External dependencies

[ReneHezser]

Keeping track on updates for external dependencies is not an easy task (there are 668 external dependencies on the papermerge-core repository). Identifying updates, applying and testing them takes time.

Dependabot is a real time-saver. I've added a config on my fork, and it immediately created 29 pull requests.

I'd be happy to jump in on this topic (for all papermerge repos), if you like to work on it with me. Testing the solution would be best by somebody with experience ;-)

• papermerge-core: Dependency updates papermerge/papermerge-core#716
• path-tmpl: library updates, new version 2.1 papermerge/path-tmpl#1
• path-tmpl-worker: [feat] 0.4.1 papermerge/path-tmpl-worker#7
• s3-worker: Version 0.5.1 - Dependency updates papermerge/s3-worker#21
• auth-server: Version 1.1.4 - Dependency updates papermerge/auth-server#51
• i3-worker: Version 0.3.1b2 - dependency updates papermerge/i3-worker#3
• ocr-worker: Version 0.4 - Dependency updates papermerge/ocr-worker#6
• papermerge-cli [Editi by @ciur: please ignore papermerge-cli. My plan is to rewrite papermerge-cli in golang and make it available as one binary deliverable]

[ciur]

Sure, sounds like a great idea!
If you open an PR in specific repository, please reference me, otherwise i may miss (or not receive at all) the notification about PR.

For FE yarn is primary tool. For BE - poetry

Maybe you start with very small repos first like path-tmpl and once you get a feeling on how to get it done, we can move bigger ones.

[ReneHezser]

@ciur Thanks for merging the PR. If you enable dependabot on the path-tmpl repository, dependabot will weekly check for updates.
https://docs.github.com/en/code-security/getting-started/dependabot-quickstart-guide#enabling-dependabot-for-your-repository

[ReneHezser]

@ciur would you have some kind of architecture diagram, that explains how the different components interact? And could you check if I missed a repo with current componentes (current, in termns of they are used by >3.5).

[ciur]

I will do this. I will publish it as part of docs.

[ciur]

@ReneHezser: https://docs.papermerge.io/3.5/developer-manual/architecture/

[ciur]

@ReneHezser regarding papermerge-cli repository, please ignore it. My plan is to rewrite papermerge-cli in golang so that the cli utility will be just one binary.

[ReneHezser]

@ciur When checking the core repo for compatibility with PostgreSQL 17 (docker-compose in the auth-server repo), I got

Test with PostgreSQL 17: While the code should work, test your specific workload

Consider Driver Updates:

asyncpg version 0.30.x should work, but check for 0.31.x updates
Consider updating psycopg2-binary to the latest version for better PostgreSQL 17 support

If you see reasons to stick with dependency versions, that's fine. Currently asyncpg (>=0.30.0,<0.31.0) is the condition for supported versions.

[ciur]

In general there is no reason to stick with asyncpg (>=0.30.0,<0.31.0). But there may be following problem: I added asyncpg very recently 2-3 days ago, as I switch to async mode in core app. Because it is so recent I did not check/adjust/work on updating neither container, nor auth-server etc yet. I just don't know what to say: probably auth-server should use psycopg2-binary as well and use same version as core app.

[ReneHezser]

@ciur Since I had the changes for the auth-server almost ready, I created the PR. Which repo should go next?

[ciur]

s3 worker: https://github.com/papermerge/s3-worker

[ReneHezser]

@ciur 2 more PRs, which need to be checked :-)

[ciur]

Thanks for your PRs — I’ve merged them. I’m now testing the 3.5.3 release and will also build and test new worker images during this process.

[ReneHezser]

@ciur I just added the last one for the core repo.