uv icon indicating copy to clipboard operation
uv copied to clipboard

`uv pip compile` does not annotate direct dependencies e.g. `via -r requirements.in`

Open ThiefMaster opened this issue 1 year ago • 7 comments
trafficstars

I found this kind pretty useful to immediately see which entries in requirements.txt come from direct dependencies, and to also see which ones are both direct and transitive ones.

To reproduce:

  • Clone https://github.com/indico/indico/ (or get the requirements* files)
  • Run uv pip compile requirements.in -o requirements.txt
  • See the (partial) diff below:
diff --git a/requirements.txt b/requirements.txt
index e376581100..b2eae90d3f 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,40 +1,26 @@
-#
-# This file is autogenerated by pip-compile with Python 3.9
-# by the following command:
-#
-#    pip-compile --strip-extras
-#
+# This file was autogenerated by uv v0.1.0 via the following command:
+#    uv pip compile requirements.in -o requirements.txt
 alembic==1.12.1
-    # via
-    #   -r requirements.in
-    #   flask-migrate
+    # via flask-migrate
 amqp==5.2.0
     # via kombu
 asttokens==2.4.1
     # via
     #   sentry-sdk
     #   stack-data
-async-timeout==4.0.3
-    # via redis
 attrs==23.1.0
     # via
     #   jsonschema
     #   referencing
 authlib==1.2.1
-    # via -r requirements.in
 babel==2.13.1
-    # via
-    #   -r requirements.in
-    #   flask-babel
+    # via flask-babel
 bcrypt==4.0.1
-    # via -r requirements.in
 billiard==4.2.0
     # via celery
 bleach==6.1.0
-    # via -r requirements.in
[...]

ThiefMaster avatar Feb 15 '24 21:02 ThiefMaster

Especially while this tool is new it also makes it MUCH harder to compare output from pip-tools and uv, since there's lots of noise in the diff from this.

ThiefMaster avatar Feb 15 '24 21:02 ThiefMaster

Not removing it would also allow for something similar to ruff's ecosystem checks. Not sure if such checks exist atm (I found some issues related to them but no actual code)...

ThiefMaster avatar Feb 15 '24 21:02 ThiefMaster

The lack of the -r requirements.in in the output has been a blocker on using uv to replace pip-compile in some projects I work on. Glad to see this already on the radar.

jzmiller1 avatar Feb 23 '24 20:02 jzmiller1

Hello @charliermarsh do you have an update on this issue ?

Thanks a lot !

Djailla avatar Mar 25 '24 15:03 Djailla

FYI, I'm (slowly) having a bit of of a poke at this one. @charliermarsh I'm assuming you'd be interested in PRs for this one right?

palfrey avatar Apr 21 '24 20:04 palfrey

Yeah happily. Let me know if you run into issues or have questions.

charliermarsh avatar Apr 21 '24 21:04 charliermarsh

@charliermarsh (and anyone else interested): https://github.com/astral-sh/uv/pull/3269 is a first draft at this. It has the major redeeming feature that it works (i.e. does the requested item here), but there's a stack of unresolved questions in the PR that need figuring out.

Also, it's needed some fairly chunky changes overall, and there's probably at least some stylistic changes that are wanted (although I tried to keep to the same style as the surrounding code)!

palfrey avatar Apr 25 '24 21:04 palfrey

Will be supported in the next version thanks to @palfrey.

charliermarsh avatar May 09 '24 14:05 charliermarsh

Thank you @palfrey - this will make dependabot updates so much less annoying

matmair avatar May 09 '24 22:05 matmair