Skip to content

Do not pin dependencies to specific versions #202

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Silviu Tantos (razius) wants to merge 2 commits into from
Closed

Do not pin dependencies to specific versions #202

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
79e6887
Do not pin dependencies to specific versions
razius Aug 5, 2018
8e522bf
Default version of setuptools on Travis is old
razius Aug 5, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .travis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,8 @@ python:
- '3.4'
- '3.5'
install:
# ensure we have recent pip/setuptools
- pip install --upgrade pip setuptools
- pip install -r requirements-test.txt
- pip install release-manager
- pip install -e .
Expand Down
12 changes: 6 additions & 6 deletions setup.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,12 +75,12 @@
],

install_requires=[
"greenlet==0.4.10",
"requests==2.2.1",
"greenlet>=0.4.10",
"requests>=2.2.1",

@asoltysik Andrzej Sołtysik (asoltysik) Aug 6, 2018

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it would better to put upper bounds to be safe, but feel free to ignore this suggestion. For example Requests uses semver: http://docs.python-requests.org/en/master/dev/philosophy/#semantic-versioning

There is also ~= operator if you prefer it: https://www.python.org/dev/peps/pep-0440/#compatible-release

@razius Silviu Tantos (razius) Aug 6, 2018

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using the ~= will still downgrade if the minor version doesn't match so I'm not sure but an upper bound sounds like a very good idea.

What should the upper bound be? I can bump on our end to latest, try it out and put that as the upper bound.

@asoltysik Andrzej Sołtysik (asoltysik) Aug 6, 2018 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For requests I think it's safe to put < 3.0.0 as they are using SemVer - for others I guess it depends what versioning scheme they are using?

@chuwy Anton Parkhomenko (chuwy) Aug 8, 2018

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm also all for adding upper bounds. Of course we need to update the tracker more often, but last time unbounded dependencies caused a lot of pain as we simply didn't know what deps were used last time.

@alexanderdean Alexander Dean (alexanderdean) Aug 8, 2018

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1 for upper bounds

@mhadam Michael Hadam (mhadam) Sep 22, 2018

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Silviu Tantos (@razius) If we can get upper bounds on all these, this should be ready for merging.

@razius Silviu Tantos (razius) Sep 22, 2018

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Michael Hadam (@mhadam) , I'll try to find some time this weekend.

"pycontracts==1.7.6",
"celery==3.1.11",
"gevent==1.0.2",
"redis==2.9.1",
"six==1.9.0"
"celery>=3.1.11,<3.1.25",
"gevent>=1.0.2",
"redis>=2.9.1",
"six>=1.9.0"
],
)