OCI build is failing on Python 3.15 with pandas 2.3

About

When updating OCI images to use Python 3.15, the process croaks on building pandas 2.3.3.

References

Chore(deps): Bump python from 3.14-slim-trixie to 3.15-slim-trixie in /release/oci #268

Thoughts

It looks like this update is blocked by an older version of pandas. Apparently, for supporting Python 3.15, the project will need to permit installation of pandas v3?

Dependabot?

Why didn't @dependabot submit an update to a more recent version of pandas?

Root cause

We found this message in the most recent Dependabot update log.

Filtered out pandas 3.x because python requirement >= 3.11 is not satisfied by python 3.10.20

Details

updater | 2026/11/04 00:23:54 INFO <job_1679132111> Checking if pandas  needs updating
updater | 2026/11/04 00:23:54 INFO <job_1679132111> Fetching release information from json registry at https://pypi.org/pypi/ for pandas
  proxy | 2026/11/04 00:23:54 [340] GET [https://pypi.org:443/pypi/pandas/json](https://pypi.org/pypi/pandas/json)
  proxy | 2026/11/04 00:23:54 [340] 200 [https://pypi.org:443/pypi/pandas/json](https://pypi.org/pypi/pandas/json)
updater | 2026/11/04 00:23:54 INFO <job_1679132111> Filtered out 1 yanked versions
updater | 2026/11/04 00:23:54 INFO <job_1679132111> Filtered out 4 pre-release versions
updater | 2026/11/04 00:23:54 INFO <job_1679132111> Latest version is 3.1.0
updater | 2026/11/04 00:23:54 INFO <job_1679132111> Fetching release information from json registry at https://pypi.org/pypi/ for pandas
  proxy | 2026/11/04 00:23:54 [342] GET [https://pypi.org:443/pypi/pandas/json](https://pypi.org/pypi/pandas/json)
  proxy | 2026/11/04 00:23:54 [342] 200 [https://pypi.org:443/pypi/pandas/json](https://pypi.org/pypi/pandas/json) (cached)
updater | 2026/11/04 00:23:54 INFO <job_1679132111> Filtered out 1 yanked versions
updater | 2026/11/04 00:23:54 INFO <job_1679132111> Filtered out pandas 3.1.0 because python requirement >= 3.11 is not satisfied by python 3.10.20
updater | 2026/11/04 00:23:54 INFO <job_1679132111> Filtered out pandas 3.1.0rc0 because python requirement >= 3.11 is not satisfied by python 3.10.20
2026/11/04 00:23:54 INFO <job_1679132111> Filtered out pandas 3.0.6 because python requirement >= 3.11 is not satisfied by python 3.10.20
2026/11/04 00:23:54 INFO <job_1679132111> Filtered out pandas 3.0.5 because python requirement >= 3.11 is not satisfied by python 3.10.20
2026/11/04 00:23:54 INFO <job_1679132111> Filtered out pandas 3.0.3 because python requirement >= 3.11 is not satisfied by python 3.10.20
2026/11/04 00:23:54 INFO <job_1679132111> Filtered out pandas 3.0.2 because python requirement >= 3.11 is not satisfied by python 3.10.20
2026/11/04 00:23:54 INFO <job_1679132111> Filtered out pandas 3.0.1 because python requirement >= 3.11 is not satisfied by python 3.10.20
2026/11/04 00:23:54 INFO <job_1679132111> Filtered out pandas 3.0.0 because python requirement >= 3.11 is not satisfied by python 3.10.20
2026/11/04 00:23:54 INFO <job_1679132111> Filtered out pandas 3.0.0rc2 because python requirement >= 3.11 is not satisfied by python 3.10.20
updater | 2026/11/04 00:23:54 INFO <job_1679132111> Filtered out pandas 3.0.0rc1 because python requirement >= 3.11 is not satisfied by python 3.10.20
updater | 2026/11/04 00:23:54 INFO <job_1679132111> Filtered out pandas 3.0.0rc0 because python requirement >= 3.11 is not satisfied by python 3.10.20
updater | 2026/11/04 00:23:54 INFO <job_1679132111> Filtered out 11 unsupported Language 3.10.20 versions
  proxy | 2026/11/04 00:23:55 [344] GET [https://pypi.org:443/pypi/lorrystream/json/](https://pypi.org/pypi/lorrystream/json/)
  proxy | 2026/11/04 00:23:55 [344] 301 [https://pypi.org:443/pypi/lorrystream/json/](https://pypi.org/pypi/lorrystream/json/) (cached)
  proxy | 2026/11/04 00:23:55 [346] GET [https://pypi.org:443/pypi/lorrystream/json](https://pypi.org/pypi/lorrystream/json)
  proxy | 2026/11/04 00:23:55 [346] 200 [https://pypi.org:443/pypi/lorrystream/json](https://pypi.org/pypi/lorrystream/json) (cached)
updater | 2026/11/04 00:23:55 INFO <job_1679132111> No update needed for pandas

Filtered out pandas 3.x because python requirement >= 3.11 is not satisfied by python 3.10.20

I don't know who is announcing a python requirement >= 3.11 here, or who is running python 3.10.20. Can you make more sense of this, @coderabbitai?

Tip

For best results, initiate chat on the files or code changes.

Analysis chain

Script executed:

#!/bin/bash
printf '\n--- Python and dependency configuration files ---\n'
fd --hidden -t f '^(pyproject\.toml|setup\.cfg|setup\.py|\.python-version|runtime\.txt|Pipfile|dependabot\.ya?ml|Dockerfile.*|.*requirements.*\.txt)$' -E .git
printf '\n--- Python and pandas configuration references ---\n'
rg --hidden -n -C3 -g '!.git/**' 'requires-python|python_requires|pandas|python-version|FROM python|package-ecosystem:|target-branch:' .
printf '\n--- Dependabot log version-selection excerpts ---\n'
gh run view 41746275691 --repo daq-tools/lorrystream --job 126299976862 --log 2>&1 | rg -n -C4 '3\.10\.20|python version|Python version|requires-python|\.python-version|runtime\.txt|Language|language version|Updating.*python' | head -220

Length of output: 30670

web_search executed:

Dependabot pip how selects Python version requires-python pyproject.toml .python-version lowest supported version default Python 3.10 unsupported Language filter pandas Requires-Python

Length of output: 13395

Script executed:

#!/bin/bash
printf '\n--- Project metadata and dependency declarations ---\n'
sed -n '1,120p' pyproject.toml
printf '\n--- Dependabot configuration ---\n'
cat -n .github/dependabot.yml
printf '\n--- CI Python matrix ---\n'
sed -n '18,52p' .github/workflows/tests.yml
printf '\n--- Dependabot Python selection implementation ---\n'
curl -fsSL https://raw.githubusercontent.com/dependabot/dependabot-core/main/python/lib/dependabot/python/language.rb | cat -n | head -280
printf '\n--- Dependabot Python requirement parser ---\n'
curl -fsSL https://raw.githubusercontent.com/dependabot/dependabot-core/main/python/lib/dependabot/python/file_parser/python_requirement_parser.rb | cat -n | head -280
printf '\n--- pandas release Python metadata ---\n'
curl -fsSL https://pypi.org/pypi/pandas/3.0.0/json | jq '{version: .info.version, requires_python: .info.requires_python}'

Length of output: 18894

Script executed:

#!/bin/bash
set -euo pipefail
printf '\n--- Upstream Python selector files ---\n'
gh api 'repos/dependabot/dependabot-core/git/trees/main?recursive=1' --jq '.tree[].path | select(startswith("python/lib/")) | select(test("version|requirement|helper"))' | head -100
printf '\n--- Python version selection helper ---\n'
curl -fsSL https://raw.githubusercontent.com/dependabot/dependabot-core/main/python/lib/dependabot/python/helpers.rb | cat -n | head -300

Length of output: 1984

Script executed:

#!/bin/bash
set -euo pipefail
curl -fsSL https://raw.githubusercontent.com/dependabot/dependabot-core/main/python/lib/dependabot/python/language_version_manager.rb | cat -n | head -300

Length of output: 6841

@amotl Yes. The message compares pandas’ Python requirement with Dependabot’s own Python interpreter.

Who requires Python ≥3.11?

pandas does. pandas 3.x publishes Requires-Python: >=3.11 in its package metadata. I confirmed this in the pandas 3.0.0 metadata on PyPI.

This is separate from lorrystream’s requirement. In pyproject.toml, Line 31 declares:

requires-python = ">=3.9"

Who runs Python 3.10.20?

Dependabot does, inside its dependency-update environment. Earlier in the same update log, it reports:

Dependabot is using Python version '3.10.20'.

The log then shows Dependabot selecting Python with pyenv local 3.10 and running pip from /usr/local/.pyenv/versions/3.10.20/.

This interpreter is separate from the OCI build and the test matrix.

Why did Dependabot select 3.10?

Dependabot reads [project].requires-python from pyproject.toml. Its current implementation selects the lowest bundled Python version that satisfies that requirement:

lorrystream permits Python >=3.9.
Dependabot’s bundled interpreters start at 3.10.20.
Therefore, Dependabot selects 3.10.20.
It then excludes pandas 3.x because Python 3.10 does not satisfy pandas’ >=3.11 requirement.

The selection comes from the sorted version list in language.rb and the first-match lookup in language_version_manager.rb.

What this means for `#269`

There are two separate restrictions:

Dependabot excludes pandas 3.x under its selected Python 3.10 interpreter.
pyproject.toml, Line 100 explicitly declares pandas<2.4. This prevents the OCI build from installing pandas 3.x, even under Python 3.15.

If the project drops Python versions below 3.11, raising requires-python to >=3.11 would also move Dependabot’s selected interpreter forward. The pandas constraint would still need a separate update.

If the project keeps older Python support, version-dependent pandas requirements are an option. In either case, allowing pandas 3.x does not by itself establish Python 3.15 compatibility. That needs separate build and test verification.

_{You are interacting with an AI system.}

Hi @coderabbitai. Thanks for the analysis. I think the decision by @dependabot to work this way is wrong. The updater should inform about potential package updates more straight-forward. However, I know about many potential obstacles in production, so I can also understand the decision to be implemented this way.

Well, what does this leave for us? Also migrate this project to Renovate, like we did for others already? Otherwise, we won't ever be notified by @dependabot about a more recent release of pandas?

Tip

For best results, initiate chat on the files or code changes.

Analysis chain

web_search executed:

Find official Renovate documentation for Python requires-python compatibility filtering, constraintsFiltering default and strict behavior, and updating pyproject.toml dependency upper bounds such as pandas<2.4 to new major releases (rangeStrategy widen or replace). Does Renovate surface releases requiring a newer Python than the project minimum? Also find official Dependabot documentation on overriding the Python interpreter for pip version updates, and whether there is a configuration option to report releases filtered by Requires-Python. Provide precise references and distinguish release detection from dependency resolution.

Length of output: 31395

@amotl Renovate is a reasonable choice for the release visibility you want. Its default behavior differs from Dependabot in this case.

Renovate does not filter updates by Python compatibility by default. It can therefore propose a pandas 3.x update even when that release requires a newer Python version than the project’s minimum. Its documentation explicitly describes the problem you identified: compatibility filtering can leave maintainers unaware of newer releases.

Will Dependabot never notify us?

Not “never,” but the current setup excludes pandas 3.x. Dependabot can still propose eligible pandas 2.x updates. Under the selection behavior established above, it will continue to filter pandas 3.x while it selects Python 3.10.

Raising the project’s Python minimum to >=3.11 would remove this particular compatibility filter. However, I would not drop supported Python versions only to change updater behavior.

Also, the pandas<2.4 constraint is not inherently a notification barrier. Dependabot can widen dependency constraints in an update PR. That operation is separate from the Python compatibility filter.

Recommendation

Given your existing use of Renovate elsewhere, I recommend migrating for consistent update visibility.

For this migration:

Keep constraintsFiltering at its default, "none". Setting it to "strict" can suppress the updates you want to see.
Ensure the configuration permits major updates and changes to dependency upper bounds.
Keep automerge disabled for pandas major updates.
Use CI to evaluate compatibility before merging.

Renovate can make the newer release visible. It cannot make the release compatible. If the project keeps older Python support, the pandas update may need Python-version markers. If the project drops that support, it may instead raise requires-python.

The Python 3.15 OCI build still needs separate verification. A pandas 3.x update is not proof that the build will succeed.

_{You are interacting with an AI system.}

Also, the pandas<2.4 constraint is not inherently a notification barrier. Dependabot can widen dependency constraints in an update PR. That operation is separate from the Python compatibility filter.

@coderabbitai: This intrigues me. Can we try to configure Dependabot correspondingly? Can you provide a configuration file?

Tip

For best results, initiate chat on the files or code changes.

Analysis chain

Script executed:

#!/bin/bash
set -euo pipefail
printf '\n--- Existing Dependabot configuration ---\n'
cat -n .github/dependabot.yml
printf '\n--- Python and pandas requirements ---\n'
rg -n -C3 'requires-python|pandas' pyproject.toml

Length of output: 1903

web_search executed:

Check the official GitHub Dependabot options reference for versioning-strategy: Does the pip ecosystem support widen for pyproject.toml dependency upper bounds? What is pip's default strategy, and how do increase and widen differ? Provide the supported-ecosystem table and relevant limitations. Also confirm whether versioning-strategy bypasses Python Requires-Python filtering. https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#versioning-strategy

Length of output: 30802

@amotl Yes. Set versioning-strategy: "widen" on the pip entry.

Use this configuration for .github/dependabot.yml. It preserves your existing ecosystems and schedules.

version: 2

updates:
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"
    versioning-strategy: "widen"

  - package-ecosystem: "docker"
    directory: "/release/oci"
    schedule:
      interval: "weekly"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "monthly"

GitHub documents widen as expanding the allowed version range to include newer releases while retaining older versions where possible. This setting applies to all dependencies managed by this pip entry, not only pandas.

Important limitation

This configuration will not remove the pandas 3.x Python compatibility filter. I should make that limit explicit in my earlier recommendation.

The two checks remain separate:

Check	Effect of `widen`
The manifest declares `pandas<2.4`	Dependabot can expand the upper bound for an eligible release.
pandas 3.x requires Python ≥3.11, but Dependabot selects Python 3.10.20	Dependabot still excludes the release.

Your current configuration omits versioning-strategy. Dependabot’s default behavior can already widen ranges for dependencies it classifies as library dependencies. The explicit setting removes that automatic choice; it does not necessarily change the result.

You can merge this configuration and trigger Check for updates on the pip update job. Check the resulting log for the selected Python version and the pandas exclusion message. If Dependabot still selects Python 3.10.20, this setting alone will not produce a pandas 3.x PR.

_{You are interacting with an AI system.}

@coderabbitai: Thank you. Added with 4a2b25d. Let's see if this will improve the situation.

@amotl

Tip

For best results, initiate chat on the files or code changes.

@amotl Thanks for adding the configuration. The next Dependabot run will show whether explicit widen changes its update proposals.

If the log still reports Python 3.10.20, pandas 3.x will remain excluded. The range strategy does not override that compatibility check.

If you found this response helpful, would you consider giving us a shout-out on X?

Thank you for using CodeRabbit!

_{You are interacting with an AI system.}

@coderabbitai: GitHub is emitting an admonition after implementing your suggestion.

#### Your .github/dependabot.yml contained invalid details
Dependabot encountered the following error when parsing your .github/dependabot.yml:
The property '#/updates/0/versioning-strategy' value "widen" did not match one of the following values: lockfile-only, auto, increase, increase-if-necessary
Please update the config file to conform with Dependabot's specification.

-- https://github.com/daq-tools/lorrystream/network/updates

Tip

For best results, initiate chat on the files or code changes.

Analysis chain

Script executed:

#!/bin/bash
set -euo pipefail
fd --hidden -t f '^dependabot\.ya?ml$' -E .git
cat -n .github/dependabot.yml

Length of output: 1130

web_search executed:

Check official GitHub Dependabot documentation versioning-strategy support for pip: widen is unsupported, accepted auto increase increase-if-necessary lockfile-only. Explain pip default auto and whether increase-if-necessary changes upper bounds only when needed. https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#versioning-strategy

Length of output: 30767

@amotl You are right. My recommendation was incorrect. Dependabot does not support versioning-strategy: "widen" for pip. I’m sorry for the invalid configuration.

I checked .github/dependabot.yml. Line 13 still contains that setting. Replace it with the accepted auto value:

-    versioning-strategy: "widen"
+    versioning-strategy: "auto"

Alternatively, remove the versioning-strategy line to use the default behavior. Keep the other entries unchanged.

The Dependabot options reference lists strategies with ecosystem-specific support. I failed to check that distinction before recommending widen.

This correction addresses the reported configuration error, not the pandas update restriction. While Dependabot selects Python 3.10.20, it will still exclude pandas releases that require Python ≥3.11. My proposed widen experiment was therefore both invalid for pip and unable to solve the original problem.

Learnings added

Learnt from: amotl
URL: https://github.com/daq-tools/lorrystream/issues/269

Timestamp: 2026-11-04T22:04:33.039Z
Learning: Within repository "daq-tools/lorrystream", only for files matching one of [".github/dependabot.yml"]: When reviewing the pip update entry in .github/dependabot.yml, reject versioning-strategy: "widen" because GitHub's pip configuration validator does not accept it. Omit the option for default behavior, or use a strategy supported specifically for pip; do not infer support from the general list of Dependabot strategies.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

_{You are interacting with an AI system.}

@coderabbitai: So, what's the solution now? Migrate to Renovate, like proposed?

Tip

For best results, initiate chat on the files or code changes.

Analysis chain

web_search executed:

Verify from official Renovate documentation: Does Renovate's Python pep621 manager update dependencies in pyproject.toml, including upper bounds such as pandas<2.4? Which rangeStrategy is supported for this case (widen versus replace)? Does constraintsFiltering default to none and allow proposals for releases requiring newer Python than the project's requires-python? Identify limitations, including unsupported range strategies and package lookup versus lockfile resolution. Also confirm whether migrating just pip dependencies while keeping Dependabot for Docker and GitHub Actions is supported operationally. Provide official documentation links and avoid guaranteeing that a particular pandas PR will be created.

Length of output: 31163

@amotl Yes. I recommend moving Python dependency updates to Renovate first. You can keep Dependabot for Docker and GitHub Actions during the transition.

My widen recommendation for Dependabot was wrong. Changing to another accepted Dependabot strategy does not remove the Python compatibility filter shown in your log.

Recommended approach

Enable Renovate for Python dependencies.
Configure its pep621 manager to update dependencies in pyproject.toml.
Use rangeStrategy: "widen" for pandas. Renovate’s PEP 440 implementation explicitly supports this strategy.
Keep automerge disabled.
Check the first Renovate run for a pandas 3.x proposal or a documented reason for its absence.
Once Renovate handles Python updates, remove the Dependabot pip entry to prevent duplicate PRs.

Renovate documents constraintsFiltering: "none" as the default. However, that setting alone does not guarantee a pandas PR. Package lookup, range handling, other configuration, and any lockfile resolution can still affect the result. Verify the first run before treating the migration as successful.

Separate from the migration

The migration addresses update visibility, not Python 3.15 compatibility.

For #269, the project still needs to permit an appropriate pandas release and verify the OCI build. If older Python versions remain supported, the dependency declarations may need Python-version markers.

I would not raise the project’s minimum Python version only to change Dependabot’s behavior.

_{You are interacting with an AI system.}

Navigation Menu

Repository navigation

OCI build is failing on Python 3.15 with pandas 2.3 #269

About

References

Thoughts

Dependabot?

Root cause

Details

Who requires Python ≥3.11?

Who runs Python 3.10.20?

Why did Dependabot select 3.10?

What this means for `#269`

Will Dependabot never notify us?

Recommendation

Important limitation

Recommended approach

Separate from the migration

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

OCI build is failing on Python 3.15 with pandas 2.3 #269

Description

About

References

Activity

amotl commented on Nov 4, 2026

Thoughts

amotl commented on Nov 4, 2026

Dependabot?

Root cause

Details

amotl commented on Nov 4, 2026

coderabbitai commented on Nov 4, 2026

Who requires Python ≥3.11?

Who runs Python 3.10.20?

Why did Dependabot select 3.10?

What this means for #269

amotl commented on Nov 4, 2026

coderabbitai commented on Nov 4, 2026

Will Dependabot never notify us?

Recommendation

amotl commented on Nov 4, 2026

coderabbitai commented on Nov 4, 2026

Important limitation

amotl commented on Nov 4, 2026

coderabbitai commented on Nov 4, 2026

amotl commented on Nov 4, 2026

coderabbitai commented on Nov 4, 2026

amotl commented on Nov 4, 2026

coderabbitai commented on Nov 4, 2026

Recommended approach

Separate from the migration

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

What this means for `#269`