Should we update extra Python ecosystem packages installed on Plone 5.2.13 container

[fredvd]

@mauritsvanrees @davisagli @pbauer

I want to make a new release of our plone-backend images for Plone 5.2 now that Maurits has released 5.2.13. But I notice in the Dockerfile we install/add some extra packages that are really outdated.

Also pip is still pinned ad 22.0.4 when the constraints.txt for Plone 5.2.13 now has pip 23.2.

The image is 'officially' not support, as in: we started promoting the container images for Plone 6. But what to do here?

If dockerfiles based on our image are really picky they repin their packages, but if they are depending on what is in the package.... We can update:

pip == 23.2 relstorage == 3.5.0 psycopg2 == 2.9.6 python-ldap == 3.4.3 plone.volto==3.1.0a9

https://github.com/plone/plone-backend/blob/533916d6685d1021d04ca82f24d36d7cd77e72e9/Dockerfile#L6-L10

[mauritsvanrees]

Actually, constraints.txt only has this for pip:

pip==20.3.4; python_version < "3.0"

So on Python 3, pip is not pinned.

The updated versions seem fine. I am not sure about the alpha version of plone.volto though. We could pin 4.0.10. Version 4 has breaking changes, but version 3.1.0a9 has a breaking change as well.

[fredvd]

Ah, pip for Python 3 is indeed not pinned in the constraints file. But there is a pip 23.2 package in the release folder on dist.plone.org: https://dist.plone.org/release/5.2.13/pip-23.2-py3-none-any.whl

I am not sure about the alpha version of plone.volto though. We could pin 4.0.10. Version 4 has breaking changes, but version 3.1.0a9 has a breaking change as well.

I'm kind of assuming plone.volto 3.X is for Plone 5.2 and 4.x is for Plone 6. @sneridagh @ericof Any opinions here?

I tend to keep the plone.volto version untouched as the Plone 5.2 / Volto combination is a custom setup anyway for installed base.

[davisagli]

@fredvd @mauritsvanrees I think it's still possible to use any version of plone.volto with Plone 5.2, but the versions are tied to which plone.restapi version is used.

plone.volto 2.x works with plone.restapi 7.x (and the 5.2 versions currently has plone.restapi = 7.8.2) plone.volto 3.x requires plone.restapi >=8.13.0 plone.volto 4.x requires plone.restapi >=8.41.0

(The current pin of plone.volto = 3.1.0a4 works even with plone.restapi 7.x because it was the last version before the requirement for plone.restapi >=8.13.0 was added.)

So I guess the options are to leave things as is, or update both plone.restapi and plone.volto. Updating to plone.restapi 8.x is a breaking change that drops support for Python 2. So I guess we need to leave things as is.

[lyralemos]

I just tried plone-backend 5.2.14 and I think pip 23.2 broke de DEVELOP option, at least in 5.2 branch.

To confirm this I cloned collective.easyform (3x branch) and tried to added as a develop egg, like this:

docker run --rm -p 8080:8080 -e DEVELOP="/app/src/collective.easyform" -v ./collective.easyform:/app/src/collective.easyform plone/plone-backend:5.2.14 start

When I try install it, it's not available in the Addons page.

That is not the case with 5.2.12 or even in plone 6 (using collective.easyform master branch).

Here the commands I ran for reference:

Plone 5.2.12

docker run --rm -p 8080:8080 -e DEVELOP="/app/src/collective.easyform" -v ./collective.easyform:/app/src/collective.easyform plone/plone-backend:5.2.12 start

Plone 6

docker run --rm -p 8080:8080 -e DEVELOP="/app/src/collective.easyform" -v ./collective.easyform:/app/src/collective.easyform plone/plone-backend:latest start

The wierd thing is that plone 6 also comes with pip 23.2.

[avoinea]

Be aware when upgrading from RelStorage 3.4.5 to 3.5.0

Extracted from RelStorage changelog

Caution

Be careful deploying this version while older versions are executing. There could be a small window of time where the locking strategies are different, leading to database corruption.