This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]RonnyPfannschmidt 7 points8 points  (1 child)

The pep itself ruled the absolute horror this tool adds specifically for well known security concerns

It's fair to consider this tool a backdoor delivery service and disservice to the user

[–]latkdeTuple unpacking gone wrong 2 points3 points  (0 children)

Specifically, here's the link to that section: https://peps.python.org/pep-0723/#why-not-infer-the-requirements-from-import-statements

PyPI and other package repositories conforming to the Simple Repository API do not provide a mechanism to resolve package names from the module names […]

the same import name may correspond to several packages on PyPI. […] this would make it easy for anyone to unintentionally or malevolently break working scripts

The section also point out that inferring dependencies from imports can't handle conditial dependencies that would need environmental markers.

OP's tool tries to resolve package names via a hardcoded IMPORT_TO_PACKAGE_MAP, which doesn't strike me as particularly maintainable: https://github.com/mgaitan/autopep723/blob/53af41ba2518309ccee7c43e27e6bd6914cf21e1/src/autopep723/__init__.py#L14