Post #1834520
2026-03-26 04:31 UTC
@brettcannon One thing I'm not clear on: we don't use lock files for "library" use, ie if you pip install napari, you get whatever new version of the dependencies is up there. So this wouldn't help in that scenario, right? Is your assertion that it would have helped people catch on faster, or that we should all be locking our dependencies? (Which I think is generally an antipattern in Python as it leads to mutually incompatible libraries...?)
Replies (1)
-
@almar@fosstodon.org 2026-03-26 08:33
@jni @brettcannon That's what I thought as well. I guess the final responsibility if for the end user to make sure their packages are sound, and a lockfile would help there. Though perhaps we library maintainers can play a role by using a lockfile only for CI, and update it regularly to spot upstream compromised packages? Preferably in an automated way?