Skip to content

Conversation

nanonyme
Copy link
Contributor

requirements-parser doesn't handle them internally so we need to
extract them from original line. Not handling these results in
unintended things being regarded as dependencies

requirements-parser doesn't handle them internally so we need to
extract them from original line. Not handling these results in
unintended things being regarded as dependencies
@nanonyme nanonyme marked this pull request as draft November 18, 2021 21:56
@nanonyme
Copy link
Contributor Author

This isn't super-secure since it evaluates the trailer as code but it should showcase the problem and be useful as workaround if you review requirements.txt beforehand.

@TingPing
Copy link
Member

Maybe prompt before doing this?

@nanonyme
Copy link
Contributor Author

nanonyme commented Jun 1, 2022

@TingPing it would not work with automatic updates.

@nanonyme
Copy link
Contributor Author

nanonyme commented Jun 1, 2022

Technically right way probably is to use ast module to parse it and interpret the result manually making sure we bail out if something weird is noticed.

@hfiguiere hfiguiere added the pip label Apr 5, 2024
@bbhtt bbhtt added the Need Rebase The PR need rebase before merging label May 8, 2025
@bbhtt bbhtt force-pushed the master branch 2 times, most recently from 8c5a0ec to ea9bfa2 Compare June 4, 2025 06:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Need Rebase The PR need rebase before merging pip

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants