Dependencies

[sepandhaghighi]

Reference Issues/PRs

What does this implement/fix? Explain your changes.

• Dependencies structure modified

Any other comments?

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[AHReccese]

Hi Sepand @sepandhaghighi, thank you for your efforts.

Plz help me understand the changes better. So previously Dependabot was detecting dev-req & req files and was pushing versions for both == and >= to go higher, which broke our python older versions support.

To address this issue, I see you've done below:

rename dev-req to req-dev and exclude it
remove req.txt and directly put reqs.txt content in install_requires in setup.py and exclude setup.py from dependabot

Some questions here:

• Why did we rename dev req? we could directly exclude it?
• why we're hardcoding req into setup.py? we could exclude this one too in the dependabot config?
• I see you've also dropped distutils (which I understand has been completely removed from python 3.12), but since we're still covering old Python versions, why not have it there for legacy cases?
• I see req-latest is not used anywhere; what's the purpose of having it? If Dependabot updates it, then our test pipeline doesn't care, and no matter what, it installs the latest available in each env, so it doesn't honor that. Also, if its content is to specify the latest version of packages, this is something that depends on the Python version, so what does it mean?

[sepandhaghighi]

Hi Sepand @sepandhaghighi, thank you for your efforts.

Plz help me understand the changes better. So previously Dependabot was detecting dev-req & req files and was pushing versions for both == and >= to go higher, which broke our python older versions support.

To address this issue, I see you've done below:

rename dev-req to req-dev and exclude it remove req.txt and directly put reqs.txt content in install_requires in setup.py and exclude setup.py from dependabot

Some questions here:

• Why did we rename dev req? we could directly exclude it?
• why we're hardcoding req into setup.py? we could exclude this one too in the dependabot config?
• I see you've also dropped distutils (which I understand has been completely removed from python 3.12), but since we're still covering old Python versions, why not have it there for legacy cases?
• I see req-latest is not used anywhere; what's the purpose of having it? If Dependabot updates it, then our test pipeline doesn't care, and no matter what, it installs the latest available in each env, so it doesn't honor that. Also, if its content is to specify the latest version of packages, this is something that depends on the Python version, so what does it mean?

1. Just for consistency.
2. To decouple package dependencies from repository dependencies.
3. As python setup.py install is completely deprecated, using distutils has no meaning.
4. The only purpose of requirements-latest is for Dependabot, when Dependabot updates this file, it triggers the CI process, and PyPI installs the most recent version of dependencies compatible with the specific version of Python (We do not consider that the most recent version of each dependency can be installed across all supported versions of Python, it's not within our scope of responsibility)