Skip to content

The template should avoid using poetry export #60

@CiottiGiorgio

Description

@CiottiGiorgio

The Poetry export plugin will soon no longer be a part of the default Poetry install.
This combined with the fact that we are not auditing dev dependencies due to an old (and resolved) issue, suggests that we should just avoid using poetry export.

@daniel-makerx suggests that we could just have poetry run pip-audit.

It will be up to each user of this template to define a strategy about how to deal with dependencies that have vulnerabilities but no available fixes (e.g.: prevent merging PR, use --ignore-vuln, ...).

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions