ADR-011: Dependency Management

Status

Accepted. Superseded in part by ADR-025, which moves the ranges into pyproject.toml and compiles the requirements files.

Adapts the platform’s ADR-015: Dependency Management.

Context

An application, like the platform, pins its dependencies. A library can’t: its pins would conflict with its callers’.

Decision

Runtime dependencies are few (httpx, pydantic, pydantic-settings, PyYAML) and declared as compatible ranges in requirements/base.txt, which setup.py installs. Development tools are pinned in requirements/local.txt. Dependabot and Mergify keep both current, as on the platform.

Alternatives Considered

Pin runtime dependencies.
Unbounded ranges.

Consequences

Positive:
- The SDK installs beside any application’s own pins.
Negative:
- The ranges must be tested: CI’s matrix runs the latest versions within them.