pyronear / pyronear/pyro-engine
Update outdated dependencies and add Dependabot
Open
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 19
- Forks
- 8
- PR merge metrics
- No merged PRs in 30d
Description
Most dependency pins are well behind current releases, and unlike pyro-api this repo has no bot keeping them fresh.
Current state vs latest
| Package | Pinned | Latest |
|---|---|---|
| fastapi (camera API) | >=0.110,<0.111 | 0.141.1 |
| uvicorn (camera API) | >=0.30,<0.31 | 0.52.4 |
| numpy (camera API) | >=1.26.4,<2 | 2.5.3 |
| huggingface_hub | ==0.23.1 | 1.30.0 |
| pillow (predictor) | ==11.0.0 | 12.3.0 |
| onnxruntime | ==1.22.1 | 1.29.0 |
| ncnn | ==1.0.20240410 | 1.0.20260526 |
| opencv-python-headless | <4.12 | 5.0.0.93 |
| pytest | >=7,<8 | 9.1.1 |
| mypy | >=1.9,<2 | 2.3.1 |
| ruff | >=0.14,<0.15 | 0.16.6 |
Proposed work
- Bump ranges in the 4 pyproject files (root, pyro_camera_api, pyro_camera_api/client, pyro-predictor) and align duplicate pins across them.
- Drop redundant tooling from dependency groups: black, isort, flake8, pydocstyle (Makefile and CI only use ruff + mypy), and pytest-asyncio (no async tests).
- Regenerate uv.lock and requirements.txt (uv export command in its header), run make quality + pytest.
- Add .github/dependabot.yml like pyro-api, but simpler: uv + github-actions + docker ecosystems, weekly, grouped PRs, no allowlist.
Risks
- opencv 5.x, numpy 2.x, ncnn 2026 build and huggingface_hub 1.x are only covered by the test suite here; a smoke test on a Pi is needed before deploying.
- Base images are left untouched (camera API is on python:3.9.16-slim); the Dependabot docker ecosystem will propose those bumps separately.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting the four pyproject files, uv.lock, requirements.txt, and the comparable pyro-api Dependabot configuration. Regenerate the dependency outputs using the command documented in requirements.txt, then run make quality and pytest. Done means aligned dependency pins, removed redundant tools, a .github/dependabot.yml covering the requested ecosystems, and a successful Raspberry Pi smoke test before deployment.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, fastapi, github-actions, numpy, python
- Domain
- backend, build-system, ci-cd, devops, testing-qa
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100