safety has too tight dependencies for filelock and psutil

[andy-maier]

Checklist

• I agree to the terms within the Safety Code of Conduct.

Safety version

3.2.14

Python version

3.12.7

Operating System

macOS 14.7.2

Describe the problem you'd like to have solved

safety 3.2.14 has the following dependencies that are specified using the ~= operator:

• filelock~=3.16.1 - this is equivalent to filelock>=3.16.1,<3.17
• psutil~=6.1.0 - this is equivalent to psutil>=6.1.0,<6.2

These dependencies are too tight and already conflict with some other packages we use when testing against minimum package levels.

Describe the ideal solution

My suggestion is to remove all pinning and thus to change these dependencies to:

• filelock>=3.16.1
• psutil>=6.1.0

I do understand that we could also increase our minimum versions for these packages to match the narrow version range allowed by safety, and I do understand that the versions above are the latest and second latest versions of these packages at this point.

However, at some point in the future, there will be other packages that require higher minimum versions of these packages than allowed by safety. That's why I am proposing to remove the pinning altogether.

Alternatives and current workarounds

No response

Additional context

No response

What I Did

In a fresh Python 3.12 virtualenv, on macOS or Linux:

git clone https://github.com/zhmcclient/python-zhmcclient.git
cd python-zhmcclient
PACKAGE_LEVEL=minimum make develop -B

The minimum version of safety we currently specify is 3.2.14

This fails with:

ERROR: Cannot install -r dev-requirements.txt (line 10) and safety==3.2.14 because these package versions have conflicting dependencies.

The conflict is caused by:
    virtualenv 20.26.6 depends on filelock<4 and >=3.12.2
    safety 3.2.14 depends on filelock~=3.16.1
    The user requested (constraint) filelock==3.13.1

To fix this you could try to:
1. loosen the range of package versions you've specified
2. remove package versions to allow pip attempt to solve the dependency conflict

ERROR: ResolutionImpossible: for help visit https://pip.pypa.io/en/latest/topics/dependency-resolution/#dealing-with-dependency-conflicts

[github-actions]

Hi @andy-maier, thank you for opening this issue!

We appreciate your effort in reporting this. Our team will review it and get back to you soon.
If you have any additional details or updates, feel free to add them to this issue.

Note: If this is a serious security issue that could impact the security of Safety CLI users, please email [email protected] immediately.

Thank you for contributing to Safety CLI!