Sunset implicit setup.py support (#1992)

Previously if an app had only a `setup.py` file and no Python package
manager files (such as `requirements.txt`, `Pipfile.lock`, `Poetry.lock`
or `uv.lock`), the buildpack would install the project using
`pip install --editable .`

However, this implicit fallback doesn't make sense now that the
buildpack supports multiple package managers, and so has to guess
which package manager to use, and whether to install the project in
editable mode or not.

As such, in #1897 this fallback was deprecated, and is now being sunset.
This also brings the classic Python buildpack's behaviour in line with
the Python CNB.

Apps that only have a `setup.py` file will now need to add an explicit
`requirements.txt` file containing:

```
--editable .
```

GUS-W-19275444.

Author: edmorley

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## [Unreleased]
 
+- Sunset the previously deprecated support for falling back to installing dependencies from a `setup.py` file if no Python package manager files were found. ([#1992](https://github.com/heroku/heroku-buildpack-python/pull/1992))
 
 ## [v324] - 2025-12-09
 

lib/cache.sh

@@ -74,9 +74,8 @@ function cache::restore() {
 				# installed Python packages. For example, if a package entry in a requirements file is
 				# later removed, pip will not uninstall the package. This check can be removed if we
 				# ever switch to only caching pip's HTTP/wheel cache rather than site-packages.
-				# TODO: Remove the `-f` check once the setup.py fallback feature is removed.
 				# TODO: Switch this to using sha256sum like the Pipenv implementation.
-				if [[ -f "${build_dir}/requirements.txt" ]] && ! cmp --silent "${cache_dir}/.heroku/requirements.txt" "${build_dir}/requirements.txt"; then
+				if ! cmp --silent "${cache_dir}/.heroku/requirements.txt" "${build_dir}/requirements.txt"; then
 					cache_invalidation_reasons+=("The contents of requirements.txt changed")
 				fi
 				;;
@@ -202,9 +201,7 @@ function cache::save() {
 	# We continue to use that format so that the file can be read by older buildpack versions.
 	echo "python-${python_full_version}" >"${cache_dir}/.heroku/python-version"
 
-	# TODO: Simplify this once multiple package manager files being found is turned into an
-	# error and the setup.py fallback feature is removed.
-	if [[ "${package_manager}" == "pip" && -f "${build_dir}/requirements.txt" ]]; then
+	if [[ "${package_manager}" == "pip" ]]; then
 		# TODO: Switch this to using sha256sum like the Pipenv implementation.
 		cp "${build_dir}/requirements.txt" "${cache_dir}/.heroku/"
 	elif [[ "${package_manager}" == "pipenv" ]]; then

lib/package_manager.sh

@@ -59,34 +59,6 @@ function package_manager::determine_package_manager() {
 		package_managers_found_display_text+=("uv.lock (uv)")
 	fi
 
-	if ((${#package_managers_found[@]} == 0)) && [[ -f "${build_dir}/setup.py" ]]; then
-		package_managers_found+=(pip)
-		package_managers_found_display_text+=("setup.py (pip)")
-		output::warning <<-EOF
-			Warning: Implicit setup.py file support is deprecated.
-
-			Your app currently only has a setup.py file and no Python
-			package manager files. This means that the buildpack has
-			to guess which package manager you want to use and also
-			whether to install your project in editable mode or not.
-
-			For now, we will use pip to install your dependencies in
-			editable mode, however, this fallback is deprecated and
-			will be removed in the future.
-
-			Please add an explicit package manager file to your app.
-
-			To continue using pip in editable mode, create a new file
-			in the root directory of your app named 'requirements.txt'
-			containing the requirement '--editable .' (without quotes).
-
-			Alternatively, if you wish to switch to another package
-			manager, we highly recommend uv:
-			https://docs.astral.sh/uv/
-		EOF
-		build_data::set_raw "setup_py_only" "true"
-	fi
-
 	local num_package_managers_found=${#package_managers_found[@]}
 
 	case "${num_package_managers_found}" in
@@ -95,6 +67,36 @@ function package_manager::determine_package_manager() {
 			return 0
 			;;
 		0)
+			if [[ -f "${build_dir}/setup.py" ]]; then
+				output::error <<-EOF
+					Error: Implicit setup.py file support has been sunset.
+
+					Your app currently only has a setup.py file and no Python
+					package manager files. This means that the buildpack can't
+					tell which package manager you want to use, and whether to
+					install your project in editable mode or not.
+
+					Previously the buildpack guessed and used pip to install your
+					dependencies in editable mode. However, this fallback was
+					deprecated in September 2025 and has now been sunset.
+
+					You must now add an explicit package manager file to your app,
+					such as a requirements.txt, poetry.lock or uv.lock file.
+
+					To continue using your setup.py file with pip in editable
+					mode, create a new file in the root directory of your app
+					named 'requirements.txt' containing the requirement
+					'--editable .' (without quotes).
+
+					Alternatively, if you wish to switch to another package
+					manager, we recommend uv, since it supports lockfiles, is
+					faster, and is actively maintained by a full-time team:
+					https://docs.astral.sh/uv/
+				EOF
+				build_data::set_string "failure_reason" "package-manager::setup-py-only"
+				exit 1
+			fi
+
 			output::error <<-EOF
 				Error: Couldn't find any supported Python package manager files.
 

lib/pip.sh

@@ -107,15 +107,9 @@ function pip::install_dependencies() {
 	local pip_install_command=(
 		pip
 		install
+		-r requirements.txt
 	)
 
-	# Support for the setup.py fallback is deprecated and will be removed in the future.
-	if [[ -f setup.py && ! -f requirements.txt ]]; then
-		pip_install_command+=(--editable .)
-	else
-		pip_install_command+=(-r requirements.txt)
-	fi
-
 	# Install test dependencies too when the buildpack is invoked via `bin/test-compile` on Heroku CI.
 	# We install both requirements files at the same time to allow pip to resolve version conflicts.
 	if [[ -v INSTALL_TEST && -f requirements-test.txt ]]; then

spec/fixtures/multiple_package_managers/setup.py

@@ -0,0 +1 @@
+# This file tests that the setup.py sunset error is not shown when other package manager files exist.

spec/fixtures/pip_basic/setup.py

@@ -1,2 +1 @@
-# This tests that the setup.py fallback is not used when other package manager files exist.
-raise RuntimeError("setup.py should not be run!")
+# This file tests that the setup.py sunset error is not shown when other package manager files exist.

spec/fixtures/pipenv_basic/setup.py

@@ -1,6 +0,0 @@
-from setuptools import setup
-
-setup(
-  name='test',
-  install_requires=['six'],
-)

spec/fixtures/poetry_basic/setup.py

@@ -49,46 +49,40 @@
     end
   end
 
-  # This case will be turned into an error in the future.
   context 'when there is only a setup.py' do
-    let(:app) { Hatchet::Runner.new('spec/fixtures/setup_py_only') }
+    let(:app) { Hatchet::Runner.new('spec/fixtures/setup_py_only', allow_failure: true) }
 
-    it 'installs packages from setup.py using pip' do
+    it 'fails the build with an informative error message' do
       app.deploy do |app|
-        expect(clean_output(app.output)).to match(Regexp.new(<<~REGEX, Regexp::MULTILINE))
+        expect(clean_output(app.output)).to include(<<~OUTPUT)
           remote: -----> Python app detected
           remote: 
-          remote:  !     Warning: Implicit setup.py file support is deprecated.
+          remote:  !     Error: Implicit setup.py file support has been sunset.
           remote:  !     
           remote:  !     Your app currently only has a setup.py file and no Python
-          remote:  !     package manager files. This means that the buildpack has
-          remote:  !     to guess which package manager you want to use and also
-          remote:  !     whether to install your project in editable mode or not.
+          remote:  !     package manager files. This means that the buildpack can't
+          remote:  !     tell which package manager you want to use, and whether to
+          remote:  !     install your project in editable mode or not.
           remote:  !     
-          remote:  !     For now, we will use pip to install your dependencies in
-          remote:  !     editable mode, however, this fallback is deprecated and
-          remote:  !     will be removed in the future.
+          remote:  !     Previously the buildpack guessed and used pip to install your
+          remote:  !     dependencies in editable mode. However, this fallback was
+          remote:  !     deprecated in September 2025 and has now been sunset.
           remote:  !     
-          remote:  !     Please add an explicit package manager file to your app.
+          remote:  !     You must now add an explicit package manager file to your app,
+          remote:  !     such as a requirements.txt, poetry.lock or uv.lock file.
           remote:  !     
-          remote:  !     To continue using pip in editable mode, create a new file
-          remote:  !     in the root directory of your app named 'requirements.txt'
-          remote:  !     containing the requirement '--editable .' \\(without quotes\\).
+          remote:  !     To continue using your setup.py file with pip in editable
+          remote:  !     mode, create a new file in the root directory of your app
+          remote:  !     named 'requirements.txt' containing the requirement
+          remote:  !     '--editable .' (without quotes).
           remote:  !     
           remote:  !     Alternatively, if you wish to switch to another package
-          remote:  !     manager, we highly recommend uv:
+          remote:  !     manager, we recommend uv, since it supports lockfiles, is
+          remote:  !     faster, and is actively maintained by a full-time team:
           remote:  !     https://docs.astral.sh/uv/
           remote: 
-          remote: -----> Using Python #{DEFAULT_PYTHON_MAJOR_VERSION} specified in .python-version
-          remote: -----> Installing Python #{DEFAULT_PYTHON_FULL_VERSION}
-          remote: -----> Installing pip #{PIP_VERSION}
-          remote: -----> Installing dependencies using 'pip install --editable .'
-          remote:        Obtaining file:///tmp/build_.*
-          remote:        .+
-          remote:        Installing collected packages: six, test
-          remote:        Successfully installed six-.+ test-0.0.0
-          remote: -----> Saving cache
-        REGEX
+          remote:  !     Push rejected, failed to compile Python app.
+        OUTPUT
       end
     end
   end