Additionally, all these dependencies run on the server, making them riskier as they have direct access to customer data if they turn out to be malicious.
Any new dependency needs to be thoroughly reviewed and approved by owners-python-build. This group is already automatically tagged in your PR to
getsentry as soon as you edit relevant files. For other repos you might need to do it manually.
To add or update a dependency:
- Clone https://github.com/getsentry/pypi/.
cdinto your clone and run
python3 -m add_pkg PKGNAME(or
python3 -m add_pkg PKGNAME==PKGVERSIONif you want a version other than the latest).
- Commit the resulting changes to a branch, open a PR in
getsentry/pypi, and tag someone on your team (any engineer can approve PRs on this repo).
- Once your PR is merged, go back to the main repo whose dependencies you want to change (
- In that repo, add to or update
requirements-dev.txt, as appropriate. Note that many of our dependencies are pinned with lower bounds only, to encourage updating to latest versions, though we do use exact pins for certain core dependencies like
django. Choose whichever one feels most appropriate in your case.
make freeze-requirements. You might need to wait a few minutes for the changes to
getsentry/pypito be deployed before this will work without erroring.
- Commit your changes (which should consist of changes to both one of the
requirementsfiles and its corresponding lockfile) to a branch and open a PR in the relevant repo. If it's not obvious, explain why you're adding or updating the dependency. Tag
owners-python-buildif they haven't already been auto-tagged.
- Merge your PR, pull
master, and run
If you need to make modifications to a dependency and need to deploy the result before it is accepted upstream, you can fork the dependency.
Depending on forks is generally discouraged unless necessary, and you should make sure that the changes in your fork are not required for self-hosted to function, because they won't be included in the PyPI distribution of Sentry.
- Fork into the
- Depend on the fork using
library-name @ https://github.com/getsentry/<repo>/archive/<40 char sha>.zipin
- The requirement in
sentrystays the same, because we upload
sentryto PyPI, and PyPI does not allow us to depend on URLs.
If you have questions about dependencies, ask owners-python-build or in #discuss-dev-infra.