Kludex / Kludex/fastapi-dependency

Require release identifier for each package to avoid security issues

Open
#1 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
42
Forks
0
PR merge metrics
No merged PRs in 30d

Description

In light of recent events with NPM it is best practice to tag the release identifier for each package to avoid any security vulnerabilities.

https://threatprotect.qualys.com/2025/09/17/more-than-400-npm-packages-affected-by-the-ongoing-supply-chain-attack/

## Current File

```
-e .

# Linter & Formatter
isort
flake8
black
mypy
pyproject-flake8
pre-commit

# Tests
coverage[toml]
pytest
pytest-sugar
dirty-equals
httpx

# Development
bpython
hatch
```

## Proposed File

```
-e .

# Linter & Formatter
isort==0.0.0
flake8t==0.0.0
blackt==0.0.0
mypyt==0.0.0
pyproject-flake8t==0.0.0
pre-committ==0.0.0

# Tests
coverage[toml]t==0.0.0
pytestt==0.0.0
pytest-sugart==0.0.0
dirty-equalst==0.0.0
httpxt==0.0.0

# Development
bpythont==0.0.0
hatcht==0.0.0
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Review the dependency list in the issue and identify the repository file containing it. Verify the intended package names and release identifiers before changing the entries, then run the listed pytest checks and confirm the dependency installation still succeeds without altering package names.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security, tooling
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.