Snapchat / Snapchat/GiGL

Update deps / python to latest supported version - use UV for dep management

Open
#405 2 comments 0 reactions 1 assignee Claimed by @svij-sc View on GitHub
Dominant language
Python
Stars
85
Forks
19
Avg merge
4d 10h
Merged PRs (30d)
6

Description

Python3.9 is reaching has reached end of life on October 31.
This poses some concerns incase there are any security issues w/ python or any of the deps we use as they will likely not publish any patches, etc.
So a need to update python version and deps exist - which is quite heavy handed change as we make use of libraries that are not all available on pypi.

1. Thus, the dependency management is complicated and involves us indexing wheels directly:
https://github.com/Snapchat/GiGL/blob/a48144bb1e1f677886e290056e0e6e6a988c95bb/python/pyproject.toml#L72-L83

2. Secondly, to be most secure, this involves us maintaining seperate frozen requirements for each host we support:
https://github.com/Snapchat/GiGL/tree/main/requirements

3. Finally, there are some other complications of trying to package and host wheels in corp/private registries: https://go/gigl-issue/1434

**Proposal to make this easier**
Taking these issues into account, we can make our dependencies easier to manage if we adopt `uv` as part of upgrading our deps / python version: https://docs.astral.sh/uv/

Specifically, the way it helps us is:
1. `uv` allows us to more easily maintain custom indexes for packages: https://docs.astral.sh/uv/concepts/indexes/
2. `uv` maintains a lockfile for us that contains information for all hosts / all dependency group resolutions: https://docs.astral.sh/uv/guides/projects/#uvlock
3. The customizability of custom auth paths/certs allows practitioners to more easy package host wheels in corp/private registries: https://docs.astral.sh/uv/concepts/authentication/

Beyond our issues above, `uv` further improves the developer experience by:
1. Installing and managing our python environment for us
2. It replaces our use of multiple other tools: pip, pip-tools, twine, conda, etc.
3. Its support for [workspace](https://docs.astral.sh/uv/concepts/projects/workspaces/) allows us to manage GiGL as part of other larger codebases.
4. Container like sandboxing

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.