You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As improvement of the project I would highly encourage the usage of a Python dependency management tool.
This makes sure all the dependencies are controlled and pinned to ensure both stability and repeatability, avoiding unexpected breaking changes and improving overall security (e.g. prevent supply chain flaws, etc.).
I would recommend introducing Poetry, which manages dependencies in the pyproject.toml, locking the dependency graph in poetry.lock file (to be committed).
Moreover, this would enable Dependabot in the repository, to ensure that the repository is both protected with security alerts and kept up to date with dependencies updates.
This is critical to ensure stability, liveness and easier contributions to an open-source project like this.
Hi all,
As improvement of the project I would highly encourage the usage of a Python dependency management tool.
This makes sure all the dependencies are controlled and pinned to ensure both stability and repeatability, avoiding unexpected breaking changes and improving overall security (e.g. prevent supply chain flaws, etc.).
I would recommend introducing Poetry, which manages dependencies in the
pyproject.toml
, locking the dependency graph inpoetry.lock
file (to be committed).Moreover, this would enable Dependabot in the repository, to ensure that the repository is both protected with security alerts and kept up to date with dependencies updates.
This is critical to ensure stability, liveness and easier contributions to an open-source project like this.
Opened a discussion here: #161
The text was updated successfully, but these errors were encountered: