search

Consensys / pythx

A Python library for the MythX smart contract security analysis platform
MIT License
33 stars 12 forks source link

Relax dependency pinning #178

Open spinoch opened 3 years ago

spinoch commented 3 years ago

Description

Currently dependencies are hard-pinned to a specific version. This is usually considered an anti-pattern.

One can relax pinning to soft pinning by allowing a range of versions for dependencies.

spinoch commented 3 years ago

@dmuhs are you still maintaining pythx and mythx-models? I'm trying to create conda packages out of these, which ussually is quite straightforward but given that pythx is hard-pinning to an outdated version of mythx-models this is problematic

spinoch commented 3 years ago

For some context, this is the only dependency that's still missing from conda-forge to get brownie on there

dmuhs commented 3 years ago

@spinoch I'm still maintaining mythx-models, pythx, and the mythx-cli packages. Just not as my day job. 🙂 I'm open to feedback and will start to go through your issues one by one, fixing things up where needed. I'd love to see conda packages for the libraries released. My experience with conda is limited, however, so contributions are much welcomed.

spinoch commented 3 years ago

Thanks @dmuhs . And sorry for the rant. I do appreciate your efforts here

There seems to be an issue between pythx and the latest mythx-models as seen from https://github.com/dmuhs/pythx/pull/172. To prevent unexpected breaking changes at mythx-models, one could have integration tests at mythx-models with pythx (basically, run pythx test suite with the latest mythx-moduls commit)

To deal with the issue of dependency pinning, I'd suggest converting the =='s in the requirements file into >= or ~=, and then checking if anything breaks.

I can take care of the conda packages (mythx-models is already on conda atm). The usability of these conda packages will greatly benefit once dependency pinning loosens as it'd allow much more flexible environments