Re: [PATCH 0/X] gnu: poetry: Fix broken dependency after dependency's version update.

[Marius Bakke <marius@gnu.org>]

[-- Attachment #1: Type: text/plain, Size: 1347 bytes --]

Tanguy Le Carrour <tanguy@bioneland.org> writes:

> Hi Guix!
>
> Few days ago, I submitted a patch to update `python-tomlkit`. It was pushed
> to master and, after I upgraded my packages today, I realised that `poetry`
> (and possibly other python packages) was broken!
>
> The "problem" is that Poetry depends on `tomlkit = "^0.5.11"`. This
> translates to `>=0.5.11,<0.6.0`. And I updated `python-tomlkit` to… 0.6.0!
>
> In SemVer [1], minor releases are supposed to "add functionality
> in a backwards compatible manner", so this "<0.6.0" seems, IMHO, wrong.
> But that's not the point…
>
> [1]: https://semver.org/
>
> Now, I have to fix Poetry and I have 2 options:
> - modify poetry `setup.py` and substitute `>=0.5.11,<0.7.0` to `>=0.5.11,<0.6.0`;
> - add a new `python-tomlkit-0.5` and use it in the propagated inputs.
>
> Any suggestion on the one I should implement?

I haven't looked into it, but if the tomlkit API really is compatible,
the first suggestion sounds good to me.  It would be good to notify
upstream about the unreasonable "pinning" in that case.

Otherwise the second suggestion sounds good too.  There is plenty of
precedence for both solutions in Guix and is really something that needs
to be decided on a case-by-case basis.

Thanks for finding and following up on the issue!  :-)

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]