CycloneDX / CycloneDX/cyclonedx-python-lib

feat(deps)!: make all de/serialization libraries optional

Open
#979 2 comments 0 reactions 0 assignees View on GitHub
breaking change dependencies
Dominant language
Python
Stars
116
Forks
67
Avg merge
8d 2h
Merged PRs (30d)
2

Description

when using this library for validation, i dont need to have the de/serialization dependencies installed.

## goal
make all de/serialization libraries optional

## solution
- make de/serialization dependnecies optional, and installable in an extra called "de/serialization" orsomething
- have a private module that tries to load optional de/serialization libs, and if this fails, then provide stubs.
- runtime shall not use any de/serialization dependencies directly, but use the own optionally loaded ones (see above)

## possible implementation (pseudo)

```py
# file: _opt/serialization.py

__all__ = ['Serializer']

try:
from serializaers import Serializer
except:
# stubs
class Serializer:
def to_json() -> Never:
raise Error('missing serializer, install optional dependnecy "serializaers"')
def from_json() -> Never:
raise Error('missing serializer, install optional dependnecy "serializaers"')
```

```py
# file: models/bom.py

from .._opt.serialization import Serializer

class Bom(Serializer):
...

```

Contributor guide

Open the contributing guide

Research direction

Start by checking the dependency declarations and the runtime serialization imports, then compare the proposed _opt/serialization.py and models/bom.py entry points. Verify that validation-only usage works without serialization dependencies, while serialization reports the missing optional dependency clearly; test both installed and absent-dependency cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.