Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Dependabot PRs add setuptools as package dependency #5868

Closed
1 task done
l0b0 opened this issue Oct 11, 2022 · 3 comments
Closed
1 task done

Dependabot PRs add setuptools as package dependency #5868

l0b0 opened this issue Oct 11, 2022 · 3 comments
Labels
L: python:poetry Python packages via poetry T: bug 🐞 Something isn't working

Comments

@l0b0
Copy link
Contributor

l0b0 commented Oct 11, 2022 •
edited
Loading

Is there an existing issue for this?

  • I have searched the existing issues

Package ecosystem

pip

Package manager version

Unknown (whatever Poetry version GitHub Dependabot is using)

Language version

Python 3.9

Manifest location and content before the Dependabot update

Gist

dependabot.yml content

Gist

Updated dependency

Gist

What you expected to see, versus what you actually saw

None of the package dependencies should include the setuptools package. This is a bug in older versions of Poetry, which cause issues when trying to install packages. In particular, the stricter poetry2nix runs into an infinite loop (upstream issue) when trying to deal with a lock file containing setuptools.

Native package manager behavior

More recent versions of Poetry do not include setuptools when running poetry lock. For a few weeks or months now I've been working around this behaviour by manually removing any reference to setuptools from poetry.lock in Dependabot PRs.

Images of the diff or a link to the PR, issue, or logs

PR

Smallest manifest that reproduces the issue

No response
@l0b0 l0b0 added the T: bug 🐞 Something isn't working label Oct 11, 2022
l0b0 added a commit to linz/geostore that referenced this issue Oct 11, 2022
@l0b0
fix: Remove mention of setuptools
e746d19 
This is due to a bug in poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.
l0b0 added a commit to linz/geostore that referenced this issue Oct 11, 2022
@l0b0
fix: Remove mention of setuptools
0dc2193 
This is due to a bug in poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.
l0b0 added a commit to linz/geostore that referenced this issue Oct 11, 2022
@l0b0
fix: Remove mention of setuptools
15dbd75 
This is due to a bug in Poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.
l0b0 added a commit to linz/geostore that referenced this issue Oct 11, 2022
@l0b0
fix: Remove mention of setuptools
0f2dd3c 
This is due to a bug in Poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.
l0b0 added a commit to linz/geostore that referenced this issue Oct 11, 2022
@l0b0
fix: Remove mention of setuptools
b0e2b6d 
This is due to a bug in Poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.
l0b0 pushed a commit to linz/geostore that referenced this issue Oct 11, 2022
@dependabot @l0b0
build(deps): bump aws-cdk-lib from 2.41.0 to 2.45.0
3916ed2 
Bumps [aws-cdk-lib](https://github.com/aws/aws-cdk) from 2.41.0 to 2.45.0.
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.md)
- [Commits](aws/aws-cdk@v2.41.0...v2.45.0)

---
updated-dependencies:
- dependency-name: aws-cdk-lib
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Also removes mention of setuptools. This is due to a bug in Poetry,
which causes an infinite loop in nix-shell
<dependabot/dependabot-core#5868>.

Signed-off-by: dependabot[bot] <support@github.com>
l0b0 added a commit to linz/geostore that referenced this issue Oct 11, 2022
@l0b0
fix: Remove mention of setuptools
62ef05c 
This is due to a bug in Poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.
l0b0 added a commit to linz/geostore that referenced this issue Oct 11, 2022
@l0b0
fix: Remove mention of setuptools
e0b1520 
This is due to a bug in Poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.
l0b0 added a commit to linz/geostore that referenced this issue Oct 11, 2022
@l0b0
fix: Remove mention of setuptools
5068c86 
This is due to a bug in poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.
l0b0 added a commit to linz/geostore that referenced this issue Oct 11, 2022
@l0b0
fix: Remove mention of setuptools
771b26c 
This is due to a bug in Poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.
kodiakhq bot pushed a commit to linz/geostore that referenced this issue Oct 11, 2022
@dependabot @l0b0
build(deps-dev): Bump types-requests from 2.28.9 to 2.28.11.2 (#2132)
a5cacf1 
* build(deps-dev): Bump types-requests from 2.28.9 to 2.28.11.2

Bumps [types-requests](https://github.com/python/typeshed) from 2.28.9 to 2.28.11.2.
- [Release notes](https://github.com/python/typeshed/releases)
- [Commits](https://github.com/python/typeshed/commits)

---
updated-dependencies:
- dependency-name: types-requests
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix: Remove mention of setuptools

This is due to a bug in Poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Victor Engmark <vengmark@linz.govt.nz>
@jeffwidman jeffwidman added the L: python:poetry Python packages via poetry label Oct 11, 2022
@jeffwidman
Copy link
Member

Hmm, we recently upgraded poetry so we're running latest release: #5746

What makes you think this is due to an older version of poetry?

Have you tried running the update locally using the dry-run script documented on the readme? Add a few puts statements and you can probably start to narrow down the source of the issue.

@l0b0
Copy link
Contributor Author

l0b0 commented Oct 12, 2022

What makes you think this is due to an older version of poetry?

After a bit more investigation, it turns out I had this the wrong way around - the newer versions of Poetry are the ones causing issues because setuptools is no longer excluded from the lock file. I get a workable lock file with current poetry2nix using Poetry 1.1.14. The fix is actually arriving in poetry2nix, which is now able to deal with this change. Sorry for the noise.

@l0b0 l0b0 closed this as completed Oct 12, 2022
kodiakhq bot added a commit to linz/geostore that referenced this issue Oct 12, 2022
@dependabot @kodiakhq
build(deps): bump aws-cdk-lib from 2.41.0 to 2.45.0 (#2135)
af7373a 
Bumps [aws-cdk-lib](https://github.com/aws/aws-cdk) from 2.41.0 to 2.45.0.
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.md)
- [Commits](aws/aws-cdk@v2.41.0...v2.45.0)

---
updated-dependencies:
- dependency-name: aws-cdk-lib
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Also removes mention of setuptools. This is due to a bug in Poetry,
which causes an infinite loop in nix-shell
<dependabot/dependabot-core#5868>.

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
kodiakhq bot added a commit to linz/geostore that referenced this issue Oct 12, 2022
@dependabot @l0b0 @kodiakhq
build(deps): Bump aws-cdk-aws-batch-alpha from 2.24.0a0 to 2.41.0a0 (#…
a9937e7 
…2012)

* build(deps): Bump aws-cdk-aws-batch-alpha from 2.24.0a0 to 2.41.0a0

Bumps [aws-cdk-aws-batch-alpha](https://github.com/aws/aws-cdk) from 2.24.0a0 to 2.41.0a0.
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.md)
- [Commits](https://github.com/aws/aws-cdk/commits)

---
updated-dependencies:
- dependency-name: aws-cdk-aws-batch-alpha
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix: Remove mention of setuptools

This is due to a bug in poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Victor Engmark <vengmark@linz.govt.nz>
Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
@jeffwidman
Copy link
Member

No problem thanks for letting us know

kodiakhq bot added a commit to linz/geostore that referenced this issue Oct 12, 2022
@dependabot @l0b0 @kodiakhq
build(deps): bump linz-logger from 0.8.0 to 0.9.0 (#1920)
4cd154b 
* build(deps): bump linz-logger from 0.8.0 to 0.9.0

Bumps [linz-logger](https://github.com/linz/python-linz-logger) from 0.8.0 to 0.9.0.
- [Release notes](https://github.com/linz/python-linz-logger/releases)
- [Commits](https://github.com/linz/python-linz-logger/commits)

---
updated-dependencies:
- dependency-name: linz-logger
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix: Remove mention of setuptools

This is due to a bug in Poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Victor Engmark <vengmark@linz.govt.nz>
Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
kodiakhq bot added a commit to linz/geostore that referenced this issue Oct 12, 2022
@dependabot @l0b0 @kodiakhq
build(deps): bump smart-open from 6.1.0 to 6.2.0 (#2024)
6204979 
* build(deps): bump smart-open from 6.1.0 to 6.2.0

Bumps [smart-open](https://github.com/piskvorky/smart_open) from 6.1.0 to 6.2.0.
- [Release notes](https://github.com/piskvorky/smart_open/releases)
- [Changelog](https://github.com/RaRe-Technologies/smart_open/blob/develop/CHANGELOG.md)
- [Commits](piskvorky/smart_open@v6.1.0...v6.2.0)

---
updated-dependencies:
- dependency-name: smart-open
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix: Remove mention of setuptools

This is due to a bug in Poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Victor Engmark <vengmark@linz.govt.nz>
Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
kodiakhq bot added a commit to linz/geostore that referenced this issue Oct 12, 2022
@dependabot @l0b0 @kodiakhq
build(deps-dev): bump boto3-stubs from 1.24.88 to 1.24.89 (#2123)
645dd68 
* build(deps-dev): bump boto3-stubs from 1.24.88 to 1.24.89

Bumps [boto3-stubs](https://github.com/youtype/mypy_boto3_builder) from 1.24.88 to 1.24.89.
- [Release notes](https://github.com/youtype/mypy_boto3_builder/releases)
- [Commits](https://github.com/youtype/mypy_boto3_builder/commits)

---
updated-dependencies:
- dependency-name: boto3-stubs
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix: Remove mention of setuptools

This is due to a bug in Poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Victor Engmark <vengmark@linz.govt.nz>
Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
l0b0 added a commit to linz/geostore that referenced this issue Oct 12, 2022
@l0b0
fix: Remove mention of setuptools
71b4160 
This is due to a bug in poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.
l0b0 added a commit to linz/geostore that referenced this issue Oct 12, 2022
@l0b0
fix: Remove mention of setuptools
b8f654c 
This is due to a bug in poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.
l0b0 added a commit to linz/geostore that referenced this issue Oct 12, 2022
@l0b0
fix: Remove mention of setuptools
8cd974a 
This is due to a bug in poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.
kodiakhq bot pushed a commit to linz/geostore that referenced this issue Oct 12, 2022
@dependabot @l0b0
build(deps): bump aws-cdk-aws-lambda-python-alpha from 2.41.0a0 to 2.…
7c55dc2 
…45.0a0 (#2138)

* build(deps): bump aws-cdk-aws-lambda-python-alpha

Bumps [aws-cdk-aws-lambda-python-alpha](https://github.com/aws/aws-cdk) from 2.41.0a0 to 2.45.0a0.
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.md)
- [Commits](https://github.com/aws/aws-cdk/commits)

---
updated-dependencies:
- dependency-name: aws-cdk-aws-lambda-python-alpha
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix: Remove mention of setuptools

This is due to a bug in poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Victor Engmark <vengmark@linz.govt.nz>
kodiakhq bot added a commit to linz/geostore that referenced this issue Oct 12, 2022
@dependabot @l0b0 @kodiakhq
build(deps): bump aws-cdk-aws-batch-alpha from 2.41.0a0 to 2.45.0a0 (#…
4b2c6c6 
…2139)

* build(deps): bump aws-cdk-aws-batch-alpha from 2.41.0a0 to 2.45.0a0

Bumps [aws-cdk-aws-batch-alpha](https://github.com/aws/aws-cdk) from 2.41.0a0 to 2.45.0a0.
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.md)
- [Commits](https://github.com/aws/aws-cdk/commits)

---
updated-dependencies:
- dependency-name: aws-cdk-aws-batch-alpha
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix: Remove mention of setuptools

This is due to a bug in poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Victor Engmark <vengmark@linz.govt.nz>
Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
l0b0 added a commit to linz/geostore that referenced this issue Oct 17, 2022
@l0b0
fix: Remove mention of setuptools
13001c2 
This is due to a bug in poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.
kodiakhq bot added a commit to linz/geostore that referenced this issue Oct 17, 2022
@dependabot @l0b0 @kodiakhq
build(deps): bump jsonschema from 4.5.1 to 4.16.0 (#2009)
bf4829a 
* build(deps): bump jsonschema from 4.5.1 to 4.16.0

Bumps [jsonschema](https://github.com/python-jsonschema/jsonschema) from 4.5.1 to 4.16.0.
- [Release notes](https://github.com/python-jsonschema/jsonschema/releases)
- [Changelog](https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst)
- [Commits](python-jsonschema/jsonschema@v4.5.1...v4.16.0)

---
updated-dependencies:
- dependency-name: jsonschema
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix: Remove mention of setuptools

This is due to a bug in poetry, which causes an infinite loop in
nix-shell <dependabot/dependabot-core#5868>.

* fix: Remove reference to unused package

* fix: Add build requirement for jsonschema

Can be removed once we update poetry2nix sufficiently.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Victor Engmark <vengmark@linz.govt.nz>
Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
L: python:poetry Python packages via poetry T: bug 🐞 Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@l0b0 @jeffwidman