Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion pyproject.toml
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ license = "MIT"
license-files = ["LICENSE"]
keywords = ["temporal", "workflow"]
dependencies = [
"nexus-rpc==1.3.0",
"nexus-rpc",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unpinned dependency and development git source for nexus-rpc

High Severity

The nexus-rpc dependency was changed from ==1.3.0 to a bare "nexus-rpc" with no version constraint, and a [tool.uv.sources] git override pointing to a feature branch (amazzeo/add-failure) was added. The git source only applies to uv-based installs; pip users installing the published package would resolve nexus-rpc from PyPI with no version floor, potentially getting an old version that lacks the new failure serialization APIs. Every other dependency in the list has version bounds. The version constraint needs to be restored with appropriate bounds, and the [tool.uv.sources] development override needs to be removed before merge.

Additional Locations (1)

Fix in Cursor Fix in Web

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Pin nexus-rpc to a version that supports new failure fields

This change removes the explicit nexus-rpc==1.3.0 requirement while the new converter path now constructs nexusrpc.HandlerError with stack_trace/original_failure (see DefaultFailureConverter.from_failure), which are not guaranteed on older releases. In environments that install from PyPI (which ignore [tool.uv.sources]), resolving to an incompatible nexus-rpc version will raise runtime TypeError the first time a Nexus handler failure is decoded, so this dependency needs a minimum/compatible version constraint.

Useful? React with 👍 / 👎.

"protobuf>=3.20,<7.0.0",
"python-dateutil>=2.8.2,<3 ; python_version < '3.11'",
"types-protobuf>=3.20",
Expand Down Expand Up @@ -230,3 +230,6 @@ exclude = ["temporalio/bridge/target/**/*"]
[tool.uv]
# Prevent uv commands from building the package by default
package = false

[tool.uv.sources]
nexus-rpc = { git = "https://github.com/nexus-rpc/sdk-python.git", branch = "amazzeo/add-failure" }
2 changes: 1 addition & 1 deletion temporalio/api/deployment/v1/message_pb2.pyi
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ class WorkerDeploymentOptions(google.protobuf.message.Message):
BUILD_ID_FIELD_NUMBER: builtins.int
WORKER_VERSIONING_MODE_FIELD_NUMBER: builtins.int
deployment_name: builtins.str
"""Required. Worker Deployment name."""
"""Required when `worker_versioning_mode==VERSIONED`."""
build_id: builtins.str
"""The Build ID of the worker. Required when `worker_versioning_mode==VERSIONED`, in which case,
the worker will be part of a Deployment Version.
Expand Down
2 changes: 2 additions & 0 deletions temporalio/api/failure/v1/message_pb2.pyi
Original file line number Diff line number Diff line change
Expand Up @@ -293,6 +293,8 @@ class ChildWorkflowExecutionFailureInfo(google.protobuf.message.Message):
global___ChildWorkflowExecutionFailureInfo = ChildWorkflowExecutionFailureInfo

class NexusOperationFailureInfo(google.protobuf.message.Message):
"""Representation of the Temporal SDK NexusOperationError object that is returned to workflow callers."""

DESCRIPTOR: google.protobuf.descriptor.Descriptor

SCHEDULED_EVENT_ID_FIELD_NUMBER: builtins.int
Expand Down
102 changes: 61 additions & 41 deletions temporalio/api/nexus/v1/message_pb2.py

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading