astral-sh / astral-sh/ruff

new rule - detect uv dev dependencies being used in production code

Open
#6,971 8 comments 6 reactions 0 assignees View on GitHub
needs-decision rule
Dominant language
Rust
Stars
49.6k
Forks
2.4k
Avg merge
2d 1h
Merged PRs (30d)
458

Description

in my project, i was importing from dev dependencies in intended to be used by users of my module:

```py
# public_module.py
from foo import bar
```
```py
# pyproject.toml
[tool.poetry.group.dev.dependencies]
foo = "^1.0.0"
```

because of this, all my tests were passing because the dependency existed, but the moment a user tried to use it, it crashed because the module was not installed.

it would be nice if ruff had a rule to detect this like [this eslint plugin does](https://github.com/import-js/eslint-plugin-import/blob/v2.27.5/docs/rules/no-extraneous-dependencies.md)

Contributor guide

Open the contributing guide

Research direction

Reproduce the example using public_module.py and pyproject.toml, then check how Ruff’s current import rules handle it. Done means Ruff reports production imports whose packages are declared only under [tool.poetry.group.dev.dependencies], without flagging valid imports.

Written by the indexing model from the issue text.

Assessment

Tech stack
python, rust
Domain
devtools, tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
43/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.