Skip to content

Remove the unreferenced, stale requirements*.txt files (Dependabot will keep bumping them) #968

Open

Description

@cemililik

Three requirements files sit at the repository root and nothing references them:

  • requirements.txt
  • requirements-eval.txt
  • requirements-linux.txt

A repository-wide search finds no reference from the Dockerfile, docker-compose.yaml, any workflow, any test, or any document that uses them as a source. Everything installs through pyproject.toml — [project.dependencies] and the extras.

They are also stale. requirements.txt declares torch>=2.0.0 and transformers>=4.38.0, where pyproject.toml requires torch>=2.4.0,<3.0.0 and transformers>=5.3.0,<6.0.0.

Why now. .github/dependabot.yml (added in #964) will open pull requests against them weekly: the pip ecosystem scans requirements*.txt in the configured directory, not only pyproject.toml. Those pull requests have to be closed by hand every week until this is resolved.

Acceptance criteria:

  • The three files are deleted, and the PR records how each was confirmed unreferenced; or
  • any that is load-bearing is regenerated from pyproject.toml and referenced from the place that needs it.
  • pyproject.toml's comment about requirements.lock (line 6) and the requirements.lock decision row in docs/roadmap/risks-and-decisions.md are reconciled with the outcome.

Activity

  1. added
    severity: lowMinor defect, inaccuracy or rough edge
    wave: 4Roadmap wave 4: low / info / watch, when touching the module
    on Oct 17, 2026
  2. cemililik commented on Oct 17, 2026

    @cemililik
    CollaboratorAuthor

    Where to start

    Thanks for taking a look. Please confirm the issue is unassigned and comment before starting so work does not overlap.

    Start with these files on development:

    Delete the three files. The note at the top of dependabot.yml already says they are stale, referenced by nothing, and should be removed when this cleanup lands, so the first acceptance criterion (delete) is the intended one. In the PR, say how you confirmed each file unreferenced (the issue lists where it looked: Dockerfile, docker-compose.yaml, the workflows, tests/ and the documentation).

    Two references the issue does not list: remove or reword the note in dependabot.yml that describes these files as stale, and remove the requirements*.txt line from .dockerignore, which becomes a pattern for files that no longer exist. The third criterion asks you to reconcile the requirements.lock comment at the top of pyproject.toml and its decision row in docs/roadmap/risks-and-decisions.md (F-PR29-A6-lock-file, #532). That row is about a future lock file, not these three; if you find it still accurate after the deletion, say so in the PR rather than editing it.

    Run the checks that read these files:

    pytest tests/test_packaging.py --no-cov
    python3 tools/check_source_path_refs.py --strict
    python3 tools/check_anchor_resolution.py --strict

    No GPU, network access or model downloads are needed. Add an entry under ## [Unreleased] in CHANGELOG.md. No documentation page changes, so there is no Turkish mirror to update.

    Open the PR against development with Fixes #968.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: packaging-ciCode area: packaging-cidependenciesDependency or ecosystem currencyenhancementNew feature or requestgood first issueGood for newcomersseverity: lowMinor defect, inaccuracy or rough edgewave: 4Roadmap wave 4: low / info / watch, when touching the module

    Type

    No type

    Projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions