From c147272853ad4f42fe84ae038799a6c598fb666b Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 7 Oct 2026 01:24:44 +0000 Subject: [PATCH 1/5] build(deps): drop unused runtime dependencies Remove packages from install_requires that the SDK never imports: - setuptools: only setup.py uses it, and pip provides it in the build environment. The <83.0 cap blocked CVE-2026-59890 / GHSA-h35f-9h28-mq5c (fixed in 83.0.0) for every downstream project. - google: the PyPI "google" package is an unofficial Google search scraper. google.protobuf comes from protobuf, google.rpc/google.api from googleapis-common-protos. It also pulled in beautifulsoup4 and soupsieve. - cffi: never imported; cryptography still brings it in. - deprecation: never imported. Move Faker and python-dotenv, used only by tests, to a new "dev" extra, and install it in `make setup` so CI keeps running the test suite. Co-Authored-By: Claude Opus 5.5 --- Makefile | 2 +- setup.py | 9 +++------ 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/Makefile b/Makefile index 9074bbe..9dca6ef 100644 --- a/Makefile +++ b/Makefile @@ -28,7 +28,7 @@ PROTOC_DIR := protoc_gen_openapiv2 setup: create-venv @echo "Installing SDK dependencies in $(VENV_DIR)..." $(VENV_PIP) install --upgrade pip - $(VENV_PIP) install -e ".[flask,fastapi,django]" + $(VENV_PIP) install -e ".[flask,fastapi,django,dev]" create-venv: @if [ ! -d "$(VENV_DIR)" ]; then \ diff --git a/setup.py b/setup.py index b4b2aa8..b31f2dc 100644 --- a/setup.py +++ b/setup.py @@ -12,18 +12,12 @@ install_requires=[ "grpcio>=1.81.0,<2.0", "protobuf>=5.29.5,<8.0.0", - "google>=3.0", "requests>=2.34.0", "PyJWT>=2.13.0", - "cffi>=1.15.1", "cryptography>=50.0.0", - "setuptools>=82.0.1,<83.0", "grpcio-status>=1.81.0,<2.0", "protoc-gen-openapiv2>=0.0.1", "googleapis-common-protos>=1.75.0", - "deprecation>=2.1.0", - "python-dotenv>=1.2.2,<2.0", - "Faker>=33.0.0,<41.0", "pydantic>=2.13.4", "mcp>=1.27.2", ], @@ -34,6 +28,9 @@ "flask": ["flask>=2.0"], "fastapi": ["fastapi>=0.100"], "django": ["django>=4.2"], + # Test-only dependencies (tests/basetest.py loads tests/.env; several + # tests generate fixtures with Faker). Installed by `make setup`. + "dev": ["Faker>=33.0.0,<41.0", "python-dotenv>=1.2.2,<2.0"], }, url="https://github.com/scalekit-inc/scalekit-sdk-python", license="MIT", From 47181eacdb548aa628d76627ac573f5e6d945ec2 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 7 Oct 2026 01:33:22 +0000 Subject: [PATCH 2/5] build(deps): keep python-dotenv as a runtime dependency The SDK doesn't import python-dotenv, but docs pages and customer code call load_dotenv() relying on the SDK to install it. Keep it in install_requires so upgrading doesn't break them; the dev extra now only adds Faker. Co-Authored-By: Claude Opus 5.5 --- setup.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/setup.py b/setup.py index b31f2dc..fd9d0af 100644 --- a/setup.py +++ b/setup.py @@ -18,6 +18,9 @@ "grpcio-status>=1.81.0,<2.0", "protoc-gen-openapiv2>=0.0.1", "googleapis-common-protos>=1.75.0", + # Not imported by the SDK, but kept: docs and customer code call + # load_dotenv() relying on the SDK to install it. + "python-dotenv>=1.2.2,<2.0", "pydantic>=2.13.4", "mcp>=1.27.2", ], @@ -28,9 +31,9 @@ "flask": ["flask>=2.0"], "fastapi": ["fastapi>=0.100"], "django": ["django>=4.2"], - # Test-only dependencies (tests/basetest.py loads tests/.env; several - # tests generate fixtures with Faker). Installed by `make setup`. - "dev": ["Faker>=33.0.0,<41.0", "python-dotenv>=1.2.2,<2.0"], + # Test-only dependencies (several tests generate fixtures with Faker). + # Installed by `make setup`. + "dev": ["Faker>=33.0.0,<41.0"], }, url="https://github.com/scalekit-inc/scalekit-sdk-python", license="MIT", From 2ca2c6c5c9f7c3717fc08a1a67454f66291924b4 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 7 Oct 2026 01:41:00 +0000 Subject: [PATCH 3/5] fix: support Python 3.10 and declare python_requires>=3.10 `import scalekit` failed on Python 3.10: OrganizationClient annotates parameters as Optional[TimeUnit], and TimeUnit is a protobuf EnumTypeWrapper instance, which typing.Optional rejects on 3.10 (3.11 relaxed the check). Postpone annotation evaluation in organization.py. Declare python_requires=">=3.10" (grpcio, protobuf and mcp all require it) with 3.10-3.14 classifiers, so pip refuses older Pythons instead of installing an SDK that cannot import. Update README and TEST_README, which still said 3.8+. Co-Authored-By: Claude Opus 5.5 --- README.md | 4 +--- scalekit/organization.py | 4 ++++ setup.py | 8 ++++++++ tests/TEST_README.md | 2 +- 4 files changed, 14 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index f0f280a..1b3c039 100644 --- a/README.md +++ b/README.md @@ -80,9 +80,7 @@ To use the Scalekit Python SDK, you must have the following: | Component | Version | | --------- | ------- | -| Python | 3.8+ | - -> **Tip:** Although Python 3.8 meets the minimum requirement, using a more recent version (such as Python 3.9 or later) is advisable. +| Python | 3.10+ | ## Examples - SSO with FastAPI diff --git a/scalekit/organization.py b/scalekit/organization.py index 0ed153b..345e0d1 100644 --- a/scalekit/organization.py +++ b/scalekit/organization.py @@ -1,3 +1,7 @@ +# Postponed annotations: Optional[TimeUnit] wraps a protobuf enum wrapper +# object, which typing rejects at import time on Python 3.10. +from __future__ import annotations + from typing import Optional, List, Dict from google.protobuf import wrappers_pb2 diff --git a/setup.py b/setup.py index fd9d0af..dd0ea53 100644 --- a/setup.py +++ b/setup.py @@ -42,8 +42,16 @@ description="Scalekit official Python SDK", long_description=open("README.md").read(), long_description_content_type="text/markdown", + # grpcio, protobuf and mcp all require Python 3.10+. + python_requires=">=3.10", classifiers=[ "Programming Language :: Python :: 3", + "Programming Language :: Python :: 3 :: Only", + "Programming Language :: Python :: 3.10", + "Programming Language :: Python :: 3.11", + "Programming Language :: Python :: 3.12", + "Programming Language :: Python :: 3.13", + "Programming Language :: Python :: 3.14", "License :: OSI Approved :: MIT License", "Operating System :: OS Independent", ], diff --git a/tests/TEST_README.md b/tests/TEST_README.md index 960b29e..92f3418 100644 --- a/tests/TEST_README.md +++ b/tests/TEST_README.md @@ -3,7 +3,7 @@ To run the test cases for this project, follow the steps below: ### Prerequisites -1. Ensure you have Python 3.8 or higher installed. +1. Ensure you have Python 3.10 or higher installed. 2. Install the required dependencies by running: ```sh python3 setup.py install From b189fec8a24c570cec9c8e8e0f1a91b5d55f684d Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 8 Oct 2026 05:56:22 +0000 Subject: [PATCH 4/5] docs: install the dev extra in the test setup steps Faker moved to the dev extra, so the documented install has to include it for test discovery to import the tests that use it. Co-Authored-By: Claude Opus 5.5 --- tests/TEST_README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/TEST_README.md b/tests/TEST_README.md index 92f3418..4837747 100644 --- a/tests/TEST_README.md +++ b/tests/TEST_README.md @@ -4,9 +4,9 @@ To run the test cases for this project, follow the steps below: ### Prerequisites 1. Ensure you have Python 3.10 or higher installed. -2. Install the required dependencies by running: +2. Install the SDK with its framework and test dependencies (or run `make setup`, which does the same in a virtual environment): ```sh - python3 setup.py install + python3 -m pip install -e ".[flask,fastapi,django,dev]" ``` ### Setting Up Environment Variables From 6c764c26fdee5da99f3fadfbaf4c3201389ade61 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 10 Oct 2026 00:06:15 +0000 Subject: [PATCH 5/5] docs(changes): add release notes for the dependency and Python 3.10 changes Co-Authored-By: Claude Opus 5.5 --- ...hanged-20261010-000108-fewer-runtime-dependencies.yaml | 8 ++++++++ .../changed-20261010-000507-minimum-python-3-10.yaml | 8 ++++++++ .../fixed-20261010-000108-python-3-10-import.yaml | 8 ++++++++ 3 files changed, 24 insertions(+) create mode 100644 .changes/unreleased/changed-20261010-000108-fewer-runtime-dependencies.yaml create mode 100644 .changes/unreleased/changed-20261010-000507-minimum-python-3-10.yaml create mode 100644 .changes/unreleased/fixed-20261010-000108-python-3-10-import.yaml diff --git a/.changes/unreleased/changed-20261010-000108-fewer-runtime-dependencies.yaml b/.changes/unreleased/changed-20261010-000108-fewer-runtime-dependencies.yaml new file mode 100644 index 0000000..29b05f6 --- /dev/null +++ b/.changes/unreleased/changed-20261010-000108-fewer-runtime-dependencies.yaml @@ -0,0 +1,8 @@ +kind: changed +body: | + Installing the SDK no longer installs `setuptools`, `google`, `deprecation` or `Faker`, or their dependencies `beautifulsoup4`, `soupsieve` and `packaging`. The SDK imports none of them. The SDK also no longer pins your environment to `setuptools` 82.x. If your code imports one of these packages without declaring it, add it to your own dependencies. +time: '2026-10-10T00:01:08.292217+00:00' +custom: + Breaking: 'No' + Ticket: '' + Migration: '' diff --git a/.changes/unreleased/changed-20261010-000507-minimum-python-3-10.yaml b/.changes/unreleased/changed-20261010-000507-minimum-python-3-10.yaml new file mode 100644 index 0000000..8fd8a43 --- /dev/null +++ b/.changes/unreleased/changed-20261010-000507-minimum-python-3-10.yaml @@ -0,0 +1,8 @@ +kind: changed +body: | + The SDK now declares Python 3.10 as its minimum supported version (`python_requires=">=3.10"`); the README previously listed 3.8. Working installs are unaffected: the previous release's dependencies, such as `grpcio` 1.81, already required Python 3.10. +time: '2026-10-10T00:05:07.307370+00:00' +custom: + Breaking: 'No' + Ticket: '' + Migration: '' diff --git a/.changes/unreleased/fixed-20261010-000108-python-3-10-import.yaml b/.changes/unreleased/fixed-20261010-000108-python-3-10-import.yaml new file mode 100644 index 0000000..60f2eac --- /dev/null +++ b/.changes/unreleased/fixed-20261010-000108-python-3-10-import.yaml @@ -0,0 +1,8 @@ +kind: fixed +body: | + `import scalekit` no longer fails on Python 3.10. Previously it raised `TypeError: typing.Optional requires a single type`; the SDK now imports and runs on Python 3.10. +time: '2026-10-10T00:01:08.210495+00:00' +custom: + Breaking: 'No' + Ticket: '' + Migration: ''