Post #1054125
2026-03-26 04:28 UTC
@brettcannon Amazing, thank you! Indeed thank you to all the PyPA folks who implemented trusted publishing, thanks to whom napari automagically ticked box 2 after ticking box 1:
https://pypi.org/project/napari/0.7.0/#napari-0.7.0-py3-none-any.whl
and thank you very much for the blog post which made it easy for go check that!
We still use requirements.txt files for our CI constraints, though, so we'll look into migrating to pylock.toml!
Replies (1)
-
@jni@fosstodon.org 2026-03-26 04:31
@brettcannon One thing I'm not clear on: we don't use lock files for "library" use, ie if you pip install napari, you get whatever new version of the dependencies is up there. So this wouldn't help in that scenario, right? Is your assertion that it would have helped people catch on faster, or that we should all be locking our dependencies? (Which I think is generally an antipattern in Python as it leads to mutually incompatible libraries...?)