Remove obsolete dependency pins (#21690)

## Summary & Motivation

Remove obsolete upper-bound dependency pins across several packages.
These pins were all stale — either referencing bugs that were fixed
years ago, or tied to infrastructure that has since been upgraded.

Also removes the `extensions/v1beta1` ingress template from the helm
chart and its associated tests, since `extensions/v1beta1/Ingress` was
removed from Kubernetes in 1.22 (August 2021).

### Pin removals

| Package | Pin removed | Why it's safe |
|---------|------------|---------------|
| **dagster-helm** `[test]` | `kubernetes<22.6.0` → `>=31` | Pin was for
k8s API version 1.19 compat. `dagster-k8s` already supports
`kubernetes<36`, and `cloud-admin-panel` already requires `>=31`. |
| **dagstermill** `[test]` | `tqdm<=4.48` → unpinned | Pin was for
[tqdm#1049](tqdm/tqdm#1049) (2020 notebook
compat bug, long fixed). `tqdm` isn't even imported in dagstermill. |
| **dagster-ssh** `[test]` | `cryptography==2.6.1` removed,
`pytest-sftpserver` bumped to `>=1.3.0` | `cryptography` 2.6.1 is from
2019. `pytest-sftpserver` doesn't depend on cryptography at all — the
pin was a stale workaround. |
| **dagster-sigma** `[test]` | `aiohttp<3.11` removed | `dagster-sigma`
main deps already use `aiohttp` without a cap. The test pin conflicted
with `dagster-cloud-backend`'s `aiohttp>=3.11.4`. |
| **dagster-airlift** `[test]` | `fastapi<0.118` removed | Pin was for
an [Airflow internal compat
issue](apache/airflow#57769 (comment)).
Latest fastapi (0.135+) requires `starlette>=0.46.0` with no upper
bound, which is compatible with the rest of the workspace. |
| **dagster-buildkite** | `urllib3<2` removed | Pin was for old BK base
image lacking OpenSSL 1.1.1+
([context](psf/requests#6432)). Current BK
base image is from July 2024 and ships OpenSSL 3.x. |
| **dagster-cloud-backend** `[tests]` | `botocore<1.32.1` removed | No
comment explaining the pin. `boto3>=1.29.0` is already a main dep, which
pulls in a matching botocore transitively. The upper bound was blocking
`urllib3>=2` needed by `tableauserverclient`. |

### Helm chart cleanup

- Removed `templates/ingress-v1beta1.yaml` — the
`extensions/v1beta1/Ingress` API was removed from Kubernetes in 1.22
(August 2021). The v1 ingress template (`networking.k8s.io/v1`) remains.
- Removed `ExtensionsV1beta1Ingress` test parametrizations from
`test_ingress.py` since the model no longer exists in `kubernetes>=31`.

## Test Plan

- Lockfile resolves successfully with all pins removed
- These are all test/dev dependency changes — no impact on production
package installs
- Helm ingress tests still cover v1 ingress functionality

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Internal-RevId: 0b2ce9e54a9626b725354ce676fa81411200a5b4

Author: 2 people

.buildkite/dagster-buildkite/pyproject.toml

@@ -20,9 +20,6 @@ dependencies = [
     "requests",
     "typing_extensions>=4.2",
     "pathspec",
-    # Need this until we have OpenSSL 1.1.1+ available in BK base image
-    # Context: https://github.com/psf/requests/issues/6432
-    "urllib3<2",
     "pytest",
 ]
 

helm/dagster/schema/pyproject.toml

@@ -25,8 +25,7 @@ dagster-helm = "schema.cli:main"
 
 [project.optional-dependencies]
 test = [
-    # remove pin once minimum supported kubernetes version is 1.19
-    "kubernetes<22.6.0",
+    "kubernetes>=31",
     "dagster",
     "dagster-aws",
     "dagster-azure",

helm/dagster/schema/schema_tests/test_ingress.py

@@ -26,22 +26,7 @@ def helm_template_function():
 # Parametrizing "webserver_field" here tests backcompat. `dagit` was the old field name.
 # This parametrization can be removed in 2.0.
 @pytest.mark.parametrize("webserver_field", ["dagsterWebserver", "dagit"])
-@pytest.mark.parametrize(
-    argnames=["output", "model", "api_version"],
-    argvalues=[
-        (
-            "templates/ingress-v1beta1.yaml",
-            models.ExtensionsV1beta1Ingress,
-            "extensions/v1beta1/Ingress",
-        ),
-        (
-            "templates/ingress.yaml",
-            models.V1Ingress,
-            "networking.k8s.io/v1/Ingress",
-        ),
-    ],
-)
-def test_ingress(template_function, webserver_field, output, model, api_version):
+def test_ingress(template_function, webserver_field):
     webserver_kwargs = {
         webserver_field: WebserverIngressConfiguration.construct(
             host="foobar.com",
@@ -58,11 +43,11 @@ def test_ingress(template_function, webserver_field, output, model, api_version)
         )
     }
 
-    template = template_function(output, model)
+    template = template_function("templates/ingress.yaml", models.V1Ingress)
     helm_values = DagsterHelmValues.construct(
         ingress=Ingress.construct(
             enabled=True,
-            apiVersion=api_version,
+            apiVersion="networking.k8s.io/v1/Ingress",
             **webserver_kwargs,  # type: ignore
         )
     )
@@ -80,27 +65,12 @@ def test_ingress(template_function, webserver_field, output, model, api_version)
 # Parametrizing "webserver_field" here tests backcompat. `dagit` was the old field name.
 # This parametrization can be removed in 2.0.
 @pytest.mark.parametrize("readonly_webserver_field", ["readOnlyDagsterWebserver", "readOnlyDagit"])
-@pytest.mark.parametrize(
-    argnames=["output", "model", "api_version"],
-    argvalues=[
-        (
-            "templates/ingress-v1beta1.yaml",
-            models.ExtensionsV1beta1Ingress,
-            "extensions/v1beta1/Ingress",
-        ),
-        (
-            "templates/ingress.yaml",
-            models.V1Ingress,
-            "networking.k8s.io/v1/Ingress",
-        ),
-    ],
-)
-def test_ingress_read_only(template_function, readonly_webserver_field, output, model, api_version):
-    template = template_function(output, model)
+def test_ingress_read_only(template_function, readonly_webserver_field):
+    template = template_function("templates/ingress.yaml", models.V1Ingress)
     helm_values = DagsterHelmValues.construct(
         ingress=Ingress.construct(
             enabled=True,
-            apiVersion=api_version,
+            apiVersion="networking.k8s.io/v1/Ingress",
             dagsterWebserver=WebserverIngressConfiguration.construct(
                 host="foobar.com",
                 path="bing",
@@ -139,23 +109,8 @@ def test_ingress_read_only(template_function, readonly_webserver_field, output,
     assert [rule.host for rule in ingress.spec.rules] == ["foobar.com", "dagster.io"]
 
 
-@pytest.mark.parametrize(
-    argnames=["output", "model", "api_version"],
-    argvalues=[
-        (
-            "templates/ingress-v1beta1.yaml",
-            models.ExtensionsV1beta1Ingress,
-            "extensions/v1beta1/Ingress",
-        ),
-        (
-            "templates/ingress.yaml",
-            models.V1Ingress,
-            "networking.k8s.io/v1/Ingress",
-        ),
-    ],
-)
-def test_ingress_tls(template_function, output, model, api_version):
-    template = template_function(output, model)
+def test_ingress_tls(template_function):
+    template = template_function("templates/ingress.yaml", models.V1Ingress)
     webserver_host = "webserver.com"
     webserver_readonly_host = "webserver-readonly.com"
     flower_host = "flower.com"
@@ -167,7 +122,7 @@ def test_ingress_tls(template_function, output, model, api_version):
     helm_values = DagsterHelmValues.construct(
         ingress=Ingress.construct(
             enabled=True,
-            apiVersion=api_version,
+            apiVersion="networking.k8s.io/v1/Ingress",
             dagsterWebserver=WebserverIngressConfiguration.construct(
                 host=webserver_host,
                 pathType=IngressPathType.IMPLEMENTATION_SPECIFIC,
@@ -209,27 +164,12 @@ def test_ingress_tls(template_function, output, model, api_version):
     assert flower_tls.secret_name == flower_tls_secret_name
 
 
-@pytest.mark.parametrize(
-    argnames=["output", "model", "api_version"],
-    argvalues=[
-        (
-            "templates/ingress-v1beta1.yaml",
-            models.ExtensionsV1beta1Ingress,
-            "extensions/v1beta1/Ingress",
-        ),
-        (
-            "templates/ingress.yaml",
-            models.V1Ingress,
-            "networking.k8s.io/v1/Ingress",
-        ),
-    ],
-)
-def test_ingress_labels(template_function, output, model, api_version):
-    template = template_function(output, model)
+def test_ingress_labels(template_function):
+    template = template_function("templates/ingress.yaml", models.V1Ingress)
     helm_values = DagsterHelmValues.construct(
         ingress=Ingress.construct(
             enabled=True,
-            apiVersion=api_version,
+            apiVersion="networking.k8s.io/v1/Ingress",
             dagsterWebserver=WebserverIngressConfiguration.construct(
                 host="foobar.com",
                 path="bing",

helm/dagster/templates/ingress-v1beta1.yaml

@@ -73,7 +73,6 @@ test = [
     "pendulum>=3.0.0; python_version >= '3.12'",
     "flask-session<0.6.0",
     "connexion<3.0.0",
-    "fastapi<0.118",
     "click",
     "structlog",
 ]

python_modules/libraries/dagster-airlift/pyproject.toml

@@ -32,5 +32,4 @@ dagster-sigma = "dagster_sigma.cli:app"
 [project.optional-dependencies]
 test = [
     "aioresponses",
-    "aiohttp<3.11",
 ]

python_modules/libraries/dagster-sigma/pyproject.toml

@@ -28,6 +28,5 @@ Homepage = "https://github.com/dagster-io/dagster/tree/master/python_modules/lib
 
 [project.optional-dependencies]
 test = [
-    "cryptography==2.6.1",
-    "pytest-sftpserver==1.2.0",
+    "pytest-sftpserver>=1.3.0",
 ]

python_modules/libraries/dagster-ssh/pyproject.toml

@@ -41,5 +41,5 @@ dagstermill = "dagstermill.cli:main"
 test = [
     "matplotlib",
     "scikit-learn>=0.19.0",
-    "tqdm<=4.48",  # https://github.com/tqdm/tqdm/issues/1049
+    "tqdm",
 ]