1"use strict";(globalThis.webpackChunkcf_infra_docs=globalThis.webpackChunkcf_infra_docs||[]).push([[10621],{83279(e,n,t){t.r(n),t.d(n,{assets:()=>d,contentTitle:()=>o,default:()=>l,frontMatter:()=>r,metadata:()=>a,toc:()=>c});const a=JSON.parse('{"id":"how-to/emergencies/update-a-dependency-in-published-packages","title":"How to update a dependency in published packages","description":"There are cases when you wish to update a dependency in a number of packages that were already built","source":"@site/docs/how-to/emergencies/update-a-dependency-in-published-packages.md","sourceDirName":"how-to/emergencies","slug":"/how-to/emergencies/update-a-dependency-in-published-packages","permalink":"/docs/how-to/emergencies/update-a-dependency-in-published-packages","draft":false,"unlisted":false,"editUrl":"https://github.com/conda-forge/conda-forge.github.io/tree/refs/heads/main/docs/how-to/emergencies/update-a-dependency-in-published-packages.md","tags":[{"inline":true,"label":"how-to","permalink":"/docs/tags/how-to"},{"inline":true,"label":"emergency","permalink":"/docs/tags/emergency"}],"version":"current","lastUpdatedAt":1790351612000,"frontMatter":{"tags":["how-to","emergency"]},"sidebar":"diataxis","previous":{"title":"Fix a packaging error","permalink":"/docs/how-to/emergencies/fix-a-packaging-error"},"next":{"title":"Compilation concepts","permalink":"/docs/maintainer/understanding_conda_forge/compilation-concepts"}}');var i=t(74848),s=t(28453);const r={tags:["how-to","emergency"]},o="How to update a dependency in published packages",d={},c=[{value:"Updating the feedstock",id:"updating-the-feedstock",level:2},{value:"Preparing a repodata update",id:"preparing-a-repodata-update",level:2}];function p(e){const n={a:"a",code:"code",h1:"h1",h2:"h2",header:"header",p:"p",pre:"pre",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.header,{children:(0,i.jsx)(n.h1,{id:"how-to-update-a-dependency-in-published-packages",children:"How to update a dependency in published packages"})}),"\n",(0,i.jsx)(n.p,{children:"There are cases when you wish to update a dependency in a number of packages that were already built\nand published. For example, it may happen that you that you did not pin a dependency as necessary,\nor that upstream introduced an incompatibility within the current pin. This approach may also be\nused to disallow specific dependency versions, for example when they contain a high-risk security\nvulnerability."}),"\n",(0,i.jsx)(n.h2,{id:"updating-the-feedstock",children:"Updating the feedstock"}),"\n",(0,i.jsxs)(n.p,{children:["If the change in question applies to one or more feedstock branches that are still maintained (see\n",(0,i.jsx)(n.a,{href:"https://conda-forge.org/docs/how-to/advanced/several-versions/",children:"maintaining several versions"}),"), it\nis a good idea to update the dependencies in the recipes first. This ensures that any subsequent\npackages built will have the correct dependencies."]}),"\n",(0,i.jsxs)(n.p,{children:["For example, let's assume that we are changing a dependency in ",(0,i.jsx)(n.code,{children:"sympy-feedstock"})," from:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-recipe",metastring:'title="The recipe (prior to update)"',children:"build:\n number: 2\n # ...\n\nrequirements:\n run:\n - mpmath >=0.19\n"})}),"\n",(0,i.jsx)(n.p,{children:"to:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-recipe",metastring:'title="The recipe (updated)"',children:"build:\n number: 3\n # ...\n\nrequirements:\n run:\n - mpmath >=0.19,<1.4\n"})}),"\n",(0,i.jsx)(n.p,{children:"Remember to bump the build number."}),"\n",(0,i.jsx)(n.h2,{id:"preparing-a-repodata-update",children:"Preparing a repodata update"}),"\n",(0,i.jsxs)(n.p,{children:["Updates to the metadata of published packages are done via ",(0,i.jsx)(n.a,{href:"https://github.com/conda-forge/conda-forge-repodata-patches-feedstock/tree/main/recipe",children:"repodata\npatches"}),".\nTo add a new update, fork the repository and look for a ",(0,i.jsx)(n.code,{children:".yaml"}
1)," file in ",(0,i.jsx)(n.code,{children:"recipe/patch_yaml/"}),"\ncorresponding to the package you want to patch. If there is none, create one."]}),"\n",(0,i.jsxs)(n.p,{children:["The file contains one or more conditions followed by change instructions. All the possible keys are\nlisted in the ",(0,i.jsx)(n.a,{href:"https://github.com/conda-forge/conda-forge-repodata-patches-feedstock/blob/main/recipe/README.md",children:"README\nfile"}),".\nFor example, let's consider the following file:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",metastring:'title="recipe/patch_yaml/sympy.yaml"',children:"if:\n name: sympy\n version_le: 1.14.0\n timestamp_lt: 1771947801000\nthen:\n - replace_depends:\n old: mpmath >=0.19\n new: mpmath >=0.19,<1.4\n"})}),"\n",(0,i.jsxs)(n.p,{children:["This rule specifies that all packages named ",(0,i.jsx)(n.code,{children:"sympy"}),", older than ",(0,i.jsx)(n.code,{children:"1.14.0"})," and created before the\nspecified timestamp should have their dependencies updated from the old to the new value. When\ncreating a new rule, remember to update the timestamp. You can use a website such as\n",(0,i.jsx)(n.a,{href:"https://currentmillis.com/",children:"current millis"}),", or one of the following commands:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"python -c \"import time; print(f'{time.time():.0f}000')\"\ndate +%s000\n"})}),"\n",(0,i.jsx)(n.p,{children:"Once ready, test the patch:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"cd recipe/\npixi run diff\n"})}),"\n",(0,i.jsxs)(n.p,{children:["You need to ",(0,i.jsxs)(n.a,{href:"https://pixi.prefix.dev/latest/installation/",children:["install ",(0,i.jsx)(n.code,{children:"pixi"})]})," beforehand if you don't have it installed yet."]}),"\n",(0,i.jsxs)(n.p,{children:["Note that this command may take a few minutes to execute. It will write a ",(0,i.jsx)(n.code,{children:"show_diff_result.txt"}),"\nfile that will list all the changes to package metadata that will be performed. It may also include\nthe metadata for a few extraneous packages (false positives) if new packages are published while the\nprocess is ongoing."]}),"\n",(0,i.jsxs)(n.p,{children:["Once you confirm that the changes look correct, create a branch, commit them and open a pull\nrequest. Remember to include the contents of ",(0,i.jsx)(n.code,{children:"show_diff_result.txt"})," in the pull request."]}),"\n",(0,i.jsx)(n.p,{children:"Alternatively, you can open the pull request first (as draft), let the CI run and then copy the\nrelevant bits from the logs (using raw logs is recommended)."})]})}function l(e={}){const{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(p,{...e})}):p(e)}},28453(e,n,t){t.d(n,{R:()=>r,x:()=>o});var a=t(96540);const i={},s=a.createContext(i);function r(e){const n=a.useContext(s);return a.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function o(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),a.createElement(s.Provider,{value:n},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.