Skip to content

Implement PEP 751 aka standardized lockfiles #13334

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
1 task done
the-gabe opened this issue Apr 15, 2025 · 1 comment
Open
1 task done

Implement PEP 751 aka standardized lockfiles #13334

the-gabe opened this issue Apr 15, 2025 · 1 comment
Labels
C: lockfile PEP implementation Involves some PEP type: feature request Request for a new feature

Comments

@the-gabe
Copy link

What's the problem this feature will solve?

I am interested in PEP 751 so that developers can leverage the official python pip package manager to install and manage dependencies with strong security assurances.

I'm creating this issue to track the implementation of this matter as I am highly interested in this.

Describe the solution you'd like

pip implementing PEP 751.

Alternative Solutions

.

Additional context

https://peps.python.org/pep-0751/

Code of Conduct
@the-gabe the-gabe added S: needs triage Issues/PRs that need to be triaged type: feature request Request for a new feature labels Apr 15, 2025
@pfmoore
Copy link
Member

pfmoore commented Apr 15, 2025

As pip is a volunteer-based project, contributions are welcome. This is definitely something we want to do, so it's just a matter of someone finding the time to implement it.

@ichard26 ichard26 changed the title Implementation of PEP 751 Implement PEP 751 aka standardized lockfiles Apr 15, 2025
@ichard26 ichard26 added PEP implementation Involves some PEP C: lockfile and removed S: needs triage Issues/PRs that need to be triaged labels Apr 15, 2025
@ndellosa95 ndellosa95 mentioned this issue Apr 16, 2025
Open
@edgarrmondragon edgarrmondragon mentioned this issue Apr 22, 2025
Open
@DevonFulcher DevonFulcher mentioned this issue Apr 22, 2025
Merged
DevonFulcher added a commit to dbt-labs/dbt-mcp that referenced this issue Apr 22, 2025
@DevonFulcher
Pin all dependencies (#84)
c5db08b 
Our current install process is with pip in `install.sh`. `install.sh`
makes for an easy installation process, but using pip can mean that
users can get different installations of dbt-mcp. The best way to fix
this would be to install the app from the `uv.lock` file, not with pip.
However, this would require that users have uv installed. In the future,
we can use [uv
export](https://github.com/astral-sh/uv/issues/12584?utm_source=chatgpt.com)
and install from pylock.toml with pip, but [that isn't supported
yet](pypa/pip#13334). In the meantime, pinning
all dependencies should help provide for a more consistent install.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
C: lockfile PEP implementation Involves some PEP type: feature request Request for a new feature
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@pfmoore @ichard26 @the-gabe