Open achimnol opened 4 days ago
This is in no way hardcoded. These lines just mean "pick whatever mypy
is on PATH
", which can easily be changed by changing PATH
.
If you can propose a way to make it configurable, that does not present a significant security risk, I am open to it. Simply providing a config option would mean, that a malicious repo could make you execute malicious code by opening its source files in your editor.
I have multiple Python projects to work on, where each project have distinct configurations:
Technically it is possible to switch PATH using something like direnv, but it becomes quickly cumbersome to do so in Zed, Neovim, VSCode, etc.
Also, the sibling ruff plugin support the custom executable path as mentioned in the PR. Why not adding this? 😉
Another plugin having a security issue does not compel me to include one in mine.
The newest commit contains an option how you can risk your computer without endangering others.
In a monorepo setting using Pantsbuild, various Python tools are installed in separate virtaulenvs like:
dist/export/python/virtualenvs/mypy/3.12.6/bin/mypy
dist/export/python/virtualenvs/ruff/3.12.6/bin/ruff
while the main source tree looks at (while it is also possible to have per-subdir lock files):
dist/export/python/virtualenvs/python-default/3.12.6/bin/python
I can override the
--python-executable
argument passed to mypy for the main virtualenv, but I cannot override themypy
executable path itself. It seems to be hardcoded here:https://github.com/python-lsp/pylsp-mypy/blob/9be427d3346c15e5e7ab331d4a312e5a83477cee/pylsp_mypy/plugin.py#L307-L313
Could we make it something configurable?