public inbox for [email protected]
help / color / mirror / Atom feedUpgrade some pgweb python dependencies
2+ messages / 2 participants
[nested] [flat]
* Upgrade some pgweb python dependencies
@ 2026-02-11 22:39 Paul A Jungwirth <[email protected]>
0 siblings, 1 reply; 2+ messages in thread
From: Paul A Jungwirth @ 2026-02-11 22:39 UTC (permalink / raw)
To: [email protected]
I submitted a patch to pgarchive recently, which led me to setting up
pgweb, based on the instructions in docs/dev_install.rst.[0]
Using debian 13 and python 3.9, I ran into several errors running `pip
install -r requirements.txt`. The versions pinned there look quite
old. The latest allowed version of pycryptodomex even seems to use
python2 syntax, so I don't understand how it works for anyone else.
Here are some patches with the upgrades I needed to get things
installed and running. (The pycryptodomex failure didn't appear until
I ran `./manage.py migrate`.) The psycopg2 upgrade is very modest, but
the other two are more aggressive. Probably more of the dependencies
are due for upgrading as well, but they do work.
[0] https://www.postgresql.org/message-id/CA%2BrenyWA77wVu2Zis3%3DtdBWAj-Xbz7cKuZbMbo6%3Do5cMR7wZVQ%40ma...
Yours,
--
Paul ~{:-)
[email protected]
Attachments:
[text/x-patch] v1-0003-Allow-pycryptodomex-up-to-3.23.0.patch (984B, ../../CA+renyW-Fc0m3+dp0kGwhHPuhuNbk4x2YZSSx5b8KTfbBbc45w@mail.gmail.com/2-v1-0003-Allow-pycryptodomex-up-to-3.23.0.patch)
download | inline diff:
From 37cf2dbbd6b41c9935b488a997f86219a8604bbd Mon Sep 17 00:00:00 2001
From: "Paul A. Jungwirth" <[email protected]>
Date: Wed, 11 Feb 2026 14:14:24 -0800
Subject: [PATCH v1 3/3] Allow pycryptodomex up to 3.23.0
Our `requirements.txt` file pins pycryptodomex to very old versions:
pycryptodomex>=3.4.7,<3.5
3.4.12 was released in 2018. Running `./manage.py migrate` fails with a
syntax error, because it's using the old Python 2 comma syntax for an
`except` clause. I don't recall Python 3 ever supporting that syntax, so
I'm not sure how this `requirements.txt` file ever worked before.
---
requirements.txt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/requirements.txt b/requirements.txt
index 6faba9be..e17a7877 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,6 +1,6 @@
Django>=4.2,<4.3
psycopg2==2.8.6
-pycryptodomex>=3.4.7,<3.5
+pycryptodomex>=3.4.7,<=3.23.0
Markdown==3.0.1
requests-oauthlib==1.0.0
cvss==2.2
--
2.47.3
[text/x-patch] v1-0002-Upgrade-PyYAML-to-6.0.3.patch (678B, ../../CA+renyW-Fc0m3+dp0kGwhHPuhuNbk4x2YZSSx5b8KTfbBbc45w@mail.gmail.com/3-v1-0002-Upgrade-PyYAML-to-6.0.3.patch)
download | inline diff:
From 9519cebe69f7482e4a87fcfa9f05406bb660fe39 Mon Sep 17 00:00:00 2001
From: "Paul A. Jungwirth" <[email protected]>
Date: Wed, 11 Feb 2026 13:59:26 -0800
Subject: [PATCH v1 2/3] Upgrade PyYAML to 6.0.3
Previously we were using 3.13, released in 2018. This no longer builds
on Debian 13 (using python3.9).
---
requirements.txt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/requirements.txt b/requirements.txt
index 64461086..6faba9be 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -9,6 +9,6 @@ pycodestyle==2.4.0
pynliner==0.8.0
Babel==2.6.0
bleach==3.1.4
-PyYAML==3.13
+PyYAML==6.0.3
zstandard==0.23.0
rpmfile==2.1.0
--
2.47.3
[text/x-patch] v1-0001-Upgrade-psycopg2-to-2.8.6.patch (801B, ../../CA+renyW-Fc0m3+dp0kGwhHPuhuNbk4x2YZSSx5b8KTfbBbc45w@mail.gmail.com/4-v1-0001-Upgrade-psycopg2-to-2.8.6.patch)
download | inline diff:
From 93308911f0d437a54ffe15f11bf2c3b02af02705 Mon Sep 17 00:00:00 2001
From: "Paul A. Jungwirth" <[email protected]>
Date: Wed, 11 Feb 2026 13:52:08 -0800
Subject: [PATCH v1 1/3] Upgrade psycopg2 to 2.8.6
This fixes an error installing it on Debian 13 (and elsewhere) described
[in this Github issue](https://github.com/psycopg/psycopg2/issues/1397).
They fixed it in [this
pull request](https://github.com/psycopg/psycopg2/pull/1399).
---
requirements.txt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/requirements.txt b/requirements.txt
index 840037ee..64461086 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,5 +1,5 @@
Django>=4.2,<4.3
-psycopg2==2.8.5
+psycopg2==2.8.6
pycryptodomex>=3.4.7,<3.5
Markdown==3.0.1
requests-oauthlib==1.0.0
--
2.47.3
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: Upgrade some pgweb python dependencies
@ 2026-02-12 12:02 Magnus Hagander <[email protected]>
parent: Paul A Jungwirth <[email protected]>
0 siblings, 0 replies; 2+ messages in thread
From: Magnus Hagander @ 2026-02-12 12:02 UTC (permalink / raw)
To: Paul A Jungwirth <[email protected]>; +Cc: [email protected]
On Wed, 11 Feb 2026 at 23:40, Paul A Jungwirth <[email protected]>
wrote:
> I submitted a patch to pgarchive recently, which led me to setting up
> pgweb, based on the instructions in docs/dev_install.rst.[0]
>
> Using debian 13 and python 3.9, I ran into several errors running `pip
> install -r requirements.txt`. The versions pinned there look quite
> old. The latest allowed version of pycryptodomex even seems to use
> python2 syntax, so I don't understand how it works for anyone else.
>
These requirements files are, ahem, badly maintained. I assume nobody
really uses them :/
FWIW, since you're on debian, the easiest is to just use the debian
packaged versions of basically everything. Our production is on debian
bookworm and testing is on debian trixie, so either of those should work.
The only thing you need to install from pip at this point is Django itself
and cvss (if you want the security pages).
Doesn't mean the requirements.txt shouldn't be better maintained, so we
should look at that, but as a quick-fix for your current situation and to
make sure you're running something that matches what's actually used in
production.
//Magnus
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2026-02-12 12:02 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2026-02-11 22:39 Upgrade some pgweb python dependencies Paul A Jungwirth <[email protected]>
2026-02-12 12:02 ` Magnus Hagander <[email protected]>
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox