Migrate to uv and apply pending Dependabot bumps#55
Merged
Conversation
Drop Python 2 vestiges (`from __future__` imports, `mock` package) and modernize the project's tooling around uv. Replaces poetry.lock with uv.lock, which subsumes all outstanding Dependabot PRs (#46, #48, #49, #51, #53, #54) by resolving to the newest compatible versions: - pytest 8.4.1 -> 9.0.3 - urllib3 2.5.0 -> 2.7.0 - click 7.1.1 -> 8.3.3 (transitive) - colorama 0.4.3 -> 0.4.6 (transitive) - jinja2 already at 3.1.6 - attrs no longer in the tree (came from removed fabric stack) Also: - require Python 3.13 explicitly - rewrite Dockerfile to use uv with the Astral image - relocate workflow into .github/workflows/ (it was misplaced and so was never being executed) and rewrite to use uv + Python 3.13 - remove .travis.yml (Python 2.7/3.7/3.8 era) - drop fabric/fabtools/hammock dev deps and fabfile.py - drop etc/old_fabfile.py (Python 2 syntax) - fix image_to_buffer compress path to work with wand 0.7+ which now requires file.fileno() on save target - point README CI badge at the GitHub Actions workflow
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces Poetry with uv, drops Python 2 vestiges, and subsumes all six open Dependabot PRs by resolving the dep graph from scratch.
Dependabot PRs this closes
uv.lockTooling changes
pyproject.tomlrewritten in PEP 621 form;poetry.lock→uv.lockrequires-python = ">=3.13"Dockerfilerewritten aroundghcr.io/astral-sh/uv:latest.github/workflows/python-app.ymlrewritten to use uv + Python 3.13 — and moved out of.github/and into.github/workflows/where Actions will actually find it (the old file was misplaced and never ran).travis.ymlremoved (Python 2.7/3.7/3.8 era)Python 2 cleanup
from __future__ import absolute_import / division / print_functionfromgiraffe.pyimport mock→from unittest import mockintest_giraffe.py; dropped themockPyPI depfabric/fabtools/hammockdev deps andfabfile.pyetc/old_fabfile.py(Python-2printsyntax)Incidental fix
image_to_buffer(..., compress=True)was broken on wand 0.7+ because wand now callsfile.fileno()on the save target, whichgzip.GzipFilewrappingBytesIOdoesn't support. Fixed by saving to a buffer first, then gzipping the bytes. The compressed path is only exercised by a test today, but the fix keeps the helper honest.Test plan
uv sync --all-groups --frozensucceeds on Python 3.13uv run pytest— 87 passed, 0 faileduv run flake8 . --select=E9,F63,F7,F82 --exclude=.venv,.git,__pycache__cleanGenerated by Claude Code