search

cloudtools / stacker

An AWS CloudFormation Stack orchestrator/manager.
http://stacker.readthedocs.io/en/stable/
BSD 2-Clause "Simplified" License
711 stars 167 forks source link

Drop support for Python 2.7-3.6 and upgrade to recent dependencies #773

Closed theister closed 1 year ago

theister commented 2 years ago

Working in a team that relies on stacker for most of our IaC code, keeping our dependency set up to date has been harder and harder over the last years, due to more and more dependencies of stacker dropping python 2.7 support in major version releases, which caused them to be pinned down in stacker dependency constraints.

This gets Python 3 users stuck on more than two years old versions of multiple dependencies, some of which even have CVE vulnerabilities registered with them.

As a resolution, I'd like to propose to release a new major version 2.0.0 that drops support for python 2.7, 3.5 and 3.6, all of which are no longer officially supported as of January 2022. At the same time, I propose to update the range of tested versions to the currently supported releases 3.7-3.10. This allows for removing the upper pinning for all dependency constraints of stacker, and keeps it easily usable for people on more recent and future versions of python. Since troposphere has also dropped support for python <3.6.

As an outsider to Remind, I unfortunately can't really judge what the current development status of stacker is and if such a change is welcome, or if a relevant group of companies using stacker is still caught up in the python2 ecosystem.

I hope this PR addresses all of these things. If there are things i've missed kindly point me towards what I can do to resolve this or what additional testing you'd like to se. Also if you'd like me to split certain parts off into separate PRs/Issues.

phobologic commented 2 years ago

Hey @theister - thanks for this. Unfortunately, much of the community of maintainers of stacker have moved on for various reasons, including myself (I, unfortunately, rarely get to write code these days and that means I'm not great at being able to judge/deal with these sorts of PRs). I've reached out to a couple of the folks that I know that have been heavily engaged in the past, but they too have moved on to other things.

So at this point, I think stacker, in this repo, is effectively EOL. If someone in the community would like to take over maintenance of it, I can work with them to get that setup. Let me know if you are interested/have the time to take over the project, or know of someone who does. Thanks!

russellballestrini commented 2 years ago

Bad ass! Thanks @Lowercases

danieljamesscott commented 2 years ago

Could this be merged/released?

theister commented 2 years ago

@russellballestrini @Lowercases

Ah, I didn't even notice there were newer answers on this PR.

What is the current status, are there still plans on merging this PR and creating the two releases? Then we wouldn't need to go ahead with our forking plans.

The suggested release path sounds good to me, although I'd rather use call the release 2.0.0rc1 instead of 1.9.9, to use proper semver, since I assume people would normally pin stacker<2.0.0 in their requirements sets. That said, we can handle either, and as long as there is some release eventually, I'd be super grateful 🙂 .

Lowercases commented 2 years ago

@theister I think the 2.0.0rc1 point is a good one.

We've been testing this internally for a while (actually with some further commits from our own) and we're all for merging. So unless @phobologic (or anybody else) has strong objections I'm all for merging this to master.

theister commented 2 years ago

Hi @Lowercases & @russellballestrini !

It's been five weeks, and it seems there haven't been any objections to your suggested release (candidate) plan. I feel this should be enough to call a silent consensus.

If you find the time (and assuming you have the appropriate rights on this repo and on pypi), I'd be very grateful if one of you could take care of a release.

Please let me know if I can support in any way.

theister commented 1 year ago

@russellballestrini @Lowercases It's been another month, any updates on a release?

Lowercases commented 1 year ago

Unfortunately I haven't got the ability to merge here.

@phobologic thoughts on doing a release? Or blessing me so I could? Thanks

Nookyx commented 1 year ago

please release the update soon. python3.10 compatibility would be much appreciated @phobologic can you do another release or grant @Lowercases permissions to do so or something like that?

phobologic commented 1 year ago

@Lowercases @russellballestrini you both should have the ability to merge this, correct? As I shared before, I'm unlikely to be of much use in this project at this point - it's been well over a year since I wrote any code.

I can share access to pypi as well - I'll go dig into that now.

phobologic commented 1 year ago

@Lowercases can you share your pypi user with me and I'll add you as an admin.

Lowercases commented 1 year ago

@phobologic thank you! I haven't got the ability to merge, I think I'm not part of cloudtools (or maybe just not the permissions). Regarding pypi, you can add nachexnachex. Thanks!!

phobologic commented 1 year ago

Ok, you were part of collaborators - I just made you part of the core collaborators. I've also sent you an invite to the pypi repo. Let me know if any of that isn't working!

Lowercases commented 1 year ago

Merging, will tag this as release candidate before following the steps outlined in https://github.com/cloudtools/stacker/pull/773#pullrequestreview-929246136.