PyYaml version needs an update about auditree-arboretum HOT 9 CLOSED

@markuszoeller I'm publishing now the new version.

from auditree-arboretum.

@markuszoeller it should be available now https://pypi.org/project/auditree-arboretum/.

from auditree-arboretum.

To echo @markuszoeller 's comments, it's not clear to me why arboretum needs pyyaml<5.4

Not only is 5.3.1 old and vulnerable, it causes dependency problems for any projects that consume arboretum and require a newer version of pyyaml.
Moreover, it looks like the pyyaml developers are no longer backporting fixes to the 5.x release. For example, versions 5.4 & 5.4.1 don't work with Python 3.10 and above (due to a fix around cython sources not getting backported).

Ideally, I think that explicit version dependency should be removed, allowing it to pick up the latest (currently 6.0.1).
@alfinkel @cletomartin - will you accept a PR for that change? Are successful unit tests enough evidence that it does not cause a regression?

from auditree-arboretum.

I don't think #54 (comment) was a typo but it was 2.5 years ago when I made the comment. There may have been an issue with syntactical usage around the package and the code but again, I can't say definitively as it was quite a while ago.

Also, I'm not sure that passing unit tests is an indicator that all would be OK as I don't think we had optimal unit test coverage (at least in the past).

But I'll defer to @cletomartin since he's probably more up to date with auditree/arboretum these days.

from auditree-arboretum.

Ok - thanks @alfinkel .. I might be missing something here, but I can't even see where or why that original PR required pyyaml. Certainly it's not used directly anywhere, and there's no obvious new indirect dependency added via that PR.

A pip inspect (or pip show pyyaml) in arboretum shows pyyaml being indirectly needed only by bandit, pre-commit and markdown-it-py.

from auditree-arboretum.

Certainly it's not used directly anywhere

It's used here:

from auditree-arboretum.

Ah - thanks for putting me straight @markuszoeller !

from auditree-arboretum.

Thanks @markuszoeller! I don't think there is a good reason for keeping that restriction. I vaguely remember we had a problem with that specific version of pyyaml long time ago so this could be the case that we forgot to release the restriction when the issue was fixed.

I have created #69 for fixing this.

from auditree-arboretum.

@markuszoeller I'm publishing now the new version.

@cletomartin JFYI, I don't see it yet on PyPi, so I cannot consume it yet. Could you take a look at the release please?

from auditree-arboretum.