oracle / oracle/oci-python-sdk
remove outdated vendored copies of dependencies: chardet httpsig_cffi idna jwt requests six urllib3
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 474
- Forks
- 321
- Avg merge
- 23m
- Merged PRs (30d)
- 4
Description
I note that oci-python-sdk does extensive vendoring/embedding of dependencies and this potentially results in missing bug fixes for users of oci-python-sdk.
https://github.com/oracle/oci-python-sdk/
https://github.com/oracle/oci-python-sdk/tree/master/src/oci/_vendor
As an example, PyPI urllib3 is at version 1.26.9 but the oci-python-sdk vendor directory contains 1.26.4, which is missing several important bug fixes:
https://pypi.org/project/urllib3/#changes
If you hadn't vendored that dependency, users of oci-python-sdk would note that urllib3 is pulled in by oci-python-sdk, scanned the version number, noticed there were updates to fix bugs, reviewed the changes and upgraded to the latest version.
I haven't checked the other vendored dependencies for new releases, but I note the last time the vendored dependencies saw version updates was May 2021, which is almost a year ago, which is a very long time in open source, especially for active projects like requests and urllib3.
A similar class of problem is pinning dependencies, but I see that you have thankfully resolved that, but some of the version ranges are still too restrictive.
https://github.com/oracle/oci-python-sdk/issues/343
https://github.com/oracle/oci-python-sdk/issues/419
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the vendored dependency copies under src/oci/_vendor, focusing on chardet, httpsig_cffi, idna, jwt, requests, six, and urllib3. Check the SDK's dependency metadata and packaging behavior; done means the outdated embedded copies are removed without breaking dependency installation or the SDK.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- tooling
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100