The 0.12.12 release changes the interface for dependent projects in a patch release; can it be made 0.13 instead?

[adamnovak]

There's a bug in the schema-salad project now, which depends on:

    "CacheControl >= 0.11.7, < 0.13",
    "lockfile >= 0.9",  # needed for CacheControl's FileCache

https://github.com/common-workflow-language/schema_salad/blob/774157d065e5ce6bf7669877a25cf2087117cb58/setup.py#L91-L92

Until 0.12.12, if you wanted to use FileCache, you were admonished to go install lockfile as a peer dependency by the resulting error message. The Right Way to use FileCache seems to have always been to depend on CacheControl[filecache], but there's at least this one project that didn't do that, an probably more out there. People seem to have assumed that the fact that FileCache needs lockfile specifically was part of its public interface as of the 0.12 release series.

With 0.12.12, that interface has changed in a patch release, and dependent projects that assumed that that wouldn't happen are now broken.

Do you want to yank 0.12.12 and renumber it 0.13, since it makes a breaking change to what people took to be the public interface of FileCache? Or should people who asked for lockfile directly and not the extra just have to reap the wages of not reading the docs right?

For what it's worth, the docs currently still say lockfile is the required module, though they do suggest using the extra:

FileCache

The FileCache is similar to the caching mechanism provided by httplib2. It requires lockfile be installed as it prevents multiple threads from writing to the same file at the same time.

Note

Note that you can install this dependency automatically with pip by requesting the filecache extra:

pip install cachecontrol[filecache]

So I'd say it was documented as though the user could rely on that module being the one that was needed.

[ionrock]

Thanks for letting me know. I yanked the release and will re-release as 0.13.

[dimbleby]

@ionrock any chance we can get that 0.13 release?

it was with great delight that I saw 0.12.12 arrive, imagine my disappointment when it was yanked...

[maresb]

@ionrock, I just spent a good chunk of time trying to figure out why pip wasn't installing the latest released version of cachecontrol before noticing that it was yanked on PyPI. Any chance to release 0.13 soon? Thanks!

[maresb]

Bump. This is causing headaches in: conda-forge/conda-lock-feedstock#40 (comment)

[stefanor]

There doesn't seem to be any git tag for 0.13