Skip to content

Build system is outdated, relies on pinning setuptools <81. #218

@duckduckgrayduck

Description

@duckduckgrayduck

This package uses setup.py for packaging, which is the old format for packaging Python projects. It is recommended to upgrade packaging to use a pyproject.toml file. Best practices are outlined here: https://packaging.python.org/en/latest/flow/

When installing lob-python without pinning setuptools<81, you will run into a module not found error for pkg_resources because it was removed from newer versions of setuptools. The error will look similar to this one:
UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.

Setuptools prior to 78.1.1 just this past year had a CVE: https://nvd.nist.gov/vuln/detail/CVE-2025-47273

This means that at this present time 78.1.1 <= setuptools < 81 are safe and compatible to build lob-python, for now. Eventually though, this will become a problem, especially if there is a CVE that is found that affects setuptools < 81 in the future.

The new best practice for packaging python packages is to use a pyproject.toml file in order to avoid being left behind and publishing the source and wheels to PyPi:
https://packaging.python.org/en/latest/guides/writing-pyproject-toml/

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions