Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

RFC: Pin all dependencies, new package `scancode-toolkit-lib` for use as a library

Offen
  • Stimmt etwas nicht?
#5,375 1 Kommentar 1 Reaktion 1 zugewiesene Person Auf GitHub ansehen

Maintainer antworten meist innerhalb von 3 Tagen

@AyanSinhaMahapatra arbeitet bereits daran.

Seit 19.10.2026.

Bewertung

Dieses Issue wurde noch nicht bewertet.

Beschreibung

installation and packaging RFC

Originally suggested by @tdruez in context of use of scancode-toolkit in scancode.io as a library, and as discussed with @pombredanne and other aboutcode maintainers:

We should consider pinning all dependencies in scancode-toolkit, as this fixes a few issues faced by us currently:

  1. pip install scancode-toolkit breaking more often because of a change in scancode dependencies, and often this takes a while to fix and release, requiring additional steps from scancode users installing scancode via pip.

  2. With pip install we are fetching the latest and greatest from pip for our libraries and this isn't the best thing with supply chain attacks and security issues being more common.

  3. Unexpected behaviour changes from updated dependencies which are harder to catch (as we only run a fraction of cor tests on latest from pip) and these can cause performance, quality issues which are hard to detect and fix.

So as a solution, we should:

  1. Pin all dependencies in scancode-toolkit
  2. Start releasing a new library scancode-toolkit-lib which has flexible dependency ranges (as we have in the current scancode-toolkit library)
  3. Also adopt the newer pylock.toml lockfile format
  4. Development installation should still use latest from pip dependencies as a way to catch these issues early, potentially with the new feature in pip 26.0+ --uploaded-prior-to= https://pip.pypa.io/en/latest/user_guide/#filtering-by-upload-time

The reason behind having the default scancode-toolkit having pinned versions, as opposed to the new scancode-toolkit-lib, is having secure defaults, where we are installing a more secure set of dependencies usually with the default and presently used scancode-toolkit library, even at the added cost of slight friction of downstream tools updating their dependency to scancode-toolkit-lib.

Suggestions are welcome on the above and on better possible names for the new library (currently meantioned as: scancode-toolkit-lib)

Vorherrschende Sprache
Python
Sterne
2.7k
Forks
831
Ø Merge
3 T. 4 Std.
Gemergte PRs (30 T.)
7

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus aboutcode-org/scancode-toolkit

Alle Issues in aboutcode-org/scancode-toolkit

Ähnliche Issues

Weitere Issues zu Python

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.