Keyroller: simplify package dependencies and remove pipfile #16626
+20
−175
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Short description
This PR tries to simplify the location of dependencies for this tool to only
requirements.txt. Also updatessetup.pyto consider that the requirements file could include hashes (pip-compileoutput).The reason for this PR is that
dependabotfound a couple of security issues for the packages pinned inPipfile.lockthat was initially generated for Python 3.7`. See #16605 and #15648.A simple test to check that the package builds correctly:
Checklist
I have: