ariatosca-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Avia Efrat (JIRA)" <j...@apache.org>
Subject [jira] [Updated] (ARIA-96) Dependency versions strictness / conflicts
Date Wed, 15 Mar 2017 15:23:47 GMT

     [ https://issues.apache.org/jira/browse/ARIA-96?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Avia Efrat updated ARIA-96:
---------------------------
    Description: 
When ARIA is used by another project, it might lead to dependency versions conflicts.
Dependency versions should be made less strict (i.e. ranges).
Alternatively we could consider vendoring some of the more common dependencies inside ARIA.
--------------------------------------------------------------------------------------------------------------------------
Our conclusions:

1. Currently, don't vendor any library.

2. Use pip-tools (specifically, pip-compile) to manage our dependencies / requirement files.

3. requirements.in:
The requirements.in will be read into `install_requires`, and includes loose dependencies
(as possible, and only direct dependencies), as is common when installing using a setup.py
file.
Since we haven't tested ARIA with many versions of our dependencies, our dependencies are
not very loose, but we are hoping to improve this as our project matures.
Currently, when we provide an upper bound, it is either because of python 2.6 compatibility,
or according to a semantic versioning (i.e. future versions that could break the current API).
Lower boundaries are usually the lowest version that we tested with ARIA, or because version
before are lacking functionality we are using.

4. requirements.txt:
The requirements.txt is generated from requirements.in via pip-compile, and includes fixed-version
dependencies, including all transitive dependencies, in order to provide an stable environment
that ARIA is ensured to work on.

5. python 2.6 compatible dependencies:
As pip-compile currently does not provide support for conditional dependencies (https://github.com/jazzband/pip-tools/issues/435),
we are adding these dependencies explicitly in the setup.py via `extras_require`, and manually
in the generated requirements.txt. We are also mentioning this issue in a comment in requirements.in.

  was:
When ARIA is used by another project, it might lead to dependency versions conflicts.
Dependency versions should be made less strict (i.e. ranges).
Alternatively we could consider vendoring some of the more common dependencies inside ARIA.


> Dependency versions strictness / conflicts
> ------------------------------------------
>
>                 Key: ARIA-96
>                 URL: https://issues.apache.org/jira/browse/ARIA-96
>             Project: AriaTosca
>          Issue Type: Task
>            Reporter: Ran Ziv
>            Assignee: Avia Efrat
>
> When ARIA is used by another project, it might lead to dependency versions conflicts.
> Dependency versions should be made less strict (i.e. ranges).
> Alternatively we could consider vendoring some of the more common dependencies inside
ARIA.
> --------------------------------------------------------------------------------------------------------------------------
> Our conclusions:
> 1. Currently, don't vendor any library.
> 2. Use pip-tools (specifically, pip-compile) to manage our dependencies / requirement
files.
> 3. requirements.in:
> The requirements.in will be read into `install_requires`, and includes loose dependencies
(as possible, and only direct dependencies), as is common when installing using a setup.py
file.
> Since we haven't tested ARIA with many versions of our dependencies, our dependencies
are not very loose, but we are hoping to improve this as our project matures.
> Currently, when we provide an upper bound, it is either because of python 2.6 compatibility,
or according to a semantic versioning (i.e. future versions that could break the current API).
Lower boundaries are usually the lowest version that we tested with ARIA, or because version
before are lacking functionality we are using.
> 4. requirements.txt:
> The requirements.txt is generated from requirements.in via pip-compile, and includes
fixed-version dependencies, including all transitive dependencies, in order to provide an
stable environment that ARIA is ensured to work on.
> 5. python 2.6 compatible dependencies:
> As pip-compile currently does not provide support for conditional dependencies (https://github.com/jazzband/pip-tools/issues/435),
we are adding these dependencies explicitly in the setup.py via `extras_require`, and manually
in the generated requirements.txt. We are also mentioning this issue in a comment in requirements.in.



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)

Mime
View raw message