Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Removing unused dependency, adding optional dependencies and loosening requests version#104

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Open
sg3-141-592 wants to merge1 commit intomaxmind:main
base:main
Choose a base branch
Loading
fromsg3-141-592:master

Conversation

@sg3-141-592
Copy link

@sg3-141-592sg3-141-592 commentedNov 8, 2020
edited
Loading

Linked to Issue#101. I noticed when installing the library that the dependency tree is quite deep. I have to install to a non-internet connected environment so I have to download all of the .whls manually which highlighted the issue.

image

I saw some opportunities for making the installation a bit leaner.

  • Have removed unused dependencyurllib3.

  • Have madeaiohttp andrequests optional installs. User gets an error message when trying to import the libraries withoutrequests oraiohttp installed

>>> import geoip2.webserviceTraceback (most recent call last):  File"<stdin>", line 1,in<module>  File"/home/sean/GeoIP2-python/geoip2/webservice.py", line 49,in<module>    raise ImportError("""To enable geoip2ImportError: To enable geoip2.webservice, install aiohttp or requests support.        pip install geoip2[aiohttp]        pip install geoip2[requests]        pip install geoip2[all]

Some figures on the size of the install for different configurations

geoip2 - 0.3MBgeoip2[aiohttp] - 12.4MBgeoip2[requests] - 2.3MBgeoip2[all] - 14.4MB

This would be a big change to how this library is installed so this would need some maintainer feedback on this level of change.

  • Also I noticed a very specific version ofrequests has been picked>=2.24.0 which is from June 2020 onwards. I'm not sure this package needs such a specific version looking the history of therequests package (https://github.com/psf/requests/blob/master/HISTORY.md). And it'll require the majority of people who use it who are already usingrequests to need to uninstall their existing version and install 2.24.0.

    Since the minimum supported version of Python for this library is Python 3.6, and the earliest version ofrequests that supports Python 3.6 is2.14.0 I've suggested updating this dependency torequests>=2.14.0,<3.0.0. I've tested withrequests 2.14.0 and all tests are passing with identical results.

diarmuidclarke, fhightower, menecio, sebix, brondsem, and akx reacted with thumbs up emoji
…ement and making aiohttp and requests optional installs
@oschwald
Copy link
Member

Although the extra dependencies do make some sense, this would likely be a breaking change for many existing web service users. I don't know if this is easily resolvable with Setuptools. Perhaps at some point, it would make sense to break this up into several packages but it would be nice to that in such a way that doesn't increase maintenance burden.

I believeurllib3 is an indirect dependency and was added as a direct dependency to ensure that our users were not subject to a security issue with earlier versions. Similarly, therequests version specified in this PR has at least one significant security vulnerability. It has been our preference to require a recent version of these deps to make sure users who only depend on the libraries indirectly get security updates and fixes for other issues.

Base automatically changed frommaster tomainJanuary 20, 2021 18:27
Copy link

@sebixsebix left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Also possible without checkingsys.modules.

importaiohttp
importaiohttp.http
exceptImportError:
pass

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
pass
aiohttp=None


importipaddress
importjson
importsys

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
import sys

importrequests
importrequests.utils
exceptImportError:
pass

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
pass
requests=None

)
# If neither requests or aiohttp is installed then inform user how to
# install them
if"aiohttp"notinsys.modulesand"requests"notinsys.modules:

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
if"aiohttp"notinsys.modulesand"requests"notinsys.modules:
ifnotrequestsandnotaiohttp:

)


if"aiohttp"insys.modules:

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
if"aiohttp"insys.modules:
ifaiohttp:

f"GeoIP2-Python-Client/{geoip2.__version__}{aiohttp.http.SERVER_SOFTWARE}"
)

if"requests"insys.modules:

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
if"requests"insys.modules:
ifrequests:

@sebix
Copy link

Although the extra dependencies do make some sense, this would likely be a breaking change for many existing web service users. I don't know if this is easily resolvable with Setuptools. Perhaps at some point, it would make sense to break this up into several packages but it would be nice to that in such a way that doesn't increase maintenance burden.

The extras-feature of setuptools is already a very easy way to "split" the requirements.

I believeurllib3 is an indirect dependency and was added as a direct dependency to ensure that our users were not subject to a security issue with earlier versions.

requests even comes with a built-in version of urllib3, so that won't be effective.

Similarly, therequests version specified in this PR has at least one significant security vulnerability. It has been our preference to require a recent version of these deps to make sure users who only depend on the libraries indirectly get security updates and fixes for other issues.

Although distributions ship "older" versions of requests, they patch the security issues in the library. Requiring very current versions, causes an upgrade of requests during the installation of geoip2, possible causing compatibility issues. Could you insteadrecommend a higher version (e.g. using an optionalrequirements.txt) but not strictly requiring (insetup.py/cfg) it?

@akx
Copy link

akx commentedAug 27, 2024
edited
Loading

This would be lovely to merge.

I was considering bumpinggeoip2 in a downstream project, but it would have added 3 new deps (aiohappyeyeballs==2.4.0,aiohttp==3.10.5,aiosignal==1.3.1) I don't need whatsoever.

EDIT: See#177 for a modernized version of this PR for the current packaging.

akx added a commit to akx/GeoIP2-python that referenced this pull requestAug 27, 2024
akx added a commit to akx/GeoIP2-python that referenced this pull requestAug 27, 2024
akx added a commit to akx/GeoIP2-python that referenced this pull requestFeb 10, 2025
akx added a commit to akx/GeoIP2-python that referenced this pull requestFeb 10, 2025
akx added a commit to akx/GeoIP2-python that referenced this pull requestAug 20, 2025
akx added a commit to akx/GeoIP2-python that referenced this pull requestAug 20, 2025
akx added a commit to akx/GeoIP2-python that referenced this pull requestAug 20, 2025
akx added a commit to akx/GeoIP2-python that referenced this pull requestSep 4, 2025
akx added a commit to akx/GeoIP2-python that referenced this pull requestSep 29, 2025
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

1 more reviewer

@sebixsebixsebix left review comments

Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@sg3-141-592@oschwald@sebix@akx

[8]ページ先頭

©2009-2025 Movatter.jp