Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Drop support for Python 3.6 #6299

Closed
jeffwidman opened this issue Dec 9, 2022 · 11 comments · Fixed by #7610
Closed

Drop support for Python 3.6 #6299

jeffwidman opened this issue Dec 9, 2022 · 11 comments · Fixed by #7610
Assignees
@jeffwidman
Labels
Ecosystems Used by the maintainer team for internal-facing project tracking T: tech-debt ⚙️

Comments

@jeffwidman
Copy link
Member

jeffwidman commented Dec 9, 2022 •
edited
Loading

Python 3.6 was EOL'd in Dec 2021. However, we've continued to support it because the Ubuntu LTS 18.04 release installed it by default and 18.04 isn't EOL until April 2023:

dependabot-core/python/lib/dependabot/python/python_versions.rb

Lines 18 to 19 in cf448a9

3.6.15 3.6.14 3.6.13 3.6.12 3.6.11 3.6.10 3.6.9 3.6.8 3.6.7 3.6.6 3.6.5 3.6.4 3.6.3
3.6.2 3.6.1 3.6.0 3.5.10 3.5.8 3.5.7 3.5.6 3.5.5 3.5.4 3.5.3

But we're starting to run into various issues where 3.6 is forcing us to include hacky workarounds:

So this is a placeholder ticket to track any discussions around timing, things that we'll need to update/remove, etc.

If you're a user of Dependabot who is still on Python 3.6 and you cannot upgrade for some reason, please chime in here explaining your use case.
@jeffwidman jeffwidman pinned this issue Dec 9, 2022
@jeffwidman jeffwidman added L: python:pip Python packages via pip L: python:poetry Python packages via poetry python Dependabot pull requests that update Python code L: python:pipenv Python packages via pipenv labels Dec 9, 2022
@jeffwidman jeffwidman mentioned this issue Jan 19, 2023
Closed
@jeffwidman
Copy link
Member Author

jeffwidman commented Jan 19, 2023 •
edited
Loading

Before we commit to a timeline on this, we'd like to measure how frequently users are running Dependabot against python 3.6 repos.

However, the new "pause for inactivity" feature is still gradually rolling out... and that will impact these metrics pretty drastically because abandoned repos that are still running Dependabot are the most likely to have never moved beyond 3.6.

We expect that rollout to finish in the next few weeks, after which our metrics will only include "active" users of Dependabot so we can gather accurate metrics and then work with some other internal stakeholders to decide on the actual date we'll drop support.

@jeffwidman jeffwidman mentioned this issue Mar 6, 2023
Closed
@edgarrmondragon
Copy link

Are there any updates on this? I think this is blocking support for Poetry 1.4.x

@grski
Copy link

grski commented Apr 6, 2023

This is a necessary change for #6758 AFAIK, or updating Poetry to 1.4.x
ANy update here or how can one help to make it move faster?

@jeffwidman
Copy link
Member Author

Thanks for letting us know you want it, we've been a little hesitant to drop it because we know some users are probably still on 3.6 and we haven't yet had time to pull metrics to see how many users will get left behind when we drop it... so knowing we've got users that are blocked on us upgrading is good to know as a counterpoint.

What we're actually planning to do very soon is try to formalize some deprecation policies for our different ecosystems. That way we not only fix this immediate problem, but also have clear timelines for everyone to see of when we will be deprecating and/or completely dropping support for old versions so there's no surprises for anyone. This is a priority for us this quarter.

Anyway, hope to have you unblocked soonish.

@MDziwny
Copy link

MDziwny commented Apr 26, 2023

While not dropping the python 3.6 is a nice intent, it's a bit problematic because it requires to pin some package managers versions (pip, pipenv, pip-tools, ...) in dependabot and the latest python versions are not well supported by dependabot (eg: on few of my projects, dependabot fails to upgrade a bunch of packages with extras requirements)

Anyway, if it's unblocked soon, we can wait 👍

@phillipuniverse
Copy link
Contributor

phillipuniverse commented Jun 3, 2023 •
edited
Loading

@jeffwidman where are we on those metrics?

Poetry 1.5.1 is out and 1.5.0 has new options for different sources that are not backwards-compatible with Poetry 1.3.x. Plus the lock file can change (the header) when a developer might add a new dependency locally with Poetry 1.5 and Dependabot uses 1.3 - they just keep flip-flopping back and forth. There also isn't a great way I know of to lint contributions to ensure local Poetry usage is the same as Dependabot.

@MDziwny
Copy link

MDziwny commented Jul 18, 2023

@jeffwidman , any news on this topic ? Can we help somehow ?

@jeffwidman
Copy link
Member Author

You'll be happy to know I've got some time booked the next few weeks to work on this... we'll need to post a note on our blog with a deprecation date, so actually merging it may take a little longer. But expect to see PR's from me arriving in the next few weeks to make this happen.

jeffwidman added a commit that referenced this issue Jul 22, 2023
@jeffwidman
Drop python 3.6
1bf25a8 
This is the result of my initial investigation spike to see how much
work it'll be to drop `python` `3.6` which has been EOL'd for a while.

So far it looks like dropping `3.6` will be technically straightforward.
The time-consuming bits will be:
1. finish the metrics version collection
2. coordinate on the messaging front with a deprecation announcement on
   the GitHub changelog.
3. All the follow-on work that dropping `3.6` unlocks... ie, bumping to nwere versions of `pip-tools`, `pip`, `poetry` etc. However, those can all happen as follow-on projects.

Python 3.7 is also EOL'd as of the end of June, and I noticed
`pip-tools` has already released `v7` which requires `3.8+`. We are
considerign aligning our python version support schedule with upstream
python, in which case we'd also drop `3.7`, which would let us also jump
all our package managers up to their latest versions. But again, all
that is out of scope of this initial project of dropping `3.6`.

So putting this up to see what CI thinks.

Fix: #6299
@jeffwidman jeffwidman mentioned this issue Jul 22, 2023
Merged
jeffwidman added a commit that referenced this issue Jul 22, 2023
@jeffwidman
Drop python 3.6
2f77ca5 
This is the result of my initial investigation spike to see how much
work it'll be to drop `python` `3.6` which has been EOL'd for a while.

So far it looks like dropping `3.6` will be technically straightforward.
The time-consuming bits will be:
1. finish the metrics version collection
2. coordinate on the messaging front with a deprecation announcement on
   the GitHub changelog.
3. All the follow-on work that dropping `3.6` unlocks... ie, bumping to nwere versions of `pip-tools`, `pip`, `poetry` etc. However, those can all happen as follow-on projects.

Python 3.7 is also EOL'd as of the end of June, and I noticed
`pip-tools` has already released `v7` which requires `3.8+`. We are
considerign aligning our python version support schedule with upstream
python, in which case we'd also drop `3.7`, which would let us also jump
all our package managers up to their latest versions. But again, all
that is out of scope of this initial project of dropping `3.6`.

So putting this up to see what CI thinks.

Fix: #6299
jeffwidman added a commit that referenced this issue Jul 22, 2023
@jeffwidman
Drop python 3.6
b255351 
This is the result of my initial investigation spike to see how much
work it'll be to drop `python` `3.6` which has been EOL'd for a while.

So far it looks like dropping `3.6` will be technically straightforward.
The time-consuming bits will be:
1. finish the metrics version collection
2. coordinate on the messaging front with a deprecation announcement on
   the GitHub changelog.
3. All the follow-on work that dropping `3.6` unlocks... ie, bumping to nwere versions of `pip-tools`, `pip`, `poetry` etc. However, those can all happen as follow-on projects.

Python 3.7 is also EOL'd as of the end of June, and I noticed
`pip-tools` has already released `v7` which requires `3.8+`. We are
considerign aligning our python version support schedule with upstream
python, in which case we'd also drop `3.7`, which would let us also jump
all our package managers up to their latest versions. But again, all
that is out of scope of this initial project of dropping `3.6`.

So putting this up to see what CI thinks.

Fix: #6299
jeffwidman added a commit that referenced this issue Jul 22, 2023
@jeffwidman
Drop python 3.6
d40fa98 
This is the result of my initial investigation spike to see how much
work it'll be to drop `python` `3.6` which has been EOL'd for a while.

So far it looks like dropping `3.6` will be technically straightforward.
The time-consuming bits will be:
1. finish the metrics version collection
2. coordinate on the messaging front with a deprecation announcement on
   the GitHub changelog.
3. All the follow-on work that dropping `3.6` unlocks... ie, bumping to nwere versions of `pip-tools`, `pip`, `poetry` etc. However, those can all happen as follow-on projects.

Python 3.7 is also EOL'd as of the end of June, and I noticed
`pip-tools` has already released `v7` which requires `3.8+`. We are
considerign aligning our python version support schedule with upstream
python, in which case we'd also drop `3.7`, which would let us also jump
all our package managers up to their latest versions. But again, all
that is out of scope of this initial project of dropping `3.6`.

So putting this up to see what CI thinks.

Fix: #6299
jeffwidman added a commit that referenced this issue Jul 25, 2023
@jeffwidman
Drop python 3.6
bbbb044 
This is the result of my initial investigation spike to see how much
work it'll be to drop `python` `3.6` which has been EOL'd for a while.

So far it looks like dropping `3.6` will be technically straightforward.
The time-consuming bits will be:
1. finish the metrics version collection
2. coordinate on the messaging front with a deprecation announcement on
   the GitHub changelog.
3. All the follow-on work that dropping `3.6` unlocks... ie, bumping to nwere versions of `pip-tools`, `pip`, `poetry` etc. However, those can all happen as follow-on projects.

Python 3.7 is also EOL'd as of the end of June, and I noticed
`pip-tools` has already released `v7` which requires `3.8+`. We are
considerign aligning our python version support schedule with upstream
python, in which case we'd also drop `3.7`, which would let us also jump
all our package managers up to their latest versions. But again, all
that is out of scope of this initial project of dropping `3.6`.

So putting this up to see what CI thinks.

Fix: #6299
@jeffwidman jeffwidman mentioned this issue Jul 31, 2023
Closed
@jeffwidman
Copy link
Member Author

We are currently planning to drop support for 3.6 later this month, we'll post an official announcement on the GitHub changelog when we do, but you'll also see it here because once that goes out I'll start merging PR's to remove support for it and then close this issue.

We will also be dropping 3.7 soon after as it's also now EOL:

@jeffwidman jeffwidman added Ecosystems Used by the maintainer team for internal-facing project tracking and removed L: python:pip Python packages via pip L: python:poetry Python packages via poetry python Dependabot pull requests that update Python code L: python:pipenv Python packages via pipenv labels Jul 31, 2023
@jeffwidman jeffwidman unpinned this issue Aug 1, 2023
@jeffwidman
Copy link
Member Author

Deprecation date is August 17th: https://github.blog/changelog/2023-08-02-deprecation-notice-dependabot-to-drop-support-for-python-3-6-and-3-7/

This was referenced Aug 2, 2023
Closed
Closed
Merged
@jeffwidman jeffwidman self-assigned this Aug 3, 2023
@jeffwidman jeffwidman mentioned this issue Aug 5, 2023
Closed
@grski
Copy link

grski commented Aug 17, 2023

Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jeffwidman jeffwidman

Labels
Ecosystems Used by the maintainer team for internal-facing project tracking T: tech-debt ⚙️
Projects
Dependabot
Archived in project
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Drop python 3.6 dependabot/dependabot-core
5 participants
@jeffwidman @phillipuniverse @MDziwny @edgarrmondragon @grski