-
Notifications
You must be signed in to change notification settings - Fork 67
Chore - Python dependencies management #170
Description
Hi all,
As improvement of the project I would highly encourage the usage of a Python dependency management tool.
This makes sure all the dependencies are controlled and pinned to ensure both stability and repeatability, avoiding unexpected breaking changes and improving overall security (e.g. prevent supply chain flaws, etc.).
I would recommend introducing Poetry, which manages dependencies in the pyproject.toml, locking the dependency graph in poetry.lock file (to be committed).
Moreover, this would enable Dependabot in the repository, to ensure that the repository is both protected with security alerts and kept up to date with dependencies updates.
This is critical to ensure stability, liveness and easier contributions to an open-source project like this.
Opened a discussion here: #161