From cd1ced63e122809e25a9f77a7c6f9affecda8df0 Mon Sep 17 00:00:00 2001 From: thePR0M3TH3AN Date: Thu, 20 Aug 2026 09:30:26 -0400 Subject: [PATCH] Pin nostr-sdk below 0.44, which the client code cannot build against MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI went red where the Tests workflow stayed green, and the reason is that the two install from different lockfiles which had drifted apart: poetry.lock held nostr-sdk 0.43.0, requirements.lock had resolved to 0.45.0 under the unbounded `>=0.43`. Two lockfiles disagreeing about a protocol SDK is not a CI quirk — it means the code was being tested against one version and shipped against another. 0.44 removed NostrSigner's constructors, including the NostrSigner.keys the client calls, and changed Client's constructor. Verified against 0.45.0: NostrSigner is left with only get_public_key, sign_event and the nip04/nip44 methods, and Client.__init__ takes no arguments. So this is a real migration touching signing and client setup, not a rename to be done in passing. Bounded at <0.44 in all three places the constraint is declared, and both lockfiles regenerated: requirements.lock resolves 0.43.1, poetry.lock keeps 0.43.0, and the relock changed exactly one line — the content hash — with no version churn anywhere else. Confirmed 0.43.1 still exposes NostrSigner.keys and a Client that takes an argument, since that is what CI will actually install. pip-audit reports no advisory against the 0.43 line, so the bound costs nothing today. The migration is recorded in TODO.md rather than attempted here: it wants the sync round-trip re-validated against a real relay, not folded into a CI fix. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN --- TODO.md | 18 ++++++++++++++++++ poetry.lock | 2 +- pyproject.toml | 4 ++-- requirements.lock | 28 ++++++++++++++-------------- src/requirements.txt | 4 +++- 5 files changed, 38 insertions(+), 18 deletions(-) diff --git a/TODO.md b/TODO.md index 1fa0bc5d..64c5f867 100644 --- a/TODO.md +++ b/TODO.md @@ -235,6 +235,24 @@ everything still open, in the order it should be tackled. It found one real defect — the config API accepting any key and any value, fixed in the same session — and one property worth recording rather than unilaterally changing, below. + - [ ] **Migrate `src/nostr/client.py` to nostr-sdk 0.44+.** The + dependency is pinned `>=0.43,<0.44` because 0.44 removed + `NostrSigner`'s constructors — `NostrSigner.keys(...)`, which + client.py:107 calls — and changed `Client`'s constructor, which + client.py:108 uses. Verified against 0.45.0: `NostrSigner` is left + with only `get_public_key`, `sign_event` and the nip04/nip44 + methods, and `Client.__init__` takes no arguments. + + This surfaced as CI red while the Tests workflow stayed green, + because the two install from different lockfiles and they had + drifted: `poetry.lock` held 0.43.0, `requirements.lock` had + resolved to 0.45.0 under the old unbounded `>=0.43`. Both are now + on the 0.43 line and agree. There is no advisory against 0.43, so + the bound costs nothing today — but it is a bound, and the + migration touches signing and client setup, so it wants doing + deliberately with the sync round-trip re-validated against a real + relay rather than folded into unrelated work. + (Found 2026-08-20 on the first CI run of this branch.) - [ ] **`textual` is an undeclared dependency, so the entire TUI test surface has never run in CI.** It appears in neither `[tool.poetry.dependencies]`, `[tool.poetry.extras]`, nor the dev diff --git a/poetry.lock b/poetry.lock index 4f6e1e79..8da03942 100644 --- a/poetry.lock +++ b/poetry.lock @@ -3709,4 +3709,4 @@ gui-win = ["toga-winforms"] [metadata] lock-version = "2.1" python-versions = ">=3.10,<3.13" -content-hash = "16864a37bf93ae5937963175fd1007e5420ef2d147823e14e3daddc34d724998" +content-hash = "5ee2dfd080286da1852be627cfb93ab42827b0e649c2f927c23a4a3a98acb76a" diff --git a/pyproject.toml b/pyproject.toml index d0c2dc5e..818305f1 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -16,7 +16,7 @@ mnemonic = "*" aiohttp = ">=3.14.3" bcrypt = "*" portalocker = ">=2.8" -nostr-sdk = ">=0.43" +nostr-sdk = ">=0.43,<0.44" websocket-client = "1.7.0" websockets = ">=15.0.0" tomli = "*" @@ -106,7 +106,7 @@ requires = [ "aiohttp>=3.14.3", "bcrypt", "portalocker>=2.8", - "nostr-sdk>=0.43", + "nostr-sdk>=0.43,<0.44", "websocket-client==1.7.0", "websockets>=15.0.0", "tomli", diff --git a/requirements.lock b/requirements.lock index 0836ecb6..cc71e088 100644 --- a/requirements.lock +++ b/requirements.lock @@ -1512,20 +1512,20 @@ mutmut==3.7.0 \ --hash=sha256:1d2f9a1bfa4a474b2213df6b17223150b492bf4a85af0eda4fb322297337fb32 \ --hash=sha256:dc93260fabb3a6fd3693aa8d1746825885cb6f9e66c7f9cc1a0f34fc6388e14a # via -r src/requirements.txt -nostr-sdk==0.45.0 \ - --hash=sha256:00da5e7e387515d1e12779eccfb2c794856f774b4534694200434aa0146a03ed \ - --hash=sha256:15346b498f4df4bb42ef2987cecd9e97ba60294b9bc7bb486e1c4b6bee4f528e \ - --hash=sha256:3b314b5160014bf70b39e95b3cf5cb059050e2fc2f782a0d9916c7ae1559e34f \ - --hash=sha256:45ff1ae2f19fedfa9f91b0c81c1be755b706e2fd1e7865ea46612c2ad1d98a3e \ - --hash=sha256:5a0fc63b69995bf2dac44e479aaec1ce1af71e687c9f4258891e429ed3db25e5 \ - --hash=sha256:5bd1a6b972e9f5ae8c4f4448a148f668f124a3389b72eafb9de00f714e829059 \ - --hash=sha256:78ccdb4766ae627ac9e2c10a7bb224d1e00da48fc7b61c7f48935ae23241fd64 \ - --hash=sha256:8152945cb27b48bbf6f89d73d8560bfbadd202b8e5c165bf5b5532e91feed417 \ - --hash=sha256:9d91d519a93c48ab4d689f975f406d8ee96e39d6876d2aeaaee58de7e66ded93 \ - --hash=sha256:a20cb90f4fa225e57118431fc05d1d567a78a047dab54d34897365fcc5b82498 \ - --hash=sha256:a7e0a886b427356dc94cd0b1bc8421b01eeb5aa9ea26e1b69c21f0a3cc1bc2ad \ - --hash=sha256:b3904abc4d7e4ac46ed66c8aa528e89748f3f25023708e4bbab58bc81d3a99f7 \ - --hash=sha256:e5cae5ef56411d6665de78c39822a4e80382231d44b4a6fc3db096b8b203ec26 +nostr-sdk==0.43.1 \ + --hash=sha256:16d830574d74978cb01bd2464b319651d2d5e77f807eec8a17b154d305bca922 \ + --hash=sha256:29f7c21ebbb2dc5d54aab30521e28da8bbcde8918ff9fdf519f9a30a6d6d6ed5 \ + --hash=sha256:36fc37504912767493c642c0af1845fcd46eb2748eaed081cb31326a1ba4ad9c \ + --hash=sha256:5a2b6d6a1bf46455b45fdf788ec9ff513e8b1de83eb39c8750a74ced56767986 \ + --hash=sha256:6342d9aee9df7b26a8c570a0bbdec8a15307f19da72898bf2a2b52931c96fcef \ + --hash=sha256:69009418f437f0df9b843757fc33344d0b849cf1c81b56f16e209301e30e133b \ + --hash=sha256:6e432d3e10993447afabcf4dba39697ec07351660df1108fa9acc7787a7ee943 \ + --hash=sha256:85f4ae5e98599e62564fc37c2e0b92692d823f2828b6b7bdbf198b11ca609fea \ + --hash=sha256:8ddd0a90d728e4d8ee81f443043e6e2e8e090f4eebcb7b4f6f84a5459671629e \ + --hash=sha256:9e37058e7c00b162418095d160bd2cc92bf3cbc81a439ba5c8baefa5a851d7b0 \ + --hash=sha256:a43ade3ee1cf45452a981f324f2a87b20e11e2bdcb872c1ebe81e34521ae90e7 \ + --hash=sha256:aa03f541ad64fcb332035f235a9b79d8fc0229740fb893beb26904d75859b43b \ + --hash=sha256:f8fda6b129309d584f2e39b3152467f6a9001f767173f93632071f6c659cd9e1 # via -r src/requirements.txt orjson==3.12.0 \ --hash=sha256:010811c1b69773450a01cef97727a67b223242f350b77d4ca000e59a9ef2155a \ diff --git a/src/requirements.txt b/src/requirements.txt index 7f0dcc2e..41668175 100644 --- a/src/requirements.txt +++ b/src/requirements.txt @@ -11,7 +11,9 @@ pytest>=9.0.3,<10 pytest-cov>=4,<7 pytest-xdist>=3,<4 portalocker>=2.8,<4 -nostr-sdk>=0.43,<1 +# 0.44 removed NostrSigner.keys and changed Client's constructor; the +# client code does not build against it yet. See TODO.md. +nostr-sdk>=0.43,<0.44 websocket-client>=1.7,<2 websockets>=15,<16