-
Notifications
You must be signed in to change notification settings - Fork 44
Description
This package uses setup.py for packaging, which is the old format for packaging Python projects. It is recommended to upgrade packaging to use a pyproject.toml file. Best practices are outlined here: https://packaging.python.org/en/latest/flow/
When installing lob-python without pinning setuptools<81, you will run into a module not found error for pkg_resources because it was removed from newer versions of setuptools. The error will look similar to this one:
UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
Setuptools prior to 78.1.1 just this past year had a CVE: https://nvd.nist.gov/vuln/detail/CVE-2025-47273
This means that at this present time 78.1.1 <= setuptools < 81 are safe and compatible to build lob-python, for now. Eventually though, this will become a problem, especially if there is a CVE that is found that affects setuptools < 81 in the future.
The new best practice for packaging python packages is to use a pyproject.toml file in order to avoid being left behind and publishing the source and wheels to PyPi:
https://packaging.python.org/en/latest/guides/writing-pyproject-toml/