting an update, or consider adding future Python versions to the [tool.cibuildwheel] skip list to make support for new Python versions a process fully under our control.

  • pyproject.toml defines build requirements for Python Wheels, runtime requirements, and “extras” for the pip package.

  • pixi.toml defines all development, CI, and build dependencies. pixi.lock pins resolved versions. Run pixi lock to update the lock file after changing pixi.toml and commit the result; CI verifies that the lock file is up to date.

  • conda/recipe.yaml defines conda package build and runtime dependencies. It mirrors the conda-forge feedstock recipe (where actual releases are built) and is built in CI with rattler-build to catch feedstock breakage early; keep the two in sync. Files in conda/variants/ complement this and set specific versions.

Services / Servers we depend on#

This list is incomplete, but attempts to aid in better understanding how many things we depend on for making PR (including main) and Release builds.

Services#

Service

PR

Release

Comment

github

x

x

https://pypi.org

x

x

https://anaconda.org/conda-forge

x

x

https://public.esss.dk

x

x

pooch files, accessed during docs build