Predictika · Dependency pins for coding agents
An AI coding agent proposes the package versions to pin for a Python project. Before it edits the requirements and writes the lock file, it sends the pins to Predictika, which checks them against a declarative model of Python-version support, yanked releases, security advisories, license policy and version requirements between packages, then returns a verdict and every reason.
This validator models the pins a coding agent proposes for a Python project: up to five package releases at a time, chosen from the catalog of releases it knows, together with the project's Python version (3.7 to 3.13) and whether the project is proprietary or open source.
Any pin set drawn from the catalog and these rules is in scope, not only the scenarios pictured here. Not covered: packages and releases outside the catalog, resolving a full dependency tree, scanning real vulnerability databases, or choosing versions for the agent. The version requirements follow the packages' published requirements; the advisory severities in the catalog are illustrative simplifications, not a security assessment of the real releases.
7 scenarios in 3 groups · each group runs from the agent’s first attempt to the outcome · click one to switch
Illustrative agent statement. The validator receives the structured request below.
Proposing agent: AI coding agent (scripted)
Before sending, the agent must call Recorded run
What this means
Our assessment of what a typical Python installer or dependency resolver does with the same cases. It is a judgment about effort and reliability, not a claim that nothing can be built. This page produces no price or quote, so only the policy checks are compared.
| What the validator caught | Typical installer or resolver | Predictika |
|---|---|---|
| License policy for a proprietary project: block GPL and AGPL, send LGPL to legal | Only with workarounds An installer does not apply a company license policy. It takes a separate license-scanning step and its own policy rules. | The license of every pin is checked against the project type in the same call as everything else. |
| A tiered advisory policy: block high severity, ask security to sign off on moderate | Only with workarounds Advisory scanners report findings; turning them into block versus sign-off decisions before the lock file is written is extra tooling. | The severity tier decides block or needs approval, and the approval is recorded before the write is accepted. |
| Every problem returned in one answer before anything is written | Only with care A resolver usually reports the first conflict it cannot satisfy; a license or advisory policy is checked elsewhere, so an agent meets the problems one step at a time. | All findings come back together, whatever order the pins arrived in. |
Every rule is checked on every call, in any order the choices arrive; one problem never hides another. Blocking findings stop the action; approval findings need a person to sign off; everything else is computed.
| 1 | The release does not support the project's Python version (for example, numpy 2.1 needs Python 3.10 or newer). |
| 2 | The release was yanked from the index. |
| 3 | The release has a high-severity advisory. |
| 4 | A GPL or AGPL package in a proprietary project. |
| 5 | Another pinned package falls outside the version range this release requires (for example, pandas 2.1 needs numpy below 2). |
| 6 | The same package is pinned twice. |
| 7 | The release has a moderate advisory: needs security sign-off or an upgrade. |
| 8 | An LGPL package in a proprietary project: needs legal sign-off. |
The recorded result of the validator for each scenario on this page: the request the AI agent sent, the verdict, and every finding, in the order they appear above.
The agent's request. Please pin pandas 2.1.4 and numpy 2.1.3 for the Python 3.12 project (license: proprietary) and write the lock file.
Verdict: Blocked.
The agent's request. Please pin pandas 2.2.3 and numpy 2.1.3 for the Python 3.12 project (license: proprietary) and write the lock file.
Verdict: Allowed.
The agent's request. Please pin requests 2.31.0 and urllib3 2.2.3 for the Python 3.11 project (license: proprietary) and write the lock file.
Verdict: Needs approval.
The agent's request. Please pin requests 2.32.3 and urllib3 2.2.3 for the Python 3.11 project (license: proprietary) and write the lock file.
Verdict: Allowed.
The agent's request. Please pin numpy 2.1.3, pandas 2.1.4, PyQt5 5.15.11, requests 2.32.3 and urllib3 2.2.3 for the Python 3.9 project (license: proprietary) and write the lock file.
Verdict: Blocked.
The agent's request. Please pin numpy 1.26.4, pandas 2.1.4, PyQt5 5.15.11, requests 2.32.3 and urllib3 2.2.3 for the Python 3.9 project (license: proprietary) and write the lock file.
Verdict: Blocked.
The agent's request. Please pin numpy 1.26.4, pandas 2.1.4, requests 2.32.3 and urllib3 2.2.3 for the Python 3.9 project (license: proprietary) and write the lock file.
Verdict: Allowed.
The text of the narrated walkthrough, step by step.