Suggestion: Get rid of XStatic dependencies and bundle required files as static resources

[roland-ruedenauer]

Most of the XStatic packages moin uses are outdated or even unmaintained. To be able to use current releases of these dependencies, I suggest moving away from depending on XStatic packages and bundle the few files required directly with moin. Not doing so, I see no way to make any progress using current jQuery, Bootstrap, etc.

[ThomasWaldmann]

Bundled dependencies are bad, dist package maintainers hate it and only should be last resort if there is no other option.

Also, for moin it would mean that a security issue in any of the bundled dependencies would force a new moin release to fix it.

The other option here is to update the xstatic packages. I guess more maintainers for these on pypi would be a good thing. Before updating the xstatic packages, make sure moin requires a version of them that actually works with moin.

[roland-ruedenauer]

The other option here is to update the xstatic packages.

As I found out, you're maintainer of most of the XStatic packages used by moin. So it should at least be possible getting PRs merged. Looking at the base XStatic package, I see an old PR, that would solve an issue with using pkg_resources, which was removed from Python 3.12 and already caused problems (#1700). What is the plan for releasing a 2.0.0 version of XStatic?

[ThomasWaldmann]

I already could fix it.

It was something way simpler than what I considered back then when trying to fix it:

Mixing pip install --user and pip install (without --user) for xstatic main package and xstatic resource packages does not work.

[roland-ruedenauer]

I already could fix it.

Sounds good.

Btw, what's the reasoning behind having all the package meta information in XStatic packages __init__.py? Wouldn't it be sufficient for most of the infomation to be kept solely in pyproject.toml?

[ThomasWaldmann]

xstatic was invented before pyproject.toml, the metadata is there so it can be easily accessed from code that uses xstatic.

[roland-ruedenauer]

Well, before pyproject.toml it was setup.py or setup.cfg. Most of the info there seems to be misplaced to me (besides possibly NAME or LOCATIONS). All this stuff will be available in the package metadata.

[ThomasWaldmann]

I wanted to have everything needed in one easy accessible place and also I wanted to be able to put additional data in there as needed, so that is not possible with the normal package metadata.