Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Python - add support for Poetry and PipEnv #4995

Closed
agmond opened this issue Oct 27, 2022 · 4 comments · Fixed by #5409
Closed

Python - add support for Poetry and PipEnv #4995

agmond opened this issue Oct 27, 2022 · 4 comments · Fixed by #5409

Comments

@agmond
Copy link

agmond commented Oct 27, 2022

Hi,

As more and more modern Python applications start using Poetry or PipEnv for managing their dependencies, please support those packaging tools, in addition to the existing (experimental) support in requirements.txt.

Poetry
Poetry uses a pyproject.toml file to declare on dependencies, and a lock file named poetry.lock.
The dependency specification can be found here.

Examples (taken from Poetry repo):

PipEnv
PipEnv uses Pipfile & Pipfile.lock.

Examples (taken from PipEnv repo):

nerdinand added a commit to nerdinand/DependencyCheck that referenced this issue Nov 5, 2022
jeremylong pushed a commit that referenced this issue Nov 19, 2022
* Add experimental Python Poetry support. Part of #4995

* Fix some copy paste errors in comments

Co-authored-by: Ferdinand Niedermann <nerdinand@users.noreply.github.com>
@jeremylong
Copy link
Owner

The poetry.lock is supported - however, the pyproject.toml is still not supported. This may cause a gap for users of pip>10 (see https://pip.pypa.io/en/stable/reference/build-system/pyproject-toml/).

jeremylong added a commit that referenced this issue Jan 31, 2023
Adds support for Pipefile.lock per #4995
@jeremylong
Copy link
Owner

With #5404 I think we are about as close as we can get to fulfilling this enhancement request. We still do not support pyproject.toml - however, there is insufficient version information to make an analysis meaningful. Should we just add a warning if no lock file is present but we found a pyproject.toml file?

@jeremylong
Copy link
Owner

It looks like pip may also support pyproject.toml: https://pip.pypa.io/en/stable/reference/build-system/pyproject-toml/

@jeremylong
Copy link
Owner

again - sorry how long this one took me to get to. I think we have covered this entirely with the 8.1.0 release (or at least the best we can).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants