A version pinned in requirements.txt is not binding on the passes that follow it #8354

What happened?

amber/requirements.txt pins typing_extensions==4.14.1. What CI installs is 4.16.0.

The licence check is what made this visible, by failing the Python 3.12 leg on 2 September once the recorded version no longer matched the installed one:

DRIFT (direct) Python packages — claimed versions differ from bundled:
  ~ typing-extensions: LICENSE-binary=4.14.1  bundled=4.16.0
ACTION REQUIRED
  Direct deps always block CI — a version bump may carry license changes.

typing-extensions 4.16.0 has been on PyPI since 2 July, so its release is not what changed. anyio 4.15.0 raised its floor to typing_extensions>=4.16.0, and the transitive closure of operator-requirements.txt is not pinned, so the pass that installs it now has to take the newer version. The 3.12 leg was green at 21:24 on 2 September and red on the next run of it.

The dependencies are installed in three passes, each its own command:

uv pip install --system --index-strategy unsafe-best-match -r amber/requirements.txt
uv pip install --system --index-strategy unsafe-best-match -r amber/operator-requirements.txt
uv pip install --system --index-strategy unsafe-best-match -r amber/dev-requirements.txt

A version pinned in the first file is not a constraint on the second. Anything the later files pull in can raise it, and the pin stops meaning what it says without anything reporting that it has.

Refreshing LICENSE-binary-python clears the check, which is what has been done each time this surfaces (#7285, #8292). It leaves the pin as decoration.

This is not about one package. Any pin in the first file can drift the same way, and only a check that happens to compare the two will notice.

Resolving the two files separately shows it without installing anything:

$ uv pip compile amber/requirements.txt --python-version 3.12
typing-extensions==4.14.1

$ uv pip compile amber/operator-requirements.txt --python-version 3.12
anyio==4.15.0
typing-extensions==4.16.0
    # via
    #   anyio
    #   huggingface-hub
    #   torch

The first file's own closure honours the pin. The second file's does not contain it, so the pass that installs that file raises the version already on disk, and nothing reports that a pinned package moved.

#8375 has since refreshed LICENSE-binary-python to 4.16.0, which is the right record of what is installed and clears the failing check. It leaves amber/requirements.txt saying typing_extensions==4.14.1, which is now the one statement in the tree that is not true.

How to reproduce?

Install the three files in the order CI does, then ask pip which version of typing_extensions is present. It reports 4.16.0, not the 4.14.1 the first file pins.

Version/Branch

main

Commit Hash (Optional)

What browsers are you seeing the problem on?

Relevant log output

build / pyamber (ubuntu-latest, 3.12)
Step: Check installed Python packages against per-module LICENSE-binary files
https://github.com/apache/texera/actions/runs/33688978291/job/100443129847