oracle / oracle/oci-python-sdk

remove outdated vendored copies of dependencies: chardet httpsig_cffi idna jwt requests six urllib3

Open
#444 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

SDK
Dominant language
Python
Stars
474
Forks
321
Avg merge
23m
Merged PRs (30d)
4

Description

I note that oci-python-sdk does extensive vendoring/embedding of dependencies and this potentially results in missing bug fixes for users of oci-python-sdk.

https://github.com/oracle/oci-python-sdk/
https://github.com/oracle/oci-python-sdk/tree/master/src/oci/_vendor

As an example, PyPI urllib3 is at version 1.26.9 but the oci-python-sdk vendor directory contains 1.26.4, which is missing several important bug fixes:

https://pypi.org/project/urllib3/#changes

If you hadn't vendored that dependency, users of oci-python-sdk would note that urllib3 is pulled in by oci-python-sdk, scanned the version number, noticed there were updates to fix bugs, reviewed the changes and upgraded to the latest version.

I haven't checked the other vendored dependencies for new releases, but I note the last time the vendored dependencies saw version updates was May 2021, which is almost a year ago, which is a very long time in open source, especially for active projects like requests and urllib3.

A similar class of problem is pinning dependencies, but I see that you have thankfully resolved that, but some of the version ranges are still too restrictive.

https://github.com/oracle/oci-python-sdk/issues/343
https://github.com/oracle/oci-python-sdk/issues/419

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the vendored dependency copies under src/oci/_vendor, focusing on chardet, httpsig_cffi, idna, jwt, requests, six, and urllib3. Check the SDK's dependency metadata and packaging behavior; done means the outdated embedded copies are removed without breaking dependency installation or the SDK.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
tooling
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.