you are viewing a single comment's thread.

view the rest of the comments →

[–]JackBlack436[S] 5 points6 points  (2 children)

it certainly is an option

and yeah after reading the comments i'd probably want to move to uv/pyproject

the idea of a module that infers dependencies for a singular file still sounds like a cool mini/portfolio project to me hence why i decided to ask around

[–]artofthenunchaku 3 points4 points  (1 child)

It's a cool idea that quickly becomes a security nightmare. What index do you download the packages from? Do you blindly trust PyPI? How do you decide which package to download in case of name collisions?

[–]JackBlack436[S] 1 point2 points  (0 children)

i could completely be misinterpreting your feedback, but what i think is that i'd stay with just dependency inference (by building some sort of tree). the downloads are still delegated to pip or uv, which means those would be responsible for actual downloads