Mailing-List: contact dev-help@ariatosca.incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@ariatosca.incubator.apache.org
Date: Thu, 23 Mar 2017 10:02:41 +0000 (UTC)
From: "Ran Ziv (JIRA)" <jira@apache.org>
To: dev@ariatosca.incubator.apache.org
Message-ID: <JIRA.13039790.1486030983000.99674.1490263361879@Atlassian.JIRA>
In-Reply-To: <JIRA.13039790.1486030983000@Atlassian.JIRA>
References: <JIRA.13039790.1486030983000@Atlassian.JIRA> <JIRA.13039790.1486030983721@jira-lw-us.apache.org>
Subject: [jira] [Closed] (ARIA-96) Dependency versions strictness /
 conflicts
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Thu, 23 Mar 2017 10:02:46 -0000


     [ https://issues.apache.org/jira/browse/ARIA-96?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Ran Ziv closed ARIA-96.
-----------------------

> Dependency versions strictness / conflicts
> ------------------------------------------
>
>                 Key: ARIA-96
>                 URL: https://issues.apache.org/jira/browse/ARIA-96
>             Project: AriaTosca
>          Issue Type: Task
>            Reporter: Ran Ziv
>            Assignee: Avia Efrat
>             Fix For: 0.1.0
>
>
> When ARIA is used by another project, it might lead to dependency versions conflicts.
> Dependency versions should be made less strict (i.e. ranges).
> Alternatively we could consider vendoring some of the more common dependencies inside ARIA.
> --------------------------------------------------------------------------------------------------------------------------
> Our conclusions:
> 1. Currently, don't vendor any library.
> 2. Use pip-tools (specifically, pip-compile) to manage our dependencies / requirement files.
> 3. requirements.in:
> The requirements.in will be read into `install_requires`, and includes loose dependencies (as possible, and only direct dependencies), as is common when installing using a setup.py file.
> Since we haven't tested ARIA with many versions of our dependencies, our dependencies are not very loose, but we are hoping to improve this as our project matures.
> Currently, when we provide an upper bound, it is either because of python 2.6 compatibility, or according to a semantic versioning (i.e. future versions that could break the current API). Lower boundaries are usually the lowest version that we tested with ARIA, or because version before are lacking functionality we are using.
> 4. requirements.txt:
> The requirements.txt is generated from requirements.in via pip-compile, and includes fixed-version dependencies, including all transitive dependencies, in order to provide an stable environment that ARIA is ensured to work on.
> 5. python 2.6 compatible dependencies:
> As pip-compile currently does not provide support for conditional dependencies (https://github.com/jazzband/pip-tools/issues/435), we are adding these dependencies explicitly in the setup.py via `extras_require`, and manually in the generated requirements.txt. We are also mentioning this issue in a comment in requirements.in.


--
This message was sent by Atlassian JIRA
(v6.3.15#6346)