Support for non-versioned dependencies?
- Dominant language
- Go
- Stars
- 643
- Forks
- 198
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 29
Description
I just noticed that the requirements.txt extractor silently ignores all Python packages listed in `requirements.txt` without a version.
I see in the tests that this is intentional. We have some use cases where returning the package list without versions (and also producing unversioned purls) would be useful. Could this be a configurable behavior?
I'm happy to submit a patch to support this in Python, I just wanted to check if you'd consider it.
Contributor guide
Research direction
Start with the Python requirements.txt extractor and the tests that currently verify unversioned packages are ignored. Determine how extractor behavior is configured, then define the expected handling for unversioned packages and purls; done means the configurable behavior is covered by tests without changing the existing default.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100