CycloneDX / CycloneDX/cyclonedx-python-lib

feat(deps)!: make all de/serialization libraries optional

未关闭
#979 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
breaking change dependencies
主要语言
Python
星标
116
派生
67
平均合并
8 天 2 小时
30 天内合并 PR
2

描述

when using this library for validation, i dont need to have the de/serialization dependencies installed.

## goal
make all de/serialization libraries optional

## solution
- make de/serialization dependnecies optional, and installable in an extra called "de/serialization" orsomething
- have a private module that tries to load optional de/serialization libs, and if this fails, then provide stubs.
- runtime shall not use any de/serialization dependencies directly, but use the own optionally loaded ones (see above)

## possible implementation (pseudo)

```py
# file: _opt/serialization.py

__all__ = ['Serializer']

try:
from serializaers import Serializer
except:
# stubs
class Serializer:
def to_json() -> Never:
raise Error('missing serializer, install optional dependnecy "serializaers"')
def from_json() -> Never:
raise Error('missing serializer, install optional dependnecy "serializaers"')
```

```py
# file: models/bom.py

from .._opt.serialization import Serializer

class Bom(Serializer):
...

```

贡献指南

打开贡献指南

调研方向

Start by checking the dependency declarations and the runtime serialization imports, then compare the proposed _opt/serialization.py and models/bom.py entry points. Verify that validation-only usage works without serialization dependencies, while serialization reports the missing optional dependency clearly; test both installed and absent-dependency cases.

由索引模型根据 Issue 内容生成。

评估

技术栈
python
领域
backend
Issue 类型
功能
难度
5/5
预计耗时
一周以上
活跃度
冷清
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。