Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Target Python 3.9/3.10 & Update Dependencies #490

Open
MRichards99 opened this issue Oct 7, 2024 · 0 comments
Open

Target Python 3.9/3.10 & Update Dependencies #490

MRichards99 opened this issue Oct 7, 2024 · 0 comments
Labels
dependencies Pull requests that update a dependency file

Comments

@MRichards99
Copy link
Collaborator

Description:
This repo currently supports Python 3.6, but this support should be dropped for a higher minimum version. Python 3.9 is the default version on the Rocky DataGateway machines. As per https://endoflife.date/python, security support for 3.9 ends October 2025. If Python 3.10 is easily installable for the production machines, I'd recommend targeting that version as it would buy an extra year of security support (which ends October 2026).

Once 3.6-3.8 support is dropped, the dependencies can be updated. Update to the latest possible dependencies - you may have to re-specify the version constraints in pyproject.toml as some dependencies will have released new major versions, which a poetry update won't catch. The safety check in noxfile.py has a large amount of vulnerabilities that it is ignoring because we haven't been able to upgrade dependencies due to Python 3.6 support. We shouldn't be ignoring any vulnerabilities, except for possibly the werkzeug one if a fix hasn't been found (it was a controversial vulnerability).

@MRichards99 MRichards99 added the dependencies Pull requests that update a dependency file label Oct 7, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

No branches or pull requests

1 participant