Identify unused production dependencies and avoid a bloated virtual environment.

Fredrik Averpil

Last update: Dec 29, 2022

Related tags

Overview

creosote

Identify unused production dependencies and avoid a bloated virtual environment.

Quickstart

# Install creosote in separate virtual environment
$ pipx install creosote

# Scan virtual environment for unused packages
$ creosote -d pyproject.toml -v .venv -p path/to/folder/**/*.py

# Get help
$ creosote --help

Ambition and history

The idea of a package like this was born from having gotten security vulnerability reports about dependencies (shipped into production) which turned out to not not even be in use.

The goal would be to be able to run this tool in CI, which will catch cases where the developer forgets to remove unused packages. A example of such a case could be when doing refactorings.

This can work well in tandem with flake8 or pylint, which can warn in CI about unused imports.

What's with the name "creosote"?

This library has borrowed its name from the Monty Python scene about Mr. Creosote.

Future improvement ideas

Support nicer inputs for --paths, don't require *.py. Ideally, default the argument to src.
Use toml to parse pyproject.toml
Add tests
Add GitHub Action

Comments

feat(logging): Add porcelain CLI flag
Why is the change needed?

Inspired by git status --porcelain, this flag allows users to specify that they want the output in a terse, parse-able format. Allows for doing something like the following.

creosote --porcelain | xargs poetry remove

How is the need addressed?

Add an optional flag --porcelain.

When that flag is on:

Set logging LEVEL to critical, effectively disabling all logs.

Use a print statement to output a terse output for easy parsing.

What side-effects could the change have?

This was done rather hastily. Maybe I should have refactored the solution. :innocent:
opened by JRasmusBm 6
[dev](deps-dev): Bump flake8-bugbear from 22.1.11 to 22.3.23
Bumps flake8-bugbear from 22.1.11 to 22.3.23.

Release notes

Sourced from flake8-bugbear's releases.

22.3.23

B006 and B008: Detect function calls at any level of the default expression (#239)

B020: Fix comprehension false postives (#238)

Tweak B019 desc (#237)

22.3.20

B022: No arguments passed to contextlib.suppress (#231)

B021: f-string used as docstring. (#230)

B020: ensure loop control variable doesn't overrides iterable it iterates (#220)

B019: check to find cache decorators on class methods (#218)

Fix crash on long empty string (#223)

Commits

c255c1b Update version + Change Log for 22.3.23 release

f9e0f77 B006 and B008: Cover additional test cases (#239)

ea0bd48 Remove long dead Travis Badge with Actions badge (#241)

0e30194 Add Pre-Commit Badge

a4dc2b7 B020: Fix comprehension false postives (#238)

77dc992 Tweak B019 desc (#237)

0069532 Update version + Change Log for 22.3.20 release (#234)

e389294 B022: No arguments passed to contextlib.suppress (#231)

4a92ce5 Add B019 check to find cache decorators on class methods (#218)

83a8227 Remove redundant W503 inline ignores (#233)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies
opened by dependabot[bot] 3
Bump importlib-metadata from 5.1.0 to 5.2.0
Bumps importlib-metadata from 5.1.0 to 5.2.0.

Changelog

Sourced from importlib-metadata's changelog.

v5.2.0

#371: Deprecated expectation that PackageMetadata.__getitem__ will return None for missing keys. In the future, it will raise a KeyError.

Commits

4fe7502 Merge pull request #417 from python/debt/deprecate-getitem-none

880a621 Mark PackageMetadata.__getitem__ as deprecated for missing values. Ref #371.

747e081 Merge https://github.com/jaraco/skeleton

82465b9 Build docs in CI, including sphinx-lint.

7662a60 Merge https://github.com/jaraco/skeleton

c68ac3b Prevent Python 3.12 from blocking checks.

ef52139 Remove unnecessary shebang and encoding header in docs conf.

86a55c8 tox 4 requires a boolean value, so use '1' to FORCE_COLOR. Fixes jaraco/skele...

9708c37 Honor ResourceWarnings. Fixes jaraco/skeleton#73.

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies python
opened by dependabot[bot] 2
[prod](deps): Bump click from 8.0.4 to 8.1.3
Bumps click from 8.0.4 to 8.1.3.

Release notes

Sourced from click's releases.

8.1.3

This is a fix release for the 8.1.0 feature release.

Changes: https://click.palletsprojects.com/en/8.1.x/changes/#version-8-1-3

Milestone: https://github.com/pallets/click/milestone/18?closed=1

8.1.2

This is a fix release for the 8.1.0 feature release.

Changes: https://click.palletsprojects.com/en/8.1.x/changes/#version-8-1-2

Milestone: https://github.com/pallets/click/milestone/17?closed=1

8.1.1

This is a fix release for the 8.1.0 feature release.

Changes: https://click.palletsprojects.com/en/8.1.x/changes/#version-8-1-1

Milestone: https://github.com/pallets/click/milestone/14?closed=1

8.1.0

This is a feature release, which includes new features and removes previously deprecated features. The 8.1.x branch is now the supported bugfix branch, the 8.0.x branch will become a tag marking the end of support for that branch. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades.

Changes: https://click.palletsprojects.com/en/8.1.x/changes/#version-8-1-0

Milestone: https://github.com/pallets/click/milestone/9?closed=1

Changelog

Sourced from click's changelog.

Version 8.1.3

Released 2022-04-28

Use verbose form of typing.Callable for @command and @group. :issue:2255

Show error when attempting to create an option with multiple=True, is_flag=True. Use count instead. :issue:2246

Version 8.1.2

Released 2022-03-31

Fix error message for readable path check that was mixed up with the executable check. :pr:2236

Restore parameter order for Path, placing the executable parameter at the end. It is recommended to use keyword arguments instead of positional arguments. :issue:2235

Version 8.1.1

Released 2022-03-30

Fix an issue with decorator typing that caused type checking to report that a command was not callable. :issue:2227

Version 8.1.0

Released 2022-03-28

Drop support for Python 3.6. :pr:2129

Remove previously deprecated code. :pr:2130

Group.resultcallback is renamed to result_callback.

autocompletion parameter to Command is renamed to shell_complete.

get_terminal_size is removed, use shutil.get_terminal_size instead.

get_os_args is removed, use sys.argv[1:] instead.

Rely on :pep:538 and :pep:540 to handle selecting UTF-8 encoding instead of ASCII. Click's locale encoding detection is removed.

... (truncated)

Commits

9c6f4c8 Merge pull request #2262 from pallets/release-8.1.3

5ec7749 release version 8.1.3

2ac3211 update requirements

5fd87bd Merge pull request #2248 from jreese/8.1.x

daa2d8e disallow use of is_flag and multiple in option

afdfb12 Merge pull request #2256 from Jonxslays/patch/typing-fix

4695370 use verbose Callable for @command and @group

6f35455 start version 8.1.3

4883c93 pre-commit updates latest release branch

0f833b6 update requirements

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies
opened by dependabot[bot] 2
[dev](deps-dev): Bump pytest from 7.0.1 to 7.1.0
Bumps pytest from 7.0.1 to 7.1.0.

Release notes

Sourced from pytest's releases.

7.1.0

pytest 7.1.0 (2022-03-13)

Breaking Changes

#8838: As per our policy, the following features have been deprecated in the 6.X series and are now removed:

pytest._fillfuncargs function.

pytest_warning_captured hook - use pytest_warning_recorded instead.

-k -foobar syntax - use -k 'not foobar' instead.

-k foobar: syntax.

pytest.collect module - import from pytest directly.

For more information consult Deprecations and Removals in the docs.

#9437: Dropped support for Python 3.6, which reached end-of-life at 2021-12-23.

Improvements

#5192: Fixed test output for some data types where -v would show less information.

Also, when showing diffs for sequences, -q would produce full diffs instead of the expected diff.

#9362: pytest now avoids specialized assert formatting when it is detected that the default __eq__ is overridden in attrs or dataclasses.

#9536: When -vv is given on command line, show skipping and xfail reasons in full instead of truncating them to fit the terminal width.

#9644: More information about the location of resources that led Python to raise ResourceWarning{.interpreted-text role="class"} can now be obtained by enabling tracemalloc{.interpreted-text role="mod"}.

See resource-warnings{.interpreted-text role="ref"} for more information.

#9678: More types are now accepted in the ids argument to @pytest.mark.parametrize. Previously only [str]{.title-ref}, [float]{.title-ref}, [int]{.title-ref} and [bool]{.title-ref} were accepted; now [bytes]{.title-ref}, [complex]{.title-ref}, [re.Pattern]{.title-ref}, [Enum]{.title-ref} and anything with a [__name__]{.title-ref} are also accepted.

#9692: pytest.approx{.interpreted-text role="func"} now raises a TypeError{.interpreted-text role="class"} when given an unordered sequence (such as set{.interpreted-text role="class"}).

Note that this implies that custom classes which only implement __iter__ and __len__ are no longer supported as they don't guarantee order.

Bug Fixes

#8242: The deprecation of raising unittest.SkipTest{.interpreted-text role="class"} to skip collection of tests during the pytest collection phase is reverted - this is now a supported feature again.

#9493: Symbolic link components are no longer resolved in conftest paths. This means that if a conftest appears twice in collection tree, using symlinks, it will be executed twice.

... (truncated)

Commits

1dbffcc [pre-commit.ci] auto fixes from pre-commit.com hooks

d53a5fb Prepare release version 7.1.0

d306ec0 Update upcoming trainings (#9744)

3e4c14b Merge pull request #9751 from fabianegli/main

7f924b1 Fix typo in deprecation documentation

4a8f8ad build(deps): Bump django from 4.0.2 to 4.0.3 in /testing/plugins_integration ...

c0fd2d8 build(deps): Bump pytest-asyncio from 0.18.1 to 0.18.2 in /testing/plugins_in...

843e018 Merge pull request #9732 from nicoddemus/9730-toml-failure

bc43d66 [automated] Update plugin list (#9733)

e38d1ca Improve error message for malformed pyproject.toml files

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies
opened by dependabot[bot] 2
chore(deps): update python docker tag to v3.11.1
This PR contains the following updates:

| Package | Update | Change | |---|---|---| | python | minor | 3.10.2 -> 3.11.1 |

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.
opened by renovate[bot] 1
Bump exceptiongroup from 1.0.4 to 1.1.0
Bumps exceptiongroup from 1.0.4 to 1.1.0.

Changelog

Sourced from exceptiongroup's changelog.

Version history

This library adheres to Semantic Versioning 2.0 <http://semver.org/>_.

1.1.0

Backported upstream fix for gh-99553 (custom subclasses of BaseExceptionGroup that also inherit from Exception should not be able to wrap base exceptions)

Moved all initialization code to __new__() (thus matching Python 3.11 behavior)

1.0.4

Fixed regression introduced in v1.0.3 where the code computing the suggestions would assume that both the obj attribute of AttributeError is always available, even though this is only true from Python 3.10 onwards (#43; PR by Carl Friedrich Bolz-Tereick)

1.0.3

Fixed monkey patching breaking suggestions (on a NameError or AttributeError) on Python 3.10 (#41; PR by Carl Friedrich Bolz-Tereick)

1.0.2

Updated type annotations to match the ones in typeshed

1.0.1

Fixed formatted traceback missing exceptions beyond 2 nesting levels of __context__ or __cause__

1.0.0

Fixed AttributeError: 'PatchedTracebackException' object has no attribute '__cause__' on Python 3.10 (only) when a traceback is printed from an exception where an exception group is set as the cause (#33)

Fixed a loop in exception groups being rendered incorrectly (#35)

Fixed the patched formatting functions (format_exception()etc.) not passing the compact=True flag on Python 3.10 like the original functions do

1.0.0rc9

Added custom versions of several traceback functions that work with exception groups even if monkey patching was disabled or blocked

1.0.0rc8

Don't monkey patch anything if sys.excepthook has been altered

... (truncated)

Commits

d6a0c30 Added the release version

a359629 Use new() only for initialization (#52)

1bfa48a [pre-commit.ci] pre-commit autoupdate (#54)

6e0f331 Backported upstream fix for gh-99553 (#51)

f32faa2 Added a better fix for the coveralls <-> coverage compatibility issue

34bcf19 Worked around coveralls's allergy of coverage 7

a50b5d8 [pre-commit.ci] pre-commit autoupdate

6abcee5 Updated tox configuration

6ed0363 [pre-commit.ci] pre-commit autoupdate

3fb346b [pre-commit.ci] pre-commit autoupdate (#47)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies python
opened by dependabot[bot] 1
Bump ruff from 0.0.188 to 0.0.194
Bumps ruff from 0.0.188 to 0.0.194.

Release notes

Sourced from ruff's releases.

v0.0.194

What's Changed

Fix F841 (UnusedVariable) range in except handler by @harupy in charliermarsh/ruff#1367

Improve excepthandler_name_range by @harupy in charliermarsh/ruff#1368

Ignore unused arguments for @overload stubs by @charliermarsh in charliermarsh/ruff#1373

Respect natural ordering for imports by @charliermarsh in charliermarsh/ruff#1374

Add a --fix-only command-line and pyproject.toml option by @charliermarsh in charliermarsh/ruff#1375

Avoid double-extending past the end when showing source by @charliermarsh in charliermarsh/ruff#1377

Add --required-version by @charliermarsh in charliermarsh/ruff#1376

Full Changelog: https://github.com/charliermarsh/ruff/compare/v0.0.193...v0.0.194

v0.0.193

What's Changed

Update CONTRIBUTING.md by @colin99d in charliermarsh/ruff#1344

Add a link to the PyCharm plugin by @charliermarsh in charliermarsh/ruff#1345

Avoid enabling all EM checks at once by @charliermarsh in charliermarsh/ruff#1349

Implement "native literals" check from pyupgrade by @squiddy in charliermarsh/ruff#1350

Bump compatibility to 3.11 by @charliermarsh in charliermarsh/ruff#1352

Add cache-dir to command-line and pyproject.toml by @squiddy in charliermarsh/ruff#1351

Update RustPython to use the correct BinOp location by @harupy in charliermarsh/ruff#1355

Add autofix for W292 [NoNewLineAtEndOfFile] by @Sawbez in charliermarsh/ruff#1354

Don't trigger E721 when comparing with None by @squiddy in charliermarsh/ruff#1356

Fix false-positive in RET504 when referencing globals by @squiddy in charliermarsh/ruff#1358

Fix B025 location by @harupy in charliermarsh/ruff#1360

Add autofix for W605 [InvalidEscapeSequence] by @Sawbez in charliermarsh/ruff#1361

Generate JSON schema for Ruff options by @edgarrmondragon in charliermarsh/ruff#1329

Annotate RUF100 messages with unmatched, disabled, and unknown codes by @charliermarsh in charliermarsh/ruff#1365

New Contributors

@colin99d made their first contribution in charliermarsh/ruff#1344

@Sawbez made their first contribution in charliermarsh/ruff#1354

Full Changelog: https://github.com/charliermarsh/ruff/compare/v0.0.192...v0.0.193

v0.0.192

What's Changed

Add some more repositories to the user list by @charliermarsh in charliermarsh/ruff#1328

Allow unittest methods in flake8-boolean-trap by @charliermarsh in charliermarsh/ruff#1333

Set force-exclude for pre-commit in README by @charliermarsh in charliermarsh/ruff#1337

Extend false-positive list for flake8-boolean-trap by @charliermarsh in charliermarsh/ruff#1338

Respect --force-exclude for files passed via stdin by @charliermarsh in charliermarsh/ruff#1342

Implement "datetime.UTC alias" check from pyupgrade by @squiddy in charliermarsh/ruff#1341

Full Changelog: https://github.com/charliermarsh/ruff/compare/v0.0.191...v0.0.192

v0.0.191

What's Changed

... (truncated)

Commits

28c45eb Remove required versions from pyproject.toml

4dc4591 Run cargo dev commands

5ef8bff Bump version to 0.0.194

2ab8f77 Update command-line help text

8b72f55 Add --required-version (#1376)

1912121 Avoid double-extending past the end when showing source (#1377)

d9355c9 Add a --fix-only command-line and pyproject.toml option (#1375)

ec80d1c Respect natural ordering for imports (#1374)

9bb470c Ignore unused arguments for @overload stubs (#1373)

dca3fcd Improve excepthandler_name_range (#1368)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies python
opened by dependabot[bot] 1
Bump attrs from 22.1.0 to 22.2.0
Bumps attrs from 22.1.0 to 22.2.0.

Release notes

Sourced from attrs's releases.

22.2.0

Highlights

It's been a lot busier than the changelog indicates, but a lot of the work happened under the hood (like some impressive performance improvements). But we've got still one big new feature that's are worthy the holidays:

Fields now have an alias argument that allows you to set the field's name in the generated __init__ method. This is especially useful for those who aren't fans of attrs's behavior of stripping underscores from private attribute names.

Special Thanks

This release would not be possible without my generous sponsors! Thank you to all of you making sustainable maintenance possible! If you would like to join them, go to https://github.com/sponsors/hynek and check out the sweet perks!

Above and Beyond

Variomedia AG (@variomedia), Tidelift (@tidelift), Sentry (@getsentry), HiredScore (@HiredScore), FilePreviews (@filepreviews), and Daniel Fortunov (@asqui).

Maintenance Sustainers

@rzijp, Adam Hill (@adamghill), Dan Groshev (@si14), Tamir Bahar (@tmr232), Adi Roiban (@adiroiban), Magnus Watn (@magnuswatn), David Cramer (@dcramer), Moving Content AG (@moving-content), Stein Magnus Jodal (@jodal), Iwan Aucamp (@aucampia), ProteinQure (@ProteinQure), Jesse Snyder (@jessesnyder), Rivo Laks (@rivol), Thomas Ballinger (@thomasballinger), @medecau, Ionel Cristian Mărieș (@ionelmc), The Westervelt Company (@westerveltco), Philippe Galvan (@PhilippeGalvan), Birk Jernström (@birkjernstrom), Jannis Leidel (@jezdez), Tim Schilling (@tim-schilling), Chris Withers (@cjw296), and Christopher Dignam (@chdsbd).

Not to forget 2 more amazing humans who chose to be generous but anonymous!

Full Changelog

Backwards-incompatible Changes

Python 3.5 is not supported anymore. #988

Deprecations

Python 3.6 is now deprecated and support will be removed in the next release. #1017

Changes

attrs.field() now supports an alias option for explicit __init__ argument names.

Get __init__ signatures matching any taste, peculiar or plain! The PEP 681 compatible alias option can be use to override private attribute name mangling, or add other arbitrary field argument name overrides. #950

attrs.NOTHING is now an enum value, making it possible to use with e.g. typing.Literal. #983

Added missing re-import of attr.AttrsInstance to the attrs namespace. #987

Fix slight performance regression in classes with custom __setattr__ and speedup even more. #991

Class-creation performance improvements by switching performance-sensitive templating operations to f-strings.

You can expect an improvement of about 5% -- even for very simple classes. #995

... (truncated)

Changelog

Sourced from attrs's changelog.

22.2.0 - 2022-12-21

Backwards-incompatible Changes

Python 3.5 is not supported anymore. #988

Deprecations

Python 3.6 is now deprecated and support will be removed in the next release. #1017

Changes

attrs.field() now supports an alias option for explicit __init__ argument names.

Get __init__ signatures matching any taste, peculiar or plain! The PEP 681 compatible alias option can be use to override private attribute name mangling, or add other arbitrary field argument name overrides. #950

attrs.NOTHING is now an enum value, making it possible to use with e.g. typing.Literal. #983

Added missing re-import of attr.AttrsInstance to the attrs namespace. #987

Fix slight performance regression in classes with custom __setattr__ and speedup even more. #991

Class-creation performance improvements by switching performance-sensitive templating operations to f-strings.

You can expect an improvement of about 5% -- even for very simple classes. #995

attrs.has() is now a TypeGuard for AttrsInstance. That means that type checkers know a class is an instance of an attrs class if you check it using attrs.has() (or attr.has()) first. #997

Made attrs.AttrsInstance stub available at runtime and fixed type errors related to the usage of attrs.AttrsInstance in Pyright. #999

On Python 3.10 and later, call abc.update_abstractmethods() on dict classes after creation. This improves the detection of abstractness. #1001

attrs's pickling methods now use dicts instead of tuples. That is safer and more robust across different versions of a class. #1009

Added attrs.validators.not_(wrapped_validator) to logically invert wrapped_validator by accepting only values where wrapped_validator rejects the value with a ValueError or TypeError (by default, exception types configurable). #1010

The type stubs for attrs.cmp_using() now have default values. #1027

To conform with PEP 681, attr.s() and attrs.define() now accept unsafe_hash in addition to hash. #1065

Commits

a9960de Prepare 22.2.0

566248a Don't linkcheck tree links

0f62805 Make towncrier marker independent from warning

b9f35eb Fix minor stub issues (#1072)

4ad4ea0 Use MyST-native include

519423d Use MyST-native doctest blocks in all MD

403adab Remove stray file

6957e4a Use new typographic branding in the last rst file, too

1bb2864 Convert examples.rst to md

c1c24cc Convert glossary.rst to md

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies python
opened by dependabot[bot] 1
[dev](deps-dev): Bump types-toml from 0.10.7 to 0.10.8
Bumps types-toml from 0.10.7 to 0.10.8.

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies
opened by dependabot[bot] 1
[dev](deps-dev): Bump pytest from 7.1.1 to 7.1.2
Bumps pytest from 7.1.1 to 7.1.2.

Release notes

Sourced from pytest's releases.

7.1.2

pytest 7.1.2 (2022-04-23)

Bug Fixes

#9726: An unnecessary numpy import inside pytest.approx{.interpreted-text role="func"} was removed.

#9820: Fix comparison of dataclasses with InitVar.

#9869: Increase stacklevel for the NODE_CTOR_FSPATH_ARG deprecation to point to the user's code, not pytest.

#9871: Fix a bizarre (and fortunately rare) bug where the [temp_path]{.title-ref} fixture could raise an internal error while attempting to get the current user's username.

Commits

2f2f1a6 Prepare release version 7.1.2

5c04f3a [7.1.x] Fix wrong log_file docs (#9879)

078733c Merge pull request #9872 from pytest-dev/backport-9871-to-7.1.x

3a7ead6 [7.1.x] fix: move 'import getpass' statement to try-clause

6d75333 [7.1.x] Increase stacklevel to point at user's code (#9870)

ddbb998 [7.1.x] Increase stacklevel to point at user's code

0ec5886 Merge pull request #9855 from pytest-dev/backport-9854-to-7.1.x

f2469fc [7.1.x] Docs: link to easy issues in contributing guide

94ec0f8 Merge pull request #9846 from pytest-dev/backport-9842-to-7.1.x

5ef96fd [7.1.x] fix comparison of dataclasses with InitVar

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies
opened by dependabot[bot] 1
Dependency Dashboard
This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

This repository currently has no open or pending branches.

Detected dependencies

github-actions

.github/workflows/check.yml

actions/checkout v3

actions/setup-python v4

actions/cache v3

actions/checkout v3

actions/setup-python v4

actions/cache v3

.github/workflows/publish.yml

actions/checkout v3

actions/setup-python v4

.github/workflows/test.yml

actions/checkout v3

actions/setup-python v4

actions/cache v3

actions/checkout v3

actions/setup-python v4

poetry

pyproject.toml

distlib ^0.3.4

loguru ^0.6.0

toml ^0.10.2

black *

ruff *

mypy *

pytest *

loguru-mypy *

types-toml *

pyenv

.python-version

python 3.11

[ ] Check this box to trigger a request for Renovate to run again on this repository
opened by renovate[bot] 0
Use NodeVisitor

This is roughly how you can use nodevisitor to be able to detect recursive imports

I've also changed the import to a set, as there might be duplicates.

Note, not tested.

opened by jdahlin 1

Releases(v1.0.3)

v1.0.3(Dec 29, 2022)
Replaced the Poetry build system with the Hatchling build system.

Please note that no functional changes where done to creosote and that this release contains purely internal changes.
Source code(tar.gz)
Source code(zip)
v1.0.2(Dec 26, 2022)
Support Python 3.11.

Source code(tar.gz)
Source code(zip)
v1.0.1(Feb 15, 2022)
Added pypi details

Use Poetry 1.1.13 in CI

Source code(tar.gz)
Source code(zip)
v1.0.0(Feb 15, 2022)

Source code(tar.gz)
Source code(zip)
v0.1.0b1(Feb 15, 2022)
Initial release 🎉

Ready to be tested in the wild!

Source code(tar.gz)
Source code(zip)