Skip to content

Conversation

florianvazelle
Copy link
Collaborator

@florianvazelle florianvazelle commented Sep 15, 2025

Description

Several CVEs in dependencies are reported by Dependabot. I get the impression that the current workflow does not allow Dependabot to bump dependencies correctly.

A good practice would be to pin dependencies, at least to have reproducible CI.
I therefore propose switching to a tool such as Poetry or UV, that this also improve dependencies management.

But first we need to migrate setup files to pyproject.toml.

Commands

For build, the command:

python setup.py sdist bdist_wheel

was moved to

pip install build
pyproject-build

For test, the command:

python setup.py test

was moved to

pip install .[tests]
python test_opensearchpy/run_tests.py

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@florianvazelle florianvazelle marked this pull request as draft September 15, 2025 07:15
@florianvazelle florianvazelle changed the title chore: migrate setup files to a pyproject.toml chore: migrate setup.py to a pyproject.toml Sep 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant