Release new version to PyPI

[johnthagen]

Could a new release be pushed to PyPI that includes #186?

For users using Django 3.0, django-rest-framework-simplejwt currently throws a warning. If running unit tests with -Werror, this causes builds to failed unless the warning is suppressed.

[Andrew-Chen-Wang]

@davesque I’m just part of the triage team, but we could try to have a GitHub action that automatically pushes this repo’s releases to PyPi.

[davesque]

Yeah, I'll do this in the next day or two when I find a moment. I'd also like to start using towncrier to make release note generation easier.

[Andrew-Chen-Wang]

@davesque are you comfortable using GH workflows? There was a bit of discussion about security concerns regarding using Python fam's workflow regarding twine and such in Django Rate-Limit. It would make things faster, and GH secrets are hidden from others.

[davesque]

You mean to auto publish new versions?

[Andrew-Chen-Wang]

Yesorta. You would still need to create a release tag wit git/github. Using the release tags, we can publish new versions, do a check to make sure the latest commit passes tests, make sure the version was actually bumped, and upload it with twine tokens in GH secrets. We can use custom commands if need be for docs as well. Separate workflows can be triggered by separate tags, if need be.

[johnthagen]

Given the current django-rest-framework-simplejwt throws a warning, could it be possible to do a quick release using the old process and iron out a new process for the next release? Thanks.

[zkanda]

Hello everybody, it would be cool if we can bump up a new release.

[Is0MerLNtaLt]

@Andrew-Chen-Wang Maybe we can just use semantic versioning using this package. And even automated the whole thing with semantic releases with this package.

[johnthagen]

@davesque Would it be possible to manually push up a new release to PyPI? Thanks.

[Is0MerLNtaLt]

@davesque I can take care of the publishing automation part if you want using GH Actions. It has been almost 2 months and this issue needs to be addressed as the current release fails to install when using Poetry. It has been fixed but has not been published yet.

[davesque]

It has been almost 2 months and this issue needs to be addressed

I feel like it's a bit unfair to suggest that 2 months is too long to wait for a release or that I "need" to do anything at all for free. And can we agree that the last two months have been a little unusual?

[Is0MerLNtaLt]

You're right @davesque. Please take your time. I'll work with a fork + private package till then.

[davesque]

@codegabru Thanks for your understanding. And I'm sorry for being a bit snippy.

[Andrew-Chen-Wang]

@davesque I think it's just really annoying for some devs to constantly see this. I mostly develop test-driven (I don't think I've ran runserver in months so I dunno if it appears there too), and so the error message for Django40DeprecationWarning popped up during my pytests. If this annoys you, you can use this filter in your pytest.ini:

filterwarnings =
    ignore::django.utils.deprecation.RemovedInDjango40Warning

Regarding towncrier, we can also integrate that into GitHub actions as well: twisted/towncrier#175 (comment)

@codegabru We can implement those package per Dave's thoughts. In the Django ratelimit package, which btw includes many integral Django community members, the head maintainer doesn't like the automated release process, and they don't publish very frequently either. They like to do things manually. You'll just have to respect people's decisions and opinions.

Also packages take a lot of maintenance hence a triage team which seems to be mostly me atm... Just understand that open source projects are just open source, which is why people take over repos, make forks or go over to Jazzband, or simply abandon a repo altogether when it's direly needed (I'm a victim of this: django-cachalot is one of the best Django cache packages, and I haven't had the time to maintain it in awhile).

In retrospect after triaging many issues in this repo, I've come to realize many devs like a lot of flexibility when it comes to security (eh hem like Auth0), which is supposed to be stringent (eh hem like OAuth + JWT). An automated process of anything makes life much easier, in any space, not just programming, but I don't want a future maintainer to start publishing like crazy when it's clearly unnecessary and some concepts are not completely proven (eh hem like issue 71).

[johnthagen]

@davesque Friendly ping to see if a new release could be issued.

[johnthagen]

@davesque Another friendly ping to see if we can get a new version released on PyPI. Thank you!

[aaronn]

This would be great to get onto pypi. Thank you!

[Andrew-Chen-Wang]

Released! Thanks for being patient!