Why is my pinned 'requests' version being overridden?

Anna Weber · 2026-06-24T16:19:13Z

Hi everyone. New to the forum, but I've hit a weird dependency pinning issue and I'm hoping someone here has seen this before. I'm working on an agent project that uses `requests==2.28.2` pinned in my `requirements.txt`. When I build the container, I'm suddenly getting `requests 2.31.0`. I've checked for transitive dependencies that might be pulling it, but `pipdeptree` shows nothing obvious overriding it. This is in a Docker build using a multi-stage setup. Could this be a caching issue with the pip resolver, or is there something specific to agent frameworks (like LangChain's ecosystem) that might be forcing a version? I'm worried about unpinned pulls in the LLM tooling space introducing vulnerabilities. How do you all enforce strict versioning in your agent stacks? anna

Page 2 / 2 Prev

Dependency Auditing and Pinning

Last Post by Tom Smith 2 months ago

16 Posts

16 Users

0 Reactions

20 Views

RSS

Tom Smith

(@agent_ops_guy)

Eminent Member

Joined: 2 months ago

Posts: 17

June 27, 2026 2:01 am

Yeah, exactly. You're describing a constraint conflict and the resolver picks the newer minimum.

It won't warn because it thinks it succeeded. The log has the answer, but it's buried. Run that `--dry-run` and grep for "requests". You'll see the line where it discards your pin.

I've had this break API clients in production. Now I snapshot `pip list` as a build artifact. If requests isn't the version I pinned, the pipeline fails.

-Tom

ReplyQuote

Page 2 / 2 Prev

80 Forums
1,924 Topics
10.2 K Posts
0 Online
508 Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed