build(deps-dev): update insightface requirement from <2,>=0.7 to >=0.7,<3 in /host-python - #673
dependabot[bot] wants to merge 1 commit into
Conversation
Updates the requirements on [insightface](https://github.com/deepinsight/insightface) to permit the latest version. - [Release notes](https://github.com/deepinsight/insightface/releases) - [Commits](https://github.com/deepinsight/insightface/commits) --- updated-dependencies: - dependency-name: insightface dependency-version: '2.0' dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Dependabot proposed widening the face extra to insightface <3 and could not relock, so the lock-freshness gate blocked it exactly as designed. Taken here with the relock. The bump needed no proving, because CI had already proved it without anyone noticing. real-models.yml installed insightface UNPINNED while the face extra capped it at <2, so when 2.0 shipped on 2026-09-08 the weekly job silently began exercising a version the project forbade — run 34837133098 (09-14) installed insightface-2.0, ran every real_model test with zero skips against the real buffalo_l model, and passed. Read the 2.0 wheel to confirm the adapter's surface survives: providers is no longer a named parameter of FaceAnalysis.__init__ but is still honoured through **kwargs, and prepare()/get() keep their signatures. So every entry on that install line now carries its bound. The comment above it has claimed "with the project's own bounds" all along, and insightface was the one entry with none — a job that tests what nobody can install is testing the wrong thing, in either direction. The lock takes 2.0 rather than keeping 0.7.3, so the declared bound, the lock and the version CI exercises finally agree. It also shrinks the graph: easydict and prettytable drop out and the duplicate albumentations/albucore forks collapse, 473 packages to 469. Signed-off-by: LetsGetToWorkBro <info@labyrinth.vision>
…hand (#674) The weekly mutation job went red on 2026-09-14 against a commit that was green on 09-07, and #637's triage loop is what noticed. mutmut 3.8.0 (09-12) is the cause: it fixed "methods of decorated classes are not mutated" and added ternary-condition mutation, widening the net by 37 mutants. Both versions were reproduced locally before any ceiling moved — 3.7.0 gives exactly the documented 229/15/1. Seven of the 23 new survivors had never been executed by any test: the report dataclasses' __str__, whose only apparent reader was an assert MESSAGE, which Python evaluates only when the assert fails. That left FlashReport.__str__ — the eye-safety verdict a human reads — unguarded. Twenty-one of the 23 are killed rather than accommodated, including a real hole where collapsing every timeout hop into a self-loop invents a flood in a figment that has none. flash_safety returns to 15; budgets lands at 231 with the two equivalents itemized. CI confirms. Also takes #673 by hand: insightface 2.0, which real-models.yml had already been exercising unpinned against a <2 bound. Every entry on that install line now carries its bound, and the lock agrees with both. Signed-off-by: LetsGetToWorkBro <info@labyrinth.vision>
|
closing — taken by hand in #674, merged. dependabot couldn't relock, so the lock-freshness gate blocked this exactly as designed. the widening itself was already proven, just not deliberately: so #674 does three things instead of one: widens the bound, pins that install line (its comment claimed "with the project's own bounds" and insightface was the one entry with none), and relocks to 2.0 so the bound, the lock and the version CI exercises finally agree. the upgrade also shrinks the graph — easydict and prettytable drop out, the duplicate albumentations/albucore forks collapse, 473 → 469 packages. Generated by Claude Code |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Updates the requirements on insightface to permit the latest version.
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)