Issue:35 Switch project to use uv by kantselovich · Pull Request #40 · GannettDigital/data-diff

kantselovich · 2026-03-21T02:29:31Z

Migrate project tooling from Poetry to uv

Fixes #35

Purpose

Switch the project from Poetry to uv to speed up local environment setup and CI, and to reduce Poetry-specific packaging and workflow configuration.

Scope

migrate pyproject.toml toward standard project metadata and dependency groups
replace Poetry commands in CI, Docker, and contributor docs with uv equivalents
preserve current extras, editable installs, test workflows, and release/build behavior

Acceptance Criteria

local setup is documented with uv
CI installs and test jobs run with uv
Docker no longer depends on Poetry
the project still supports the current dependency extras and CLI entrypoint

gemini-code-assist · 2026-03-21T02:29:54Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request undertakes a significant migration of the project's Python dependency management system from Poetry to uv. The primary goal is to enhance development efficiency by speeding up local environment setup and continuous integration processes, while also standardizing the project's pyproject.toml configuration. This change aims to streamline workflows and reduce reliance on Poetry-specific tooling, ensuring a more modern and performant dependency management approach.

Highlights

Migration to uv: The project's Python dependency management has been migrated from Poetry to uv.
Standardized pyproject.toml: The pyproject.toml file has been updated to use standard project metadata and dependency groups, aligning with PEP 621.
Updated Tooling Commands: All Poetry-specific commands have been replaced with uv equivalents across documentation, Docker configurations, and development scripts.
Performance Improvement: Local environment setup and CI performance are expected to improve significantly due to uv's speed.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Ignored Files

Ignored by pattern: .github/workflows/** (2)
- .github/workflows/ci.yml
- .github/workflows/ci_full.yml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

orca-security-us

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0 0 1 0	View in Orca
Passed	SAST	0 0 0 0	View in Orca
Passed	Secrets	0 0 0 0	View in Orca
Warning	Vulnerabilities	7 3 0 0	View in Orca

🛡️ The following IaC misconfigurations have been detected

	NAME	FILE
	Pip Install Without Pinned Package Version	Dockerfile	View in code

☢️ The following Vulnerabilities (CVEs) have been detected

PACKAGE	FILE	CVE ID	INSTALLED VERSION	FIXED VERSION
deepdiff	./uv.lock	CVE-2025-58367	7.0.1	8.6.1	View in code
deepdiff	./uv.lock	CVE-2026-33155	7.0.1	8.6.2	View in code
mysql-connector-python	./uv.lock	CVE-2024-21272	8.0.29	9.1.0	View in code
orjson	./uv.lock	CVE-2025-67221	3.11.5	3.11.6	View in code
protobuf	./uv.lock	CVE-2026-0994	4.25.8	6.33.5, 5.29.6	View in code
pyjwt	./uv.lock	CVE-2026-32597	2.9.0	2.12.0	View in code
pyopenssl	./uv.lock	CVE-2026-27459	25.3.0	26.0.0	View in code
urllib3	./uv.lock	CVE-2025-66418	1.26.20	2.6.0	View in code
urllib3	./uv.lock	CVE-2025-66471	1.26.20	2.6.0	View in code
urllib3	./uv.lock	CVE-2026-21441	1.26.20	2.6.3	View in code

Note: The scan should have failed if no policies were configured in warn-only mode.

gemini-code-assist

Code Review

This pull request successfully migrates the project's tooling from Poetry to uv, which should improve performance for local setup and CI. The changes cover updates to pyproject.toml, CI/Docker configurations, and developer documentation. The migration to the standard [project] table in pyproject.toml is well-executed. I've found one critical issue regarding the definition of dependency groups which will prevent development dependencies from being installed correctly. My review includes a suggestion to align it with uv's recommended practice.

gemini-code-assist · 2026-03-21T02:30:58Z

pyproject.toml

+[project.optional-dependencies]
+preql = ["preql>=0.2.19"]
+mysql = ["mysql-connector-python>=8.0.29"]
 postgresql = ["psycopg2"]
 redshift = ["psycopg2"]
-snowflake = ["snowflake-connector-python", "cryptography"]
+snowflake = ["snowflake-connector-python>=3.0.2,<4.0.0", "cryptography"]
 presto = ["presto-python-client"]
 oracle = ["oracledb"]
-mssql = ["pyodbc"]
-# databricks = ["databricks-sql-connector"]
-trino = ["trino"]
+mssql = ["pyodbc>=4.0.39"]
+trino = ["trino>=0.314.0"]
 clickhouse = ["clickhouse-driver"]
 vertica = ["vertica-python"]
 duckdb = ["duckdb"]
 all-dbs = [
-    "preql", "mysql-connector-python", "psycopg2", "snowflake-connector-python", "cryptography", "presto-python-client",
-    "oracledb", "pyodbc", "trino", "clickhouse-driver", "vertica-python", "duckdb"
+  "preql>=0.2.19",
+  "mysql-connector-python>=8.0.29",
+  "psycopg2",
+  "snowflake-connector-python>=3.0.2,<4.0.0",
+  "cryptography",
+  "presto-python-client",
+  "oracledb",
+  "pyodbc>=4.0.39",
+  "trino>=0.314.0",
+  "clickhouse-driver",
+  "vertica-python",
+  "duckdb",
 ]

-[tool.poetry.group.dev.dependencies]
-pre-commit = ">=3.5.0"
+[project.scripts]
+data-diff = "data_diff.__main__:main"
+
+[project.urls]
+Repository = "https://github.com/GannettDigital/data-diff"
+
+[dependency-groups]
+dev = [
+  "parameterized",
+  "unittest-parallel",
+  "ruff>=0.1.4",
+  "pre-commit>=3.5.0",
+]
+ci = [
+  "google-cloud-bigquery<3.0.0",
+]


The [dependency-groups] table is not a standard part of pyproject.toml (PEP 621) and is not recognized by uv. To define development or CI dependencies that can be installed with uv sync --extra <group>, they should be moved into [project.optional-dependencies]. This will ensure that commands like uv sync --all-extras correctly install all necessary dependencies for development and CI environments as described in CONTRIBUTING.md.

[project.optional-dependencies] preql = ["preql>=0.2.19"] mysql = ["mysql-connector-python>=8.0.29"] postgresql = ["psycopg2"] redshift = ["psycopg2"] snowflake = ["snowflake-connector-python>=3.0.2,<4.0.0", "cryptography"] presto = ["presto-python-client"] oracle = ["oracledb"] mssql = ["pyodbc>=4.0.39"] trino = ["trino>=0.314.0"] clickhouse = ["clickhouse-driver"] vertica = ["vertica-python"] duckdb = ["duckdb"] all-dbs = [ "preql>=0.2.19", "mysql-connector-python>=8.0.29", "psycopg2", "snowflake-connector-python>=3.0.2,<4.0.0", "cryptography", "presto-python-client", "oracledb", "pyodbc>=4.0.39", "trino>=0.314.0", "clickhouse-driver", "vertica-python", "duckdb", ] dev = [ "parameterized", "unittest-parallel", "ruff>=0.1.4", "pre-commit>=3.5.0", ] ci = [ "google-cloud-bigquery<3.0.0", ] [project.scripts] data-diff = "data_diff.__main__:main" [project.urls] Repository = "https://github.com/GannettDigital/data-diff"

orca-security-us

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0 0 1 0	View in Orca
Passed	SAST	0 0 0 0	View in Orca
Passed	Secrets	0 0 0 0	View in Orca
Warning	Vulnerabilities	5 1 0 0	View in Orca

🛡️ The following IaC misconfigurations have been detected

	NAME	FILE
	Pip Install Without Pinned Package Version	Dockerfile	View in code

☢️ The following Vulnerabilities (CVEs) have been detected

PACKAGE	FILE	CVE ID	INSTALLED VERSION	FIXED VERSION
mysql-connector-python	./uv.lock	CVE-2024-21272	8.0.29	9.1.0	View in code
orjson	./uv.lock	CVE-2025-67221	3.11.5	3.11.6	View in code
pyopenssl	./uv.lock	CVE-2026-27459	25.3.0	26.0.0	View in code
urllib3	./uv.lock	CVE-2025-66418	1.26.20	2.6.0	View in code
urllib3	./uv.lock	CVE-2025-66471	1.26.20	2.6.0	View in code
urllib3	./uv.lock	CVE-2026-21441	1.26.20	2.6.3	View in code

Note: The scan should have failed if no policies were configured in warn-only mode.

kantselovich added 2 commits March 20, 2026 19:26

Issue:32 Switch project to use uv

0e4e697

Merge remote-tracking branch 'origin/master' into uv_switch_35

7ce0c59

orca-security-us bot reviewed Mar 21, 2026

View reviewed changes

kantselovich added the enhancement New feature or request label Mar 21, 2026

gemini-code-assist bot reviewed Mar 21, 2026

View reviewed changes

kantselovich added 3 commits March 20, 2026 19:46

Dependencies fix

01e84f1

Debug ci run

1c90a6e

Remove 3.8 and add 3.12 support for tests

da3790c

orca-security-us bot reviewed Mar 21, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Issue:35 Switch project to use uv#40

Issue:35 Switch project to use uv#40
kantselovich wants to merge 5 commits intomasterfrom
uv_switch_35

kantselovich commented Mar 21, 2026

Uh oh!

gemini-code-assist bot commented Mar 21, 2026

Uh oh!

orca-security-us bot left a comment •

edited

Loading

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Mar 21, 2026

Uh oh!

orca-security-us bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

kantselovich commented Mar 21, 2026

Migrate project tooling from Poetry to uv

Purpose

Scope

Acceptance Criteria

Uh oh!

gemini-code-assist bot commented Mar 21, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

orca-security-us bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Orca Security Scan Summary

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

orca-security-us bot left a comment

Choose a reason for hiding this comment

Orca Security Scan Summary

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

orca-security-us bot left a comment •

edited

Loading