[jeffspahr]

Problem

Release-2.18 Dependabot selects Python 3.14 for projects whose frozen dependencies support older interpreters. The hosted run reports unresolvable MLMD 1.21.0 and TensorFlow 2.21.0 while updating other packages. Ignoring direct MLMD upgrades does not remove MLMD from those resolutions.

The full 20-project audit also found SDK/platform development tooling failing on Python 3.14: docformatter 1.4 metadata generation raises AttributeError: Constant has no attribute s.

The metadata writer and visualization images use Python 3.11; their uv-generated requirements headers do not select Dependabot's interpreter. The PostgreSQL retained-data harness uses Python 3.10 for frozen MLMD 1.14.0.

Changes

Add project-scoped .python-version files: Python 3.11 for backend, metadata writer, visualization, SDK and Kubernetes platform tooling; Python 3.10 for the PostgreSQL harness. The backend selection covers recursively fetched requirements as well. Full patch versions are required by Dependabot's pyenv validation; its version manager selects an available patch in that minor line.

Preserve every package pin, the unconditional MLMD ignore, and Python >=3.9 support in the SDK, pipeline spec and Kubernetes platform packages. Add configuration regression coverage and trigger it for interpreter-file changes. Document the tooling/runtime distinction.

flowchart LR
  A[Before: updater defaults to Python 3.14] --> B[Frozen MLMD and visualization dependencies cannot resolve]
  C[After: project interpreter selection] --> D[Backend Python 3.11]
  C --> E[PostgreSQL harness Python 3.10]
  D --> F[Existing pins resolve]
  E --> F

Loading

Verification

uv run --no-project --with pyyaml python .github/resources/scripts/dependabot_config_test.py

Before: test_projects_select_compatible_updater_python fails for all six missing interpreter files (the two SDK/platform cases were reproduced before extending this PR). After: all 13 tests pass, including the existing unconditional MLMD-ignore guard. YAPF and git diff --check pass.

Full existing requirements resolve independently with uv 0.13.5:

for project in backend backend/metadata_writer backend/src/apiserver/visualization; do
  uv tool run --from uv==0.13.5 uv pip compile "$project/requirements.txt" --python-version 3.11 --python-platform x86_64-manylinux_2_39 -o /tmp/resolver-proof.txt
done
uv tool run --from uv==0.13.5 uv pip compile .github/resources/postgresql-upgrade/requirements.txt --python-version 3.10 --python-platform x86_64-manylinux_2_39 -o /tmp/harness-resolver-proof.txt

All four pass without changing tracked requirements. Repeating metadata-writer/harness resolution with --python-version 3.14 fails because MLMD has no cp314 wheel. Visualization under 3.14 also fails (Python-dependent google-api-core/grpcio constraints); the hosted run separately reports TensorFlow's missing compatible release. Backend's own requirements alone resolve on 3.14, but its nested MLMD requirements do not.

These are resolver checks, not runtime installation tests. Hosted Dependabot selection and end-to-end completion must be verified after merge; the newer post-ignore run is still in progress. No clean hosted result is claimed.

Part of #14421.

Complete 20-project audit

The audit table records all configured projects, interpreter selections and results. Requirements/source/development inputs and immediate-child projects were checked independently using uv 0.13.5 against Linux x86_64-manylinux_2_39. All 20 project dependency sets resolve after the six scoped interpreter selections. Editable local paths were checked against Dependabot's preparer; the backend test's SDK source path remains valid and unchanged. GCPC setup dependency checks use the checkout and do not claim hosted-equivalent isolated setup execution.

Additional before/after reproduction (run separately for sdk/python and kubernetes_platform/python):

uv tool run --from uv==0.13.5 uv pip compile sdk/python/requirements-dev.txt --python-version 3.14 --python-platform x86_64-manylinux_2_39 -o /tmp/dev-before.txt
uv tool run --from uv==0.13.5 uv pip compile sdk/python/requirements-dev.txt --python-version 3.11 --python-platform x86_64-manylinux_2_39 -o /tmp/dev-after.txt

Before fails building pinned docformatter 1.4 metadata; after passes. SDK development requirements also pass an actual pip 3.11 dry-run. Python 3.9 resolution remains passing for the API spec, SDK runtime/dev, Kubernetes platform runtime/dev, and native-migration requirements. No requirements files, package support metadata, or MLMD-ignore rules changed.

All 13 configuration tests, YAPF and whitespace checks pass. Inventory verification confirms the audit table covers exactly the 20 configured projects. Hosted CI and post-merge Dependabot completion remain required; no successful hosted run is claimed.

[github-actions]

Contributor Report for @jeffspahr

Metric	Value
Kubeflow org member	Yes
Issues opened in kubeflow/pipelines	461
Merged PRs in kubeflow/pipelines	383
GitHub account age	3481 days (created 2017-04-21)
PR comments in kubeflow/pipelines	1636

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from jeffspahr. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• .github/OWNERS
• backend/OWNERS
• docs/OWNERS
• kubernetes_platform/OWNERS
• sdk/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment