Update deps / python to latest supported version - use UV for dep management
- Dominant language
- Python
- Stars
- 85
- Forks
- 19
- Avg merge
- 4d 10h
- Merged PRs (30d)
- 6
Description
Python3.9 is reaching has reached end of life on October 31.
This poses some concerns incase there are any security issues w/ python or any of the deps we use as they will likely not publish any patches, etc.
So a need to update python version and deps exist - which is quite heavy handed change as we make use of libraries that are not all available on pypi.
1. Thus, the dependency management is complicated and involves us indexing wheels directly:
https://github.com/Snapchat/GiGL/blob/a48144bb1e1f677886e290056e0e6e6a988c95bb/python/pyproject.toml#L72-L83
2. Secondly, to be most secure, this involves us maintaining seperate frozen requirements for each host we support:
https://github.com/Snapchat/GiGL/tree/main/requirements
3. Finally, there are some other complications of trying to package and host wheels in corp/private registries: https://go/gigl-issue/1434
**Proposal to make this easier**
Taking these issues into account, we can make our dependencies easier to manage if we adopt `uv` as part of upgrading our deps / python version: https://docs.astral.sh/uv/
Specifically, the way it helps us is:
1. `uv` allows us to more easily maintain custom indexes for packages: https://docs.astral.sh/uv/concepts/indexes/
2. `uv` maintains a lockfile for us that contains information for all hosts / all dependency group resolutions: https://docs.astral.sh/uv/guides/projects/#uvlock
3. The customizability of custom auth paths/certs allows practitioners to more easy package host wheels in corp/private registries: https://docs.astral.sh/uv/concepts/authentication/
Beyond our issues above, `uv` further improves the developer experience by:
1. Installing and managing our python environment for us
2. It replaces our use of multiple other tools: pip, pip-tools, twine, conda, etc.
3. Its support for [workspace](https://docs.astral.sh/uv/concepts/projects/workspaces/) allows us to manage GiGL as part of other larger codebases.
4. Container like sandboxing
Contributor guide
Assessment
This issue has not been assessed yet.