-
Notifications
You must be signed in to change notification settings - Fork 980
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
run pip-compile on all of our requirements files #11912
Merged
Merged
Changes from all commits
Commits
Show all changes
7 commits
Select commit
Hold shift + click to select a range
bb9c134
run pip-compile on all of our requirements files
dstufft 728b3ac
reconile protobuf versions
dstufft e47a293
reconile docutils
dstufft 9384953
autoescape is now built into Jinja
dstufft 67cf38c
jinja2.ext.with_ is also a built in now
dstufft 06c2b5b
restore previous pin of webauthn
dstufft dffd2e4
Run pip-check after installing dependencies
dstufft File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,5 +1,5 @@ | ||
[python: **.py] | ||
[jinja2: **.html] | ||
encoding = utf-8 | ||
extensions=jinja2.ext.autoescape,jinja2.ext.with_,warehouse.utils.html:ClientSideIncludeExtension | ||
extensions=warehouse.utils.html:ClientSideIncludeExtension | ||
silent=False |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is this downgrade intentional?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, ish.
We're currently actually installing a "broken" (as far as dependency constraints are concerned) environment because of
--no-deps
(I think). I was actually going to ask you about this, but figured I'd get the rest of the updates working first.So we're using
google-cloud-bigquery<3.0.0
, which I see you pinned due to googleapis/python-bigquery#1196.That pin causes us to install
google-cloud-bigquery==2.34.4
, which 2.34.4 requires protobuf<4.Obviously, it seems to work fine in practice, but I don't think we want to be installing "broken" sets of dependencies like that, and I think the reasons why we were capable of doing that to begin with is:
--no-deps
inDockerfile
means pip won't check the version constraints.make deps
doesn't check that the pins match, just that all of the names in the old and new ones match.So, this brings us back to a "clean" set of dependencies. If we want a newer version of protobuf, we'll need to unpin google-cloud-bigquery, which I'm not sure I understand why it was pinned to start with. It looks like just because it introduced a (needless) dependency on pyarrow and numpy, but I can't tell if that was actually causing problems or if it was just conceptually we felt we didn't want those deps drug in.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The
--no-deps
flag was added in #10463 as a workaround for pypa/pip#9644 which still seems to be a bug, unfortunately.Huh, I was under the impression that it was re-compiling our
.in
files to determine upgrades, but I agree that that doesn't appear to be the case.Yes, this is exactly why.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think Renovate might support that, and maybe dependabot does too I'm not sure.
Though we have a more foundational issue that even
pip-compile
isn't really right here, because we need all of our requirements files to be resolvable together. Right nowpip-compile
ondeploy.in
gives youprotobuf==4.*
while onmain.in
gives youprotobuf=3.*
, which even with--no-deps
pip will error because you can't install both.So blindly upgrading the
.txt
files is ~fine as long as we ensure that our dependency set is resolvable, which prior to #10463 was done by just having pip install it, but I just pushed a new commit to this PR that addspip check
after we install which will restore checking for resolvability.I think the edge cases caused by pinning might be sufficiently annoying that skipping the extra dependencies isn't worth the pin? The issue is open with Google so if/when they fix it we should drop those dependencies ourselves, but I'm not sure that we're really gaining much by installing them.
What do you think?