TechPrufer
Get started
Shopify
Shopify logoShopify · Feature trail

Deprecation Management Toolkit

2 posts · Sep 2018 – Jan 2022

What this trail covers

Shopify has developed and enhanced its tools and strategies for managing code deprecations. Initial efforts focused on preventing developers from accidentally using deprecated code and addressing the challenges of complex dependency upgrades. The Deprecation Toolkit was introduced as an open-source Ruby gem that uses a whitelist approach to track and manage deprecations. It allows for gradual fixing of existing deprecations while enforcing stricter rules for new ones. This post details the iteration of this toolkit, including its use in gamifying deprecation fixing and its impact on dependency upgrade processes.

All Shopify trails
  1. Fixing the Dependency Confusion Vulnerability in 600+ Ruby Apps - ShopifyThis post details the development of a Bundler plugin to automate the migration of `Gemfile.lock` files to a newer format without updating gem versions, addressing the dependency confusion vulnerability. It also describes the creation of a CLI tool on top of the CI system to manage large-scale migrations, including environment setup, command execution, and pull request creation. The post highlights collaboration with the Heroku Buildpack team to update their Ruby buildpack and with the Bundler team to improve lockfile regeneration capabilities. Finally, it outlines measures to prevent future vulnerabilities by enforcing the recommended Bundler version in local development and CI.
  2. Introducing the Deprecation Toolkit - ShopifyThis post introduces the Deprecation Toolkit, an open-source Ruby gem that uses a whitelist approach to manage code deprecations. It allows developers to record existing deprecations in YAML files by running test suites and then enforces stricter rules for new deprecations, raising errors when they are introduced. The toolkit helps in gradually fixing existing deprecations and prevents new ones from being introduced, thereby speeding up dependency upgrades and improving codebase health. It also details gamification strategies for fixing deprecations.