novoic/surfboard

Do not pin dependency versions

jonashaag opened this issue · 2 comments

jonashaag commented

Pinning dependencies of a library to an exact version (e.g., pandas==1.0.1) has many drawbacks, for example security issues. I see no reason why the dependencies have to be pinned for surfboard.

Maybe we can pin only the major versions, e.g. pandas>=1,<2.

rlenain commented

Thanks very much -- we'll consider this.

rlenain commented

Addressed in #13 . Thanks for the suggestion @jonashaag