Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

RFC: Pin all dependencies, new package `scancode-toolkit-lib` for use as a library

Aperta
  • Qualcosa non va?
#5,375 1 commento 1 reazione 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 3 giorni

@AyanSinhaMahapatra ci sta già lavorando.

Dal 19/10/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

installation and packaging RFC

Originally suggested by @tdruez in context of use of scancode-toolkit in scancode.io as a library, and as discussed with @pombredanne and other aboutcode maintainers:

We should consider pinning all dependencies in scancode-toolkit, as this fixes a few issues faced by us currently:

  1. pip install scancode-toolkit breaking more often because of a change in scancode dependencies, and often this takes a while to fix and release, requiring additional steps from scancode users installing scancode via pip.

  2. With pip install we are fetching the latest and greatest from pip for our libraries and this isn't the best thing with supply chain attacks and security issues being more common.

  3. Unexpected behaviour changes from updated dependencies which are harder to catch (as we only run a fraction of cor tests on latest from pip) and these can cause performance, quality issues which are hard to detect and fix.

So as a solution, we should:

  1. Pin all dependencies in scancode-toolkit
  2. Start releasing a new library scancode-toolkit-lib which has flexible dependency ranges (as we have in the current scancode-toolkit library)
  3. Also adopt the newer pylock.toml lockfile format
  4. Development installation should still use latest from pip dependencies as a way to catch these issues early, potentially with the new feature in pip 26.0+ --uploaded-prior-to= https://pip.pypa.io/en/latest/user_guide/#filtering-by-upload-time

The reason behind having the default scancode-toolkit having pinned versions, as opposed to the new scancode-toolkit-lib, is having secure defaults, where we are installing a more secure set of dependencies usually with the default and presently used scancode-toolkit library, even at the added cost of slight friction of downstream tools updating their dependency to scancode-toolkit-lib.

Suggestions are welcome on the above and on better possible names for the new library (currently meantioned as: scancode-toolkit-lib)

Lingua principale
Python
Stelle
2.7k
Fork
831
Merge medio
3g 4h
PR unite (30g)
7

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di aboutcode-org/scancode-toolkit

Tutte le issue di aboutcode-org/scancode-toolkit

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.