requirements.txt has no version pins #7

New issue

Closed

opened 2026-07-28 21:01:48 +00:00 by paulloth1 · 1 comment

paulloth1 commented

2026-07-28 21:01:48 +00:00

(Migrated from github.com)

Problem

`requirements.txt` lists `fastapi`, `uvicorn`, `jinja2`, `httpx`, `python-multipart`, `aiosqlite` with no version constraints at all. A fresh `pip install -r requirements.txt` on a new Pi (or after a venv rebuild) can pull in breaking major-version upgrades of any of these with no warning, especially FastAPI/Starlette which move fairly quickly.

Suggested fix

Pin exact versions (ideally via `pip freeze` from the currently-deployed venv, or a `requirements.lock`) so a fresh setup reproduces the same environment that's actually been tested.

## Problem \`requirements.txt\` lists \`fastapi\`, \`uvicorn\`, \`jinja2\`, \`httpx\`, \`python-multipart\`, \`aiosqlite\` with no version constraints at all. A fresh \`pip install -r requirements.txt\` on a new Pi (or after a venv rebuild) can pull in breaking major-version upgrades of any of these with no warning, especially FastAPI/Starlette which move fairly quickly. ## Suggested fix Pin exact versions (ideally via \`pip freeze\` from the currently-deployed venv, or a \`requirements.lock\`) so a fresh setup reproduces the same environment that's actually been tested.

paulloth1 commented

2026-07-28 21:19:31 +00:00

(Migrated from github.com)

Fixed in b95ed21: pinned all 6 direct dependencies in requirements.txt to the exact versions currently deployed and tested on the Pi.

Fixed in b95ed21: pinned all 6 direct dependencies in requirements.txt to the exact versions currently deployed and tested on the Pi.