Live data from Hacker News

A year of uv: pros, cons, and should you migrate

bitecode.dev

391–400 of 401 posts

Re: A year of uv: pros, cons, and should you migrate

#391
post #387

Earlier quoted context omitted.

> Why would the wrong venv be activated? Because when you activate a venv in a given terminal window it stays active until you deliberately deactivate it, and one terminal and one venv looks much like another. > I activate a venv according to the project I'm currently working on. So just manual discipline? It works (most of the time), but in my experience there's a "discipline budget"; every little niggle you have to…

>So just manual discipline? It works (most of the time), but in my experience there's a "discipline budget"; every little niggle you have to worry about manually saps your ability to think about the actual business problem. >...but getting forced to update while you're in the middle of working on a feature... I feel like trying to work on more than one project in the same session would require more such discipline. >…

> I feel like trying to work on more than one project in the same session would require more such discipline.

We all know that multitasking reduces productivity. But business often demands it (hopefully while being conscious of what it's costing).

You also don't have to be working in the "same session" to trip yourself up this way - "this terminal tab still has the venv from what I was working on yesterday/last week" is a way I've had it happen.

> I primarily develop libraries; if something breaks this way, I want to find out about it as soon as possible, so that I can advertise correct dependency ranges to my downstream.

If you want to find out as soon as possible, better to have a systematic way of finding out (e.g. a daily "edge build") than pick up new dependencies essentially at random.

> The requirements.txt approach does, of course, allow you to list transitive dependencies explicitly, and pin everything.

It allows you to, but it doesn't make it easy or natural. Especially if you're making a library, you probably don't want to list all your transitive dependencies or pin exact versions in your requirements.txt (at least not the one you're publishing). So you end up with something like two different requirements.txt where you use a frozen one for development and then switch to an unfrozen one for release or when you need to add or change dependencies, and regenerate the frozen one every so often. None of which is impossible, but it's all tedious and error-prone and there's no real standardisation (so e.g. even if you come up with a good workflow for your project, will your IDE understand it?).

> Fortunately, it looks like I'd be able to take advantage of the PEP 751 standard if and when I need that.

That's a standard written in response to the rise of uv, that still hasn't been agreed to, much less implemented, much less turned on by default (and unfortunately most of the time when you realise you need a lock file, you need the lock file that the first run of your tool would have generated when it was run, not the lock file it would generate now - so an optional lock file is of limited effectiveness). I don't think it justifies a "python packaging has never been a problem" stance - quite the opposite, it's an acknowledgement that pre-uv python packaging really was as broken as many of us were saying.

Re: A year of uv: pros, cons, and should you migrate

#392

Earlier quoted context omitted.

> Lockfiles are meant to describe the exact version of everything that should be in the environment to have exact reproducible behaviour (not just "working"), including transitive dependencies. It is wrong to specify the versions for your transitive dependencies except to achieve reproducible builds, as in CI or other situations. If a dependency fails to correctly describe their requirements in their pyproject.toml i…

>It is wrong to specify the versions for your transitive dependencies except to achieve reproducible builds Yes, and this is why many people have both pyproject.toml and requirements.txt. pyproject.toml is meant to specify abstract, unresolved dependencies only. >If your application only works with specific versions of dependencies and has bugs in others, that should be described in pyproject.toml. That's quite liter…

> That's quite literally not the design, if by "dependencies" you mean including transitive dependencies.

I don't. Your transitive dependencies are not your problem, they are upstream's problem. Anything regarding version requirements of such packages belongs upstream.

> pyproject.toml isn't there to enable reproducible builds.

Agreed. The repository itself should not contain anything related to reproducible builds. Reproducible builds are a packaging concern not part of the source of the project itself. Ex, it would be appropriate to ship a lockfile alongside a wheel or a tarball that specifies it is the lockfile used to produce that particular build of the project; but both the wheel and the lockfile exist outside the context of the project itself.

> Some application developers would say that, as far as they are concerned, the code "cannot run" except in the context of a reproducible build.

Yes, they are wrong.

Re: A year of uv: pros, cons, and should you migrate

#393

Earlier quoted context omitted.

Yes, the code is at https://github.com/tiltowait/botch I'm planning on asking on the Astral Discord server once I have some time to set aside to it. By "without it being a package", I mean that I don't have `src/foo`, which has `src/foo/__main__.py`, but e.g. `src/main.py`.

>By "without it being a package", I mean that I don't have `src/foo`, which has `src/foo/__main__.py`, but e.g. `src/main.py`. This doesn't matter. What does matter, though, is that [project.scripts] doesn't support passing arguments - the entry point is only specified as path.to.module:function , which is expected not to take any arguments (although of course it can read `sys.argv`, which will be forwarded from the…

Thanks for the links. This helped point me in the right direction. I made no-argument callables in my launch script and ran `uvx migrate-to-uv`. I then changed the [tool.hatch...] section to this:

    [tool.hatch.build.targets.wheel]
    force-include = {"src/" = "/"}
With those three things done, I'm in business. Thanks!

Re: A year of uv: pros, cons, and should you migrate

#394

Earlier quoted context omitted.

> And I had to deal with Scala's SBT ("Simple Build Tool") in another life. I feel you.

For someone who was just about to give Scala a try, what's wrong with it and are there alternative build tools?

I've use sbt and don't have a problem.

But Mill is very good. [1]

[1] https://mill-build.org/mill/index.html

Re: A year of uv: pros, cons, and should you migrate

#395

Earlier quoted context omitted.

>By "without it being a package", I mean that I don't have `src/foo`, which has `src/foo/__main__.py`, but e.g. `src/main.py`. This doesn't matter. What does matter, though, is that [project.scripts] doesn't support passing arguments - the entry point is only specified as path.to.module:function , which is expected not to take any arguments (although of course it can read `sys.argv`, which will be forwarded from the…

Thanks for the links. This helped point me in the right direction. I made no-argument callables in my launch script and ran `uvx migrate-to-uv`. I then changed the [tool.hatch...] section to this: [tool.hatch.build.targets.wheel] force-include = {"src/" = "/"} With those three things done, I'm in business. Thanks!

Glad it worked. Most build systems attempt automatic package discovery, but they might not assume that you want to include top-level modules. I haven't tried Hatch(ling) so I can't advise. The maintainer posts here (and is active on discuss.python.org), though.

Re: A year of uv: pros, cons, and should you migrate

#396
post #391

Earlier quoted context omitted.

>So just manual discipline? It works (most of the time), but in my experience there's a "discipline budget"; every little niggle you have to worry about manually saps your ability to think about the actual business problem. >...but getting forced to update while you're in the middle of working on a feature... I feel like trying to work on more than one project in the same session would require more such discipline. >…

> I feel like trying to work on more than one project in the same session would require more such discipline. We all know that multitasking reduces productivity. But business often demands it (hopefully while being conscious of what it's costing). You also don't have to be working in the "same session" to trip yourself up this way - "this terminal tab still has the venv from what I was working on yesterday/last week"…

>None of which is impossible, but it's all tedious and error-prone and there's no real standardisation (so e.g. even if you come up with a good workflow for your project, will your IDE understand it?).

I mean, my "IDE" is Vim, and I'm not even a Vim power-user or anything.

People gravitate towards tools according to their needs and preferences. My own needs are simple, and my aesthetic sense is such that I strongly prefer to use many small tools instead of an opinionated, over-arching workflow tool. Getting into the details probably isn't productive any further from here.

>That's a standard written in response to the rise of uv

I know it looks this way given the timing, but I really don't think that's accurate. Python packaging discussion moves slowly and people have been talking about lock files for a long time. PEP 751 has seen multiple iterations, and it's not the first attempt, either. When uv first appeared, a lot of important people were taken completely by surprise; they hadn't heard of the project at all. My impression is that the Astral team liked it just fine that way, too. But it's not as if someone like Brett Cannon had an epiphany from seeing uv's approach. Poetry has been doing its own lock files for years.

>so an optional lock file is of limited effectiveness

The problem is that you aren't going to just get everyone to do everything "professionally". Python is where it is because of the low barrier to entry. A quite large fraction of Python programmers likely still don't even know what pyproject.toml is.

>I don't think it justifies a "python packaging has never been a problem" stance

That's certainly not my stance and I don't think it's the other guy's stance. I just shy away from heavyweight solutions on principle. Simple is better than complex, and all that. And I end up noticing problems that others don't, this way.

Re: A year of uv: pros, cons, and should you migrate

#397

Earlier quoted context omitted.

Deno and npm both store the hashes of all the dependencies you use in a lock file and verify them on future reinstalls.

The lockfile is good, but I'm talking about this inline dependency syntax, # dependencies = ['requests', 'beautifulsoup4'] And likewise, Deno can import by URL. Neither include an integrity hash. For JS, I'd suggest import * as goodlib from 'https://verysecure.com/notmalicious.mjs' with { integrity="sha384-xxx" } which mirrors https://developer.mozilla.org/en-US/docs/Web/Security/Subres... and https://developer.mozil…

[deleted]

Re: A year of uv: pros, cons, and should you migrate

#398
post #391

Earlier quoted context omitted.

> I feel like trying to work on more than one project in the same session would require more such discipline. We all know that multitasking reduces productivity. But business often demands it (hopefully while being conscious of what it's costing). You also don't have to be working in the "same session" to trip yourself up this way - "this terminal tab still has the venv from what I was working on yesterday/last week"…

>None of which is impossible, but it's all tedious and error-prone and there's no real standardisation (so e.g. even if you come up with a good workflow for your project, will your IDE understand it?). I mean, my "IDE" is Vim, and I'm not even a Vim power-user or anything. People gravitate towards tools according to their needs and preferences. My own needs are simple, and my aesthetic sense is such that I strongly p…

> People gravitate towards tools according to their needs and preferences.

Up to a point, but people are also nudged, not always consciously, by the reality of what tools exist in their ecosystem. The fact that Python makes "heavy" tools difficult to write and use is a significant factor in what many Python developers think is just a personal preference, IME. (I'd also argue that if you want to use lots of small tools you actually have more need for a standard format for your dependencies and your lockfile, since all the tools need to understand it).

> The problem is that you aren't going to just get everyone to do everything "professionally". Python is where it is because of the low barrier to entry. A quite large fraction of Python programmers likely still don't even know what pyproject.toml is.

Yes and no. I agree that many Python programmers aren't going to change the defaults and may not even know where their tool config file is. Any approach that requires extra effort from the user is not going to succeed. That's exactly why I think lockfiles need to be on by default, which is not something that has to make things harder for users (e.g. npm is a similarly beginner-first ecosystem but they have lockfiles and I've never seen it cited as something that makes it harder to get started or anything like that).

Re: A year of uv: pros, cons, and should you migrate

#399
post #63

Earlier quoted context omitted.

python just didn't have much momentum until relatively recently, despite it's age. There are efforts to speed it up going on now backed by Microsoft. For pypy it's in a weird spot as the things it does fast are the ones you'd usually just offload to a module implemented in C

As a long time Pythonista I was going to push back against your suggestion that Python didn't have much momentum until recently, but then I looked at the historic graph on https://www.tiobe.com/tiobe-index/ and yeah, Python's current huge rise in popularity didn't really get started until around 2018. (TIOBE's methodology is a bit questionable though, as far as I can tell it's almost entirely based on how many search…

python had momentum until the 2->3 transition put a huge damper on it around 2012-2016.

Python got lucky with the machine learning community using Python. (Thank you TensorFlow and PyTorch, and the SciPy community for saving Python.)

Re: A year of uv: pros, cons, and should you migrate

#400
post #268

Can someone explain a non-project based workflow/configuration for uv? I get creating a bespoke folder, repo, and uv venv for certain long-lived projects (like creating different apps?). But most of my work, since I adopted conda 7ish years ago, involves using the same ML environment across any number of folders or even throw-away notebooks on the desktop, for instance. I’ll create the environment and sometimes add n…

That's my main use case not-yet-supported by uv. It should not be too difficult to add a feature or wrapper to uv so that it works like pew/virtualenvwrapper. E.g. calling that wrapper uvv, something like 1. uvv new --python=... ...# venvs stored in a central location 2. uvv workon # now you are in the virtualenv 3. deactive # now you get out of the virtualenv You could imagine additional features such as keeping a l…

So this is probably just me not understanding your use case, but surely this is a nearly identical workflow?

1. uv init # venv stored in folder-name/.venv 2. cd # running stuff with uv run will automatically pick up the venv 3. cd .. # now you get out of the virtualenv

Post reply on HN