Pin tree-sitter dependency version ranges#1208
Merged
Merged
Conversation
All 27 tree-sitter-* deps were unversioned in pyproject.toml. Users installing via 'pip install graphifyy' (the README's primary install path) bypass uv.lock entirely and resolve whatever tree-sitter-* versions PyPI happens to serve. A breaking minor bump in any grammar package can land in user installs without notice. Add explicit lower bounds (matching uv.lock) and upper bounds one minor above (or one major above for 0.x packages with frequent breaks). Ranges chosen to allow patch updates without re-pinning while blocking incompatible major/minor jumps.
safishamsi
requested changes
Jun 9, 2026
safishamsi
left a comment
safishamsi
left a comment
Collaborator
There was a problem hiding this comment.
Good call on this — unpinned tree-sitter grammars are a real silent-break risk on pip install graphifyy (which doesn't read uv.lock). I cross-checked all 26 bounds against the locked versions in uv.lock and they're all correct: every lower bound ≤ locked version, every upper bound > locked version. The width choices look sensibly tuned per-package too.
One gap: 3 optional-extra grammars remain unpinned
The same silent-break risk exists for grammars in the optional extras block, which this PR doesn't touch:
tree-sitter-sql(extrasql, line ~68) — no specifiertree-sitter-dm(extradm, line ~72) — no specifiertree-sitter-hcl(extraterraform, line ~73) — no specifier (note: it is pinned in thedevgroup already, so the locked version is available for reference)
A user who installs pip install graphifyy[sql] or graphifyy[terraform] hits the exact vulnerability this PR addresses. Please apply the same lower/upper bound scheme to these three and I'll approve.
safishamsi
added a commit
that referenced
this pull request
Jun 12, 2026
rbelem
pushed a commit
to rbelem/graphify
that referenced
this pull request
Jun 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
All 27
tree-sitter-*dependencies inpyproject.tomlare declared with no version specifier:uv.lockcoversuv syncusers, but the README's primary install path (pip install graphifyy/uv tool install graphifyy) does not consult the lock and resolves whatever PyPI currently serves. A breaking minor bump in any of the 27 grammar packages -- and the 0.x ones break often -- can land in user installs without notice.This PR adds explicit lower and upper bounds matching the current
uv.lock:Patch updates still flow through automatically; incompatible major/minor jumps now require a deliberate bump.
Test plan
uv sync --frozenstill works (no lock churn).uv lock --checkpasses (lock is consistent with the new constraints).pip install graphifyyresolves cleanly.🤖 Generated with Claude Code