Skip to content

chore(deps): update dependency cachetools to v7 #840

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
olavloite merged 1 commit into from
Mar 5, 2026
Merged

chore(deps): update dependency cachetools to v7 #840

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,9 @@ build==1.4.0 \
# via
# -r requirements.in
# pip-tools
cachetools==6.2.6 \
--hash=sha256:16c33e1f276b9a9c0b49ab5782d901e3ad3de0dd6da9bf9bcd29ac5672f2f9e6 \
--hash=sha256:8c9717235b3c651603fff0076db52d6acbfd1b338b8ed50256092f7ce9c85bda
cachetools==7.0.2 \
--hash=sha256:7e7f09a4ca8b791d8bb4864afc71e9c17e607a28e6839ca1a644253c97dbeae0 \
--hash=sha256:938dcad184827c5e94928c4fd5526e2b46692b7fb1ae94472da9131d0299343c
Comment on lines +17 to +19
Copy link

@gemini-code-assist gemini-code-assist bot Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

This update to cachetools is a major version bump, which carries inherent risks. More critically, the project's test suite, as configured in noxfile.py, does not appear to use this requirements.txt file for installing dependencies during testing.

Most test sessions (e.g., unit, system, compliance_test) use session.install('.') or session.install('.[tracing]'). This command resolves dependencies based on the broad version ranges in setup.py (e.g., google-cloud-spanner>=3.55.0) at the time the tests are executed, rather than using the specific pinned versions from this file.

This leads to two significant problems:

  1. This dependency update to cachetools is likely not being tested by the CI pipeline, as the test environment will resolve its own set of dependencies independently.
  2. The primary benefit of pinning dependencies in requirements.txt—ensuring reproducible environments—is lost during the testing phase.

To resolve this, the test sessions in noxfile.py should be updated to install dependencies from this file. For instance, session.install('.') could be changed to session.install('-r', 'requirements.txt', '.'). This would ensure that tests are consistently run against the exact dependency versions specified here.

# via google-auth
certifi==2025.11.12 \
--hash=sha256:97de8790030bbd5c2d96b7ec782fc2f7820ef8dba6db909ccf95449f2d062d4b \
Expand Down
Loading