Skip to content

Conversation

@cognifloyd
Copy link
Member

@cognifloyd cognifloyd commented Jul 29, 2024

Follow-up for #6220 to regenerate lockfiles/st2.lock and pull in the tooz update.
Along with that update, there were a variety of other packages updated, so I updated fixed-requirements.txt (and related files) to track the locked versions.

Here is a summary of the updates:

Lockfile diff: lockfiles/st2.lock [st2]

==                    Upgraded dependencies                     ==

  argcomplete                    3.3.0        -->   3.4.0
  bcrypt                         4.1.2        -->   4.2.0
  certifi                        2024.2.2     -->   2024.7.4
  cryptography                   42.0.5       -->   43.0.0
  exceptiongroup                 1.2.1        -->   1.2.2
  filelock                       3.14.0       -->   3.15.4
  importlib-metadata             7.1.0        -->   8.2.0
  jinja2                         3.1.3        -->   3.1.4
  jsonpointer                    2.4          -->   3.0.0
  netaddr                        1.2.1        -->   1.3.0
  orjson                         3.10.1       -->   3.10.6
  oslo-config                    9.4.0        -->   9.5.0
  oslo-utils                     7.1.0        -->   7.2.0
  packaging                      24.0         -->   24.1
  pip                            24.0         -->   24.2
  platformdirs                   4.2.1        -->   4.2.2
  prettytable                    3.10.0       -->   3.10.2
  prompt-toolkit                 3.0.43       -->   3.0.47
  psutil                         5.9.8        -->   6.0.0
  pygments                       2.17.2       -->   2.18.0
  pyspnego                       0.10.2       -->   0.11.1
  pytest                         8.2.0        -->   8.3.2
  pywinrm                        0.4.3        -->   0.5.0
  redis                          5.0.4        -->   5.0.7
  requests                       2.31.0       -->   2.32.3
  requests-ntlm                  1.2.0        -->   1.3.0
  setuptools                     69.5.1       -->   72.1.0
  tenacity                       8.2.3        -->   9.0.0
  tooz                           6.1.0        -->   6.2.0
  typing-extensions              4.11.0       -->   4.12.2
  ujson                          5.9.0        -->   5.10.0
  urllib3                        2.2.1        -->   2.2.2
  virtualenv                     20.26.1      -->   20.26.3
  zipp                           3.18.1       -->   3.19.2
  zstandard                      0.22.0       -->   0.23.0

I reviewed the changelogs for all packages that had a major version bump, and we're not using the features that changed behavior.

Additional Changes

  1. I also realized that we can remove lockfiles/setuptools.lock because it only has 2 deps in it (setuptools, wheel), both of which are explicitly required in lockfiles/st2.lock. So, I configured pants to use the st2 lockfile whenever it needs to do something like build wheels with setuptools.
  2. I just found out about a pants feature that allows us to reduce duplication of the python interpreter constraints in pants.toml. Hopefully that will make it easier to grok where changes are required when we bump those constraints.
  3. One of the virtualenv tests started failing, but I could not figure out which package triggered it. When I removed my virtualenv, and went back to master, the error message reverts to the old message for some time, and then consistently provides the new error message. So, I've experienced this same error on master without any of these upgrades. However, this is a minor error message that is only checked in a test, so I just updated the test to accept the new message as well.

Lockfile diff: lockfiles/st2.lock [st2]

==                    Upgraded dependencies                     ==

  argcomplete                    3.3.0        -->   3.4.0
  bcrypt                         4.1.2        -->   4.2.0
  certifi                        2024.2.2     -->   2024.7.4
  cryptography                   42.0.5       -->   43.0.0
  exceptiongroup                 1.2.1        -->   1.2.2
  filelock                       3.14.0       -->   3.15.4
  importlib-metadata             7.1.0        -->   8.2.0
  jinja2                         3.1.3        -->   3.1.4
  jsonpointer                    2.4          -->   3.0.0
  netaddr                        1.2.1        -->   1.3.0
  orjson                         3.10.1       -->   3.10.6
  oslo-config                    9.4.0        -->   9.5.0
  oslo-utils                     7.1.0        -->   7.2.0
  packaging                      24.0         -->   24.1
  pip                            24.0         -->   24.2
  platformdirs                   4.2.1        -->   4.2.2
  prettytable                    3.10.0       -->   3.10.2
  prompt-toolkit                 3.0.43       -->   3.0.47
  psutil                         5.9.8        -->   6.0.0
  pygments                       2.17.2       -->   2.18.0
  pyspnego                       0.10.2       -->   0.11.1
  pytest                         8.2.0        -->   8.3.2
  pywinrm                        0.4.3        -->   0.5.0
  redis                          5.0.4        -->   5.0.7
  requests                       2.31.0       -->   2.32.3
  requests-ntlm                  1.2.0        -->   1.3.0
  setuptools                     69.5.1       -->   72.1.0
  tenacity                       8.2.3        -->   9.0.0
  tooz                           6.1.0        -->   6.2.0
  typing-extensions              4.11.0       -->   4.12.2
  ujson                          5.9.0        -->   5.10.0
  urllib3                        2.2.1        -->   2.2.2
  virtualenv                     20.26.1      -->   20.26.3
  zipp                           3.18.1       -->   3.19.2
  zstandard                      0.22.0       -->   0.23.0
pants can reuse our main st2 resolve when it needs to run setuptools to,
for example, build wheels. By doing that, we do not need to track dependency
updates separately for setuptools+wheel.
@pull-request-size pull-request-size bot added the size/XXL PR that changes 1000+ lines. You should absolutely split your PR into several. label Jul 29, 2024
I get these errors on master too, but inconsistently.
So the recent updates do not seem to be the cause, though
they make the symptom worse (it consistently fails
instead of working sometimes).
@cognifloyd cognifloyd requested a review from a team July 29, 2024 23:04
Copy link
Contributor

@jk464 jk464 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link
Contributor

@bishopbm1 bishopbm1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@cognifloyd cognifloyd merged commit ca12f16 into master Jul 31, 2024
@cognifloyd cognifloyd deleted the regen-lockfile branch July 31, 2024 12:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

external dependency infrastructure: ci/cd pantsbuild size/XXL PR that changes 1000+ lines. You should absolutely split your PR into several.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants