From b3c27a83fa59621732ad00f1c8ebe8ac977a0b35 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Tue, 29 Sep 2026 16:49:09 +0200 Subject: [PATCH] chore: fix dep constriants Signed-off-by: Jan Kowalleck --- pyproject.toml | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 49741777..e9ce6763 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -69,13 +69,13 @@ classifiers = [ cyclonedx-py = "cyclonedx_py._internal.cli:run" [tool.poetry.dependencies] -python = "^3.9" -cyclonedx-python-lib = { version = "^8.0 || ^9.0 || ^10 || ^11", extras = ["validation"] } +python = ">=3.9, <4" +cyclonedx-python-lib = { version = ">=8, <12", extras = ["validation"] } packageurl-python = ">=0.11, <2" # keep in sync with same dep in `cyclonedx-python-lib` -pip-requirements-parser = "^32.0" -packaging = "^22 || ^23 || ^24 || ^25 || ^26" -tomli = { version = "^2.0.1", python = "<3.11" } -chardet = "^5.1" +pip-requirements-parser = ">=32, <33" +packaging = ">=22, <27" +tomli = { version = ">=2.0.1, <3", python = "<3.11" } +chardet = ">=5.1, <6" [tool.poetry.group.dev.dependencies] # pin to exact versions, if the tool/lib/plugin is process-relevant @@ -84,7 +84,7 @@ ddt = "1.7.2" flake8 = "7.3.0" flake8-annotations = "3.1.1" flake8-bugbear = "24.12.12" -flake8-copyright-validator = "^0.0.1" +flake8-copyright-validator = ">=0.0.1, <0.0.2" flake8-isort = "6.1.2" flake8-quotes = "3.4.0" flake8-use-fstring = "1.4" @@ -94,7 +94,7 @@ isort = "6.1.0" autopep8 = "2.3.2" mypy = "1.19.1" bandit = "1.8.6" -tomli = { version = "^2.0.1", python = "<3.11" } +tomli = { version = ">=2.0.1, <3", python = "<3.11" } tox = "4.30.3" pyupgrade = [ { version = "3.21.0", python = "<3.10" }, @@ -112,8 +112,8 @@ setuptools = ">= 47.0.0" # we do not relaly care for exact versions, as long as they have a stable CLI and craft usable virtual-environments pip = ">=23.0" pipenv = ">=2023.11.5" -poetry = "^1.7" -pdm = "^2.11" +poetry = ">=1.7, <2" +pdm = ">=2.11, <3" uv = "0.12.10" # keep pinned to exact version, until a v1.0.0 is released