chore(deps): bump google-cloud-firestore - #989
lahirumaramba wants to merge 3 commits into
Conversation
Update google-cloud-firestore requirement to >=2.28.0 for Python >=3.10 and keep >=2.27.0 for Python <3.10 because google-cloud-firestore 2.28.0 dropped support for Python 3.9.
There was a problem hiding this comment.
Code Review
This pull request updates the google-cloud-firestore dependency in requirements.txt to apply different version constraints based on the Python version. The reviewer identifies a potential issue with using lexicographical string comparisons for Python version markers, which could cause incorrect dependency resolution in some environments. They suggest using specific equality checks (python_version != '3.9' and python_version == '3.9') to ensure robust behavior across all dependency parsers.
| google-cloud-firestore >= 2.28.0; platform.python_implementation != 'PyPy' and python_version >= '3.10' | ||
| google-cloud-firestore >= 2.27.0; platform.python_implementation != 'PyPy' and python_version < '3.10' |
There was a problem hiding this comment.
Using python_version >= '3.10' and python_version < '3.10' can lead to unexpected behavior with older or alternative package managers, dependency parsers, and security scanners that incorrectly perform lexicographical string comparison instead of PEP 440 version comparison.
Specifically, under lexicographical comparison:
'3.9' >= '3.10'evaluates toTrue(since'9' > '1'), which would incorrectly select the>= 2.28.0requirement on Python 3.9.'3.9' < '3.10'evaluates toFalse, failing to select the>= 2.27.0requirement on Python 3.9.
Since the minimum supported Python version for this project is 3.9 (as specified in setup.py), you can safely use python_version != '3.9' and python_version == '3.9' respectively. This is completely robust against any lexicographical string comparison bugs.
google-cloud-firestore >= 2.28.0; platform.python_implementation != 'PyPy' and python_version != '3.9'
google-cloud-firestore >= 2.27.0; platform.python_implementation != 'PyPy' and python_version == '3.9'
Update
google-cloud-firestorerequirement inrequirements.txtfrom>= 2.27.0to>= 2.28.0for Python >= 3.10 environments, while preserving>= 2.27.0for Python < 3.10 environments. This prevents dependency resolution errors on Python 3.9 wheregoogle-cloud-firestore2.28.0 dropped support.