Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

uv pip compile does not annotate direct dependencies e.g. via -r requirements.in #1343

Closed
ThiefMaster opened this issue Feb 15, 2024 · 9 comments · Fixed by #3269
Closed
Labels
compatibility Compatibility with a specification or another tool

Comments

@ThiefMaster
Copy link

I found this kind pretty useful to immediately see which entries in requirements.txt come from direct dependencies, and to also see which ones are both direct and transitive ones.

To reproduce:

diff --git a/requirements.txt b/requirements.txt
index e376581100..b2eae90d3f 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,40 +1,26 @@
-#
-# This file is autogenerated by pip-compile with Python 3.9
-# by the following command:
-#
-#    pip-compile --strip-extras
-#
+# This file was autogenerated by uv v0.1.0 via the following command:
+#    uv pip compile requirements.in -o requirements.txt
 alembic==1.12.1
-    # via
-    #   -r requirements.in
-    #   flask-migrate
+    # via flask-migrate
 amqp==5.2.0
     # via kombu
 asttokens==2.4.1
     # via
     #   sentry-sdk
     #   stack-data
-async-timeout==4.0.3
-    # via redis
 attrs==23.1.0
     # via
     #   jsonschema
     #   referencing
 authlib==1.2.1
-    # via -r requirements.in
 babel==2.13.1
-    # via
-    #   -r requirements.in
-    #   flask-babel
+    # via flask-babel
 bcrypt==4.0.1
-    # via -r requirements.in
 billiard==4.2.0
     # via celery
 bleach==6.1.0
-    # via -r requirements.in
[...]
@ThiefMaster
Copy link
Author

Especially while this tool is new it also makes it MUCH harder to compare output from pip-tools and uv, since there's lots of noise in the diff from this.

@ThiefMaster
Copy link
Author

Not removing it would also allow for something similar to ruff's ecosystem checks. Not sure if such checks exist atm (I found some issues related to them but no actual code)...

@jzmiller1
Copy link

The lack of the -r requirements.in in the output has been a blocker on using uv to replace pip-compile in some projects I work on. Glad to see this already on the radar.

@zanieb zanieb changed the title uv pip compile removes via -r requirements.in uv pip compile does not annotate direct dependencies e.g. via -r requirements.in Mar 4, 2024
@Djailla
Copy link

Djailla commented Mar 25, 2024

Hello @charliermarsh do you have an update on this issue ?

Thanks a lot !

@palfrey
Copy link
Contributor

palfrey commented Apr 21, 2024

FYI, I'm (slowly) having a bit of of a poke at this one. @charliermarsh I'm assuming you'd be interested in PRs for this one right?

@charliermarsh
Copy link
Member

Yeah happily. Let me know if you run into issues or have questions.

@palfrey
Copy link
Contributor

palfrey commented Apr 25, 2024

@charliermarsh (and anyone else interested): #3269 is a first draft at this. It has the major redeeming feature that it works (i.e. does the requested item here), but there's a stack of unresolved questions in the PR that need figuring out.

Also, it's needed some fairly chunky changes overall, and there's probably at least some stylistic changes that are wanted (although I tried to keep to the same style as the surrounding code)!

charliermarsh pushed a commit that referenced this issue May 9, 2024
## Summary

Fixes #1343. This is kinda a first
draft at the moment, but does at least mostly work locally (barring some
bits of the test suite that seem to not work for me in general).

## Test Plan

Mostly running the existing tests and checking the revised output is
sane

## Outstanding issues

Most of these come down to "AFAIK, the existing tools don't support
these patterns, but `uv` does" and so I'm not sure there's an existing
good answer here! Most of the answers so far are "whatever was easiest
to build"

- [x] ~~Is "-r pyproject.toml" correct? Should it show something else or
get skipped entirely~~ No it wasn't. Fixed in
3044fa8
- [ ] If the requirements file is stdin, that just gets skipped. Should
it be recorded?
- [ ] Overrides get shown as "--override<override.txt>". Correct?
- [x] ~~Some of the tests (e.g.
`dependency_excludes_non_contiguous_range_of_compatible_versions`) make
assumptions about the order of package versions being outputted, which
this PR breaks. I'm not sure if the text is fairly arbitrary and can be
replaced or whether the behaviour needs fixing?~~ - fixed by removing
the custom pubgrub PartialEq/Hash
- [ ] Are all the `TrackedFromStr` et al changes needed, or is there an
easier way? I don't think so, I think it's necessary to track these sort
of things fairly comprehensively to make this feature work, and this
sort of invasive change feels necessary, but happy to be proved wrong
there :)
- [x] ~~If you have a requirement coming in from two or more different
requirements files only one turns up. I've got a closed-source example
for this (can go into more detail if needed), mostly consisting of a
complicated set of common deps creating a larger set. It's a rarer case,
but worth considering.~~ 042432b
- [ ] Doesn't add annotations for `setup.py` yet
- This is pretty hard, as the correct location to insert the path is
`crates/pypi-types/src/metadata.rs`'s `parse_pkg_info`, which as it's
based off a source distribution has entirely thrown away such matters as
"where did this package requirement get built from". Could add "`built
package name`" as a dep, but that's a little odd.
@charliermarsh
Copy link
Member

Will be supported in the next version thanks to @palfrey.

@matmair
Copy link

matmair commented May 9, 2024

Thank you @palfrey - this will make dependabot updates so much less annoying

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
compatibility Compatibility with a specification or another tool
Projects
None yet
Development

Successfully merging a pull request may close this issue.

6 participants