breaking compatibility is like nicotin [LWN.net]

breaking compatibility is like nicotin

Posted May 21, 2025 16:57 UTC (Wed) by ballombe (subscriber, #9523)
Parent article: Recent disruptive changes from Setuptools

...the only way to stop is not to start.

How could they break 12000 packages and not notice ?

to post comments

breaking compatibility is like nicotin

Posted May 22, 2025 12:06 UTC (Thu) by lunaryorn (guest, #111088) [Link] (3 responses)

Well, it's all about perspective.

PyPI hosts about 630.000 packages by its own account. You say they broke 12000 packages and didn't notice. I'd say setuptools broke only two percent of all known packages.

Now, finding those two percent might present a bit of a challenge. I don't think Python has any kind of infrastructure for large scale automated rebuilds across the whole ecosystem to test for such regressions.

Considering this, and the wildly heterogeneous Python packaging and tooling landscape, I find it surprising that they only broke 12000 packages.

breaking compatibility is like nicotin

Posted May 22, 2025 17:05 UTC (Thu) by mb (subscriber, #50428) [Link] (2 responses)

>Now, finding those two percent might present a bit of a challenge.

One of their own dependencies broke due to the change:

> In fact, this change was already known to be incompatible with the popular Requests library [...]
> The 78.0.1 patch simply removed Requests from the Setuptools integration tests

breaking compatibility is like nicotin

Posted May 23, 2025 14:09 UTC (Fri) by lunaryorn (guest, #111088) [Link]

Yes, I've read that, and–among other things–sure indicates that this change wasn't quite done well. From what I've seen, the setuptools maintainers sometimes seem to have... peculiar opinions.

But we should still consider the number in perspective.

The setuptools maintainers really don't have chance at all to assess the impact of their changes upfront. The whole Python ecosystem is neither prepared nor equipped for large-scale testing of its foundations. It desperately lacks the equivalent of Rust's crater, all the more for its fragmented tooling.

Their only way to see what they'd break is to rollout the change and see. Consider this, it's quite surprising that this doesn't break more frequently, and in worse ways.

breaking compatibility is like nicotin

Posted May 29, 2025 21:24 UTC (Thu) by zahlman (guest, #175387) [Link]

Just to clarify (in case I didn't adequately communicate it in the article):

Requests isn't a dependency of Setuptools; rather, the *tests* for Setuptools would *try to install* a separate copy of Requests - from source - in a separate environment, for the purpose of testing integration with pip. Setuptools doesn't try to download anything by itself (it asks pip to do so in these tests), so it doesn't have any use for Requests.

In 78.0.1, Requests was removed from the set of example packages used for this kind of integration testing. (As far as I can tell, this was *not* rolled back when the breaking change was rolled back.) The rationale was that already-built versions of Requests already exist; this "build" process is trivial (no code is actually compiled, metadata is just shuffled around); and the overwhelming majority of Requests users will get this pre-built version (you essentially have to request the source version explicitly if you want it, and there's normally no reason to do so for anyone except perhaps Linux distro maintainers).