Deprecate implicit setup.py support #1897
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
edmorley
force-pushed
the
deprecate-setup-py
branch
2 times, most recently
from
290a3ec to
2907ebc
Compare
Currently if an app has only a `setup.py` file and no Python package
manager files (such as `requirements.txt`, `Pipfile.lock`, `Poetry.lock`
or `uv.lock`), the buildpack will install the project using
`pip install --editable .`
However, there is nothing pip-specific about `setup.py` - the file is
not a package manager dependency file but instead a setuptools package
file, and could easily be installed by any package manager. In addition,
some projects may want to install this file in standard rather than
editable mode.
As such, it's best that the buildpack doesn't guess which package
manager and mode to use, and instead we require explicit configuration
from the user.
For example in the form of a `requirements.txt` file that references the
package definition, via this single line in the requirements file:
```
--editable .
```
That said, in general we recommend people don't use `setup.py` to declare
their dependencies, since:
(a) the file is deprecated in favour of `pyproject.toml`
(b) it's intended more for libraries rather than applications, and it's
much less common (and practical) to list all transitive dependencies
in a `setup.py`, meaning apps using the file typically have unpinned
dependencies, which is a production reliability risk. (Apps should
either be using a package manager that supports lockfiles, or else
using one of the pip requirements files substitutes like pip-tools
or `pip freeze` etc).
The existing metrics for this fallback show usage to be very low, so
we'll likely not wait long before converting this warning to an error
(particularly since fixing the error is a case of adding a single
line requirements file, so fairly simple).
GUS-W-19275438.
edmorley
force-pushed
the
deprecate-setup-py
branch
from
2907ebc to
51f708e
Compare
Malax
approved these changes
Sep 10, 2025
Merged
Closed
edmorley
added a commit
that referenced
this pull request
Dec 9, 2025
Previously if an app has only a `setup.py` file and no Python package manager files (such as `requirements.txt`, `Pipfile.lock`, `Poetry.lock` or `uv.lock`), the buildpack would install the project using `pip install --editable .` However, this implicit fallback doesn't make sense now that the buildpack supports multiple package managers, and so has to guess which package manager to use, and whether to install the project in editable mode or not. As such, in #1897 this fallback was deprecated, and is now being sunset. This also brings the classic Python buildpack's behaviour in line with the Python CNB. Apps that only have a `setup.py` file will now need to add an explicit `requirements.txt` file containing: ``` --editable . ``` GUS-W-19275444.
edmorley
added a commit
that referenced
this pull request
Dec 9, 2025
Previously if an app had only a `setup.py` file and no Python package manager files (such as `requirements.txt`, `Pipfile.lock`, `Poetry.lock` or `uv.lock`), the buildpack would install the project using `pip install --editable .` However, this implicit fallback doesn't make sense now that the buildpack supports multiple package managers, and so has to guess which package manager to use, and whether to install the project in editable mode or not. As such, in #1897 this fallback was deprecated, and is now being sunset. This also brings the classic Python buildpack's behaviour in line with the Python CNB. Apps that only have a `setup.py` file will now need to add an explicit `requirements.txt` file containing: ``` --editable . ``` GUS-W-19275444.
edmorley
added a commit
that referenced
this pull request
Dec 9, 2025
Previously if an app had only a `setup.py` file and no Python package manager files (such as `requirements.txt`, `Pipfile.lock`, `Poetry.lock` or `uv.lock`), the buildpack would install the project using `pip install --editable .` However, this implicit fallback doesn't make sense now that the buildpack supports multiple package managers, and so has to guess which package manager to use, and whether to install the project in editable mode or not. As such, in #1897 this fallback was deprecated, and is now being sunset. This also brings the classic Python buildpack's behaviour in line with the Python CNB. Apps that only have a `setup.py` file will now need to add an explicit `requirements.txt` file containing: ``` --editable . ``` GUS-W-19275444.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently if an app has only a
setup.pyfile and no Python package manager files (such asrequirements.txt,Pipfile.lock,Poetry.lockoruv.lock), the buildpack will install the project usingpip install --editable .However, there is nothing pip-specific about
setup.py- the file is not a package manager dependency file but instead a setuptools package file, and could easily be installed by any package manager. In addition, some projects may want to install this file in standard rather than editable mode.As such, it's best that the buildpack doesn't guess which package manager and mode to use, and instead we require explicit configuration from the user.
For example in the form of a
requirements.txtfile that references the package definition, via this single line in the requirements file:That said, in general we recommend people don't use
setup.pyto declare their dependencies, since:pyproject.tomlsetup.py, meaning apps using the file typically have unpinned dependencies, which is a production reliability risk. (Apps should either be using a package manager that supports lockfiles, or else using one of the pip requirements files substitutes for lockfiles, like pip-tools orpip freezeetc.)The existing metrics for this fallback show usage to be very low, so we'll likely not wait long before converting this warning to an error (particularly since fixing the error is a case of adding a single line requirements file, so fairly simple).
GUS-W-19275438.