Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Switch from pipfile to plette lib #7741

Closed
wants to merge 1 commit into from
Closed

Switch from pipfile to plette lib #7741

wants to merge 1 commit into from

Conversation

jeffwidman
Copy link
Member

plette requires python 3.7, so blocked on:

The main user of pipfile is pipenv, and not any of the other
python package managers.

However, pipfile library has been pretty much unmaintained, so
pipenv switched to using plette for parsing/validation of
Pipfile's:

So let's switch our usage as well. Today we only use pipfile for
generating hashes, so this is effectively a silent no-op. However, down
the road we could leverage plette for Pipfile parsing/validation...
for example see how it's flagging things here:
#6104 (comment)

@jeffwidman jeffwidman self-assigned this Aug 5, 2023
@jeffwidman jeffwidman added the Ecosystems Used by the maintainer team for internal-facing project tracking label Aug 5, 2023
@jeffwidman jeffwidman force-pushed the switch-from-pipfile-to-plette-lib branch from 91ce1b7 to 08a9369 Compare August 10, 2023 00:15
@jeffwidman
Copy link
Member Author

@matteius @oz123 What the current state of plette? I see pipenv uses it instead of pipfile, but then I saw a comment by you two saying that plette is also in maintenance/only critical fixes mode. Curious why that is? Is there a different library planned for the future?

@jeffwidman
Switch from pipfile to plette lib
a4a8f75 
The main user of `pipfile` is `pipenv`, and _not_ any of the other
python package managers.

However, `pipfile` library has been pretty much unmaintained, so
`pipenv` switched to using `plette` for parsing/validation of
`Pipfile`'s:
* pypa/pipenv#5310
* pypa/pipenv#5339

So let's switch our usage as well. Today we only use `pipfile` for
generating hashes, so this is effectively a silent no-op. However, down
the road we could leverage `plette` for `Pipfile` parsing/validation...
for example see how it's flagging things here:
#6104 (comment)
@jeffwidman jeffwidman force-pushed the switch-from-pipfile-to-plette-lib branch from 08a9369 to a4a8f75 Compare August 23, 2023 16:04
@oz123
Copy link

oz123 commented Aug 23, 2023

I'm actively working on palette. It's pretty much complete, hence there is not much to do.
Given to much free time , I might replace Cerberus with dataclass validation.

jeffwidman added a commit to jeffwidman/dependabot-core that referenced this pull request Dec 16, 2023
@jeffwidman
Make toml an explicit requirement
5ea130e 
I couldn't figure out why the tests for:
* dependabot#7741

were all failing until I realized that `pipfile` imports `toml`:
https://github.com/pypa/pipfile/blob/4706d2cbd35e0b47a05a6421fa17f93827bc454f/setup.py#L44

which then gets used over in the unrelated file `parser.py`.

So let's make the import of `toml` explicit so that we aren't relying on
it's import as a side-effect of `pipfile`.

The `toml` version that `pipfile` imports isn't pinned, so I just pinned
to the latest release.
jeffwidman added a commit to jeffwidman/dependabot-core that referenced this pull request Dec 16, 2023
@jeffwidman
Make toml an explicit requirement
b5d302b 
I couldn't figure out why the tests for:
* dependabot#7741

were all failing until I realized that `pipfile` imports `toml`:
https://github.com/pypa/pipfile/blob/4706d2cbd35e0b47a05a6421fa17f93827bc454f/setup.py#L44

which then gets used over in the unrelated file `parser.py`.

So let's make the import of `toml` explicit so that we aren't relying on
it's import as a side-effect of `pipfile`.

The `toml` version that `pipfile` imports isn't pinned, so I just pinned
to the latest release.
jeffwidman added a commit to jeffwidman/dependabot-core that referenced this pull request Dec 16, 2023
@jeffwidman
Make toml an explicit requirement
21a646e 
I couldn't figure out why the tests were failing for:
* dependabot#7741

until I realized that `pipfile` imports `toml`:
https://github.com/pypa/pipfile/blob/4706d2cbd35e0b47a05a6421fa17f93827bc454f/setup.py#L44

which then gets used over in the unrelated file `parser.py`.

So let's make the import of `toml` explicit so that we aren't relying on
it's import as a side-effect of `pipfile`.

The `toml` version that `pipfile` imports isn't pinned, so I just pinned
to the latest release.
jeffwidman added a commit to jeffwidman/dependabot-core that referenced this pull request Dec 16, 2023
@jeffwidman
Make toml an explicit requirement
b589071 
I couldn't figure out why the tests were failing for:
* dependabot#7741

until I realized that `pipfile` imports `toml`:
https://github.com/pypa/pipfile/blob/4706d2cbd35e0b47a05a6421fa17f93827bc454f/setup.py#L44

which then gets used over in the unrelated file `parser.py`.

So let's make the import of `toml` explicit so that we aren't relying on
the side effects of importing `pipfile`. The `toml` requirement from
`pipfile` isn't pinned, so I simply pinned to the latest release.
jeffwidman added a commit to jeffwidman/dependabot-core that referenced this pull request Dec 16, 2023
@jeffwidman
Make toml an explicit requirement
005c6e6 
I couldn't figure out why the tests were failing for:
* dependabot#7741

until I realized that `pipfile` imports `toml`:
https://github.com/pypa/pipfile/blob/4706d2cbd35e0b47a05a6421fa17f93827bc454f/setup.py#L44

which then gets used over in the unrelated file `parser.py`:
https://github.com/dependabot/dependabot-core/blob/89ebc55dac8630574301a10917425f80a56e4763/python/helpers/lib/parser.py#L24

So let's make the import of `toml` explicit so that we aren't relying on
the side effects of importing `pipfile`. The `toml` requirement from
`pipfile` isn't pinned, so I simply pinned to the latest release.

Python `3.11` added a native `tomllib` library, so once we drop support
for `3.10` we can drop this 3p lib entirely.
@jeffwidman jeffwidman mentioned this pull request Dec 16, 2023
Merged
jeffwidman added a commit to jeffwidman/dependabot-core that referenced this pull request Dec 16, 2023
@jeffwidman
Make toml an explicit requirement
4abc9e1 
I couldn't figure out why the tests were failing for:
* dependabot#7741

until I realized that `pipfile` imports `toml`:
https://github.com/pypa/pipfile/blob/4706d2cbd35e0b47a05a6421fa17f93827bc454f/setup.py#L44

which then gets used over in the unrelated file `parser.py`:
https://github.com/dependabot/dependabot-core/blob/89ebc55dac8630574301a10917425f80a56e4763/python/helpers/lib/parser.py#L24

So let's make the import of `toml` explicit so that we aren't relying on
the side effects of importing `pipfile`. The `toml` requirement from
`pipfile` isn't pinned, so I simply pinned to the latest release.

Python `3.11` added a native `tomllib` library, so once we drop support
for `3.10` we can drop this 3p lib entirely.
@jeffwidman jeffwidman mentioned this pull request Dec 16, 2023
Merged
@jeffwidman
Copy link
Member Author

Superseded by (since I am not working on the :dependabot: team, I no longer have write access to this repo):

The failing test is solved by:

@jeffwidman jeffwidman closed this Dec 16, 2023
@oz123
Copy link

oz123 commented Dec 16, 2023

Hey Jeff, headsup, I am about to release a new version of plette some when in January 2024. I am just waiting from the review from @matteius. Then new release is a complete rewrite of the core without cerberus.
The new code has the same old API.

@jeffwidman
Copy link
Member Author

Thanks for the heads up, maybe we can have the conversation over in #8627 though since I am no longer on the Dependabot team I had to re-open this PR from my own fork...

But really though, as long as the public API for hash generation doesn't change, then it won't really matter. Can merge this now and then :dependabot: will send a bump PR whenever you release the new version.

jeffwidman added a commit to jeffwidman/dependabot-core that referenced this pull request Dec 18, 2023
@jeffwidman
Make toml an explicit requirement
110d5b4 
I couldn't figure out why the tests were failing for:
* dependabot#7741

until I realized that `pipfile` imports `toml`:
https://github.com/pypa/pipfile/blob/4706d2cbd35e0b47a05a6421fa17f93827bc454f/setup.py#L44

which then gets used over in the unrelated file `parser.py`:
https://github.com/dependabot/dependabot-core/blob/89ebc55dac8630574301a10917425f80a56e4763/python/helpers/lib/parser.py#L24

So let's make the import of `toml` explicit so that we aren't relying on
the side effects of importing `pipfile`. The `toml` requirement from
`pipfile` isn't pinned, so I simply pinned to the latest release.

Python `3.11` added a native `tomllib` library, so once we drop support
for `3.10` we can drop this 3p lib entirely.
jeffwidman added a commit to jeffwidman/dependabot-core that referenced this pull request Jan 23, 2024
@jeffwidman
Make toml an explicit requirement
fb42f12 
I couldn't figure out why the tests were failing for:
* dependabot#7741

until I realized that `pipfile` imports `toml`:
https://github.com/pypa/pipfile/blob/4706d2cbd35e0b47a05a6421fa17f93827bc454f/setup.py#L44

which then gets used over in the unrelated file `parser.py`:
https://github.com/dependabot/dependabot-core/blob/89ebc55dac8630574301a10917425f80a56e4763/python/helpers/lib/parser.py#L24

So let's make the import of `toml` explicit so that we aren't relying on
the side effects of importing `pipfile`. The `toml` requirement from
`pipfile` isn't pinned, so I simply pinned to the latest release.

Python `3.11` added a native `tomllib` library, so once we drop support
for `3.10` we can drop this 3p lib entirely.
jeffwidman added a commit to jeffwidman/dependabot-core that referenced this pull request Jan 23, 2024
@jeffwidman
Make toml an explicit requirement
2d0cb4e 
I couldn't figure out why the tests were failing for:
* dependabot#7741

until I realized that `pipfile` imports `toml`:
https://github.com/pypa/pipfile/blob/4706d2cbd35e0b47a05a6421fa17f93827bc454f/setup.py#L44

which then gets used over in the unrelated file `parser.py`:
https://github.com/dependabot/dependabot-core/blob/89ebc55dac8630574301a10917425f80a56e4763/python/helpers/lib/parser.py#L24

So let's make the import of `toml` explicit so that we aren't relying on
the side effects of importing `pipfile`. The `toml` requirement from
`pipfile` isn't pinned, so I simply pinned to the latest release.

Python `3.11` added a native `tomllib` library, so once we drop support
for `3.10` we can drop this 3p lib entirely.
jeffwidman added a commit to jeffwidman/dependabot-core that referenced this pull request Jan 24, 2024
@jeffwidman
Make toml an explicit requirement
3e40ab1 
I couldn't figure out why the tests were failing for:
* dependabot#7741

until I realized that `pipfile` imports `toml`:
https://github.com/pypa/pipfile/blob/4706d2cbd35e0b47a05a6421fa17f93827bc454f/setup.py#L44

which then gets used over in the unrelated file `parser.py`:
https://github.com/dependabot/dependabot-core/blob/89ebc55dac8630574301a10917425f80a56e4763/python/helpers/lib/parser.py#L24

So let's make the import of `toml` explicit so that we aren't relying on
the side effects of importing `pipfile`. The `toml` requirement from
`pipfile` isn't pinned, so I simply pinned to the latest release.

Python `3.11` added a native `tomllib` library, so once we drop support
for `3.10` we can drop this 3p lib entirely.
jeffwidman added a commit to jeffwidman/dependabot-core that referenced this pull request Mar 11, 2024
@jeffwidman
Make toml an explicit requirement
f04a6b6 
I couldn't figure out why the tests were failing for:
* dependabot#7741

until I realized that `pipfile` imports `toml`:
https://github.com/pypa/pipfile/blob/4706d2cbd35e0b47a05a6421fa17f93827bc454f/setup.py#L44

which then gets used over in the unrelated file `parser.py`:
https://github.com/dependabot/dependabot-core/blob/89ebc55dac8630574301a10917425f80a56e4763/python/helpers/lib/parser.py#L24

So let's make the import of `toml` explicit so that we aren't relying on
the side effects of importing `pipfile`. The `toml` requirement from
`pipfile` isn't pinned, so I simply pinned to the latest release.

Python `3.11` added a native `tomllib` library, so once we drop support
for `3.10` we can drop this 3p lib entirely.
abdulapopoola added a commit that referenced this pull request Mar 14, 2024
@jeffwidman @abdulapopoola
Make toml an explicit requirement (#8626)
4d467a3 
I couldn't figure out why the tests were failing for:
* #7741

until I realized that `pipfile` imports `toml`:
https://github.com/pypa/pipfile/blob/4706d2cbd35e0b47a05a6421fa17f93827bc454f/setup.py#L44

which then gets used over in the unrelated file `parser.py`:
https://github.com/dependabot/dependabot-core/blob/89ebc55dac8630574301a10917425f80a56e4763/python/helpers/lib/parser.py#L24

So let's make the import of `toml` explicit so that we aren't relying on
the side effects of importing `pipfile`. The `toml` requirement from
`pipfile` isn't pinned, so I simply pinned to the latest release.

Python `3.11` added a native `tomllib` library, so once we drop support
for `3.10` we can drop this 3p lib entirely.

Co-authored-by: AbdulFattaah Popoola <abdulapopoola@github.com>
@jeffwidman jeffwidman deleted the switch-from-pipfile-to-plette-lib branch June 27, 2024 22:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@jeffwidman jeffwidman

Labels
Ecosystems Used by the maintainer team for internal-facing project tracking L: python
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@jeffwidman @oz123