Conversation
`regex` uses date-based (calendar) versioning, so the caret constraint `^2024.11.6` resolves to `>=2024.11.6,<2025.0.0` and locks out every 2025+ release — even though those are not semver-major breaks. deduce uses `regex` in exactly one place (tokenizer.py: a single `regex.compile` with `\w+`, `regex.I`, `regex.M`), a bedrock API that is stable across these releases; the BSN/phone annotators use the stdlib `re`, not this library. Change the constraint to a floor (`>=2024.11.6`). Full test suite (122 tests) passes with regex 2026.9.3 installed, and end-to-end de-identification is unaffected. This also unblocks downstream environments that need a newer `regex` (e.g. co-installed with transformers>=5.5.0, which requires regex>=2025).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
regexuses date-based (calendar) versioning, not semver. The current constraintexpands (via Poetry's caret rule) to
>=2024.11.6,<2025.0.0, which locks out every 2025+ release ofregex— treating the calendar year2024as if it were a semver major. Those newer releases are not breaking changes; they're routine bugfix/feature releases under the library's date-tag scheme.This blocks any environment that needs a newer
regexalongside deduce — for example co-installingtransformers>=5.5.0, which requiresregex>=2025. Today the two are mutually exclusive purely because of this caret.Why it's safe
deduce uses the
regexlibrary in exactly one place:That's a single
regex.compileusing\w+and theI/Mflags — bedrock API that has been stable for years. (The BSN and phone annotators use the stdlibre, not this library.)Change
Turn the cap into a floor:
poetry.lockregenerated to match (still resolvesregexto2024.11.6by default — the change only permits newer versions, it doesn't force them).Verification
With
regex 2026.9.3installed (≈2 years past the old cap):Happy to adjust the constraint form (e.g. an explicit upper bound at a future known-good version) if you prefer a different policy for this dep.