microsoft / microsoft/component-detection
Python: Dependencies are looked up from incorrect urls
Open
@cobya is already working on this.
Since May 23, 2024.
detector:pip
status:requirements
type:bug
- Dominant language
- C#
- Stars
- 553
- Forks
- 135
- Avg merge
- 20h 58m
- Merged PRs (30d)
- 6
Description
When running component-detection on one of my projects I am seeing output like the following.
[INFO] Getting Python data from https://pypi.org/pypi/pywinpty>=1.1.0/json
[WARN] Received 404 Not Found from https://pypi.org/pypi/pywinpty>=1.1.0/json
[WARN] Dependency Package pywinpty>=1.1.0 not found in Pypi. Skipping package
It seems like component-detection is in some situations passing an incorrect url which contains the version specifier and obviously does not resolve. This seems to happen for transitive dependencies that are constrained to a specific version by some other direct or transitive dependency.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.