Post #1834521
2026-03-26 08:33 UTC
@jni @brettcannon That's what I thought as well. I guess the final responsibility if for the end user to make sure their packages are sound, and a lockfile would help there.
Though perhaps we library maintainers can play a role by using a lockfile only for CI, and update it regularly to spot upstream compromised packages? Preferably in an automated way?
Replies (1)
-
@jni@fosstodon.org 2026-03-27 10:44
@almar @brettcannon "using a lockfile only for CI" We do this for napari! But we use requirements.txt based constraints, not pylock.toml, so when a version is updated, we kinda just bump it. 😅 (Once a week.) It does mean in most cases we have a built-in cooldown period. But yes, this doesn't really help end users. I think the best thing for users is that uv/pip etc should have cooldown periods by default, and a --unsafe-get-absolute-latest opt-in flag for getting "today's" release.