Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

RFC: Pin all dependencies, new package `scancode-toolkit-lib` for use as a library

Abierto
  • ¿Algo no está bien?
#5,375 1 comentario 1 reacción 1 asignado Ver en GitHub

Los mantenedores suelen responder en 3 días

@AyanSinhaMahapatra ya está trabajando en esto.

Desde el 19/10/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

installation and packaging RFC

Originally suggested by @tdruez in context of use of scancode-toolkit in scancode.io as a library, and as discussed with @pombredanne and other aboutcode maintainers:

We should consider pinning all dependencies in scancode-toolkit, as this fixes a few issues faced by us currently:

  1. pip install scancode-toolkit breaking more often because of a change in scancode dependencies, and often this takes a while to fix and release, requiring additional steps from scancode users installing scancode via pip.

  2. With pip install we are fetching the latest and greatest from pip for our libraries and this isn't the best thing with supply chain attacks and security issues being more common.

  3. Unexpected behaviour changes from updated dependencies which are harder to catch (as we only run a fraction of cor tests on latest from pip) and these can cause performance, quality issues which are hard to detect and fix.

So as a solution, we should:

  1. Pin all dependencies in scancode-toolkit
  2. Start releasing a new library scancode-toolkit-lib which has flexible dependency ranges (as we have in the current scancode-toolkit library)
  3. Also adopt the newer pylock.toml lockfile format
  4. Development installation should still use latest from pip dependencies as a way to catch these issues early, potentially with the new feature in pip 26.0+ --uploaded-prior-to= https://pip.pypa.io/en/latest/user_guide/#filtering-by-upload-time

The reason behind having the default scancode-toolkit having pinned versions, as opposed to the new scancode-toolkit-lib, is having secure defaults, where we are installing a more secure set of dependencies usually with the default and presently used scancode-toolkit library, even at the added cost of slight friction of downstream tools updating their dependency to scancode-toolkit-lib.

Suggestions are welcome on the above and on better possible names for the new library (currently meantioned as: scancode-toolkit-lib)

Lenguaje dominante
Python
Estrellas
2.7k
Forks
831
Merge medio
3 d 4 h
PR fusionados (30 d)
7

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de aboutcode-org/scancode-toolkit

Todos los issues de aboutcode-org/scancode-toolkit

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.