stubtest (static vs runtime)

rather than

pyrefly coverage check (static only)

So pyrefly is a bean counter. If using mypyc, e.g. black, doesn’t have stubs, then understandable this could be a valid use case.

BUT that is an outlier. Without stubs that removes the usefulness of pyright which catches actual bugs.

static vs runtime matters

Similarly to how test coverage measures how much of a library’s source code is hit by its tests, type coverage measures what percentage of a library’s typables have type annotations.

Errrr no!

type coverage should be how much of the typing has corresponding tests. This is particularly important for stub packages. Which are focused on confirming the advertised typing accurately reflects actual typing.

Hope they didn’t cyber squat the package name.

Listen to Yoda, “Try? Either do or do not! No try there is.”

The correct answer to percentage of a libraries typables having type annotations is either zero or all. This is advertised by the py.typed file. There is no middle ground.

Wtf is wrong with pyrefly authors?

Stub package with naming starting with type- does not follow PEP561.

The convention is types-*.

So yeah, what is type-coverage?!

Tools i recommend:

• rebuff – finds places in code to replace with better algorithms. Wanted a tool to recommend itertools and itertools-more usage, but achieve that. Chosen cuz it’s not Rust.

• typos – fixes typos in both code and docs

• mypy+pyright+stubtest – need all of them. pyright phones home. mypy isn’t enough it misses way too much.

• pretty format YAML

• cyclonedx-bom – create software bill of materials

• pip-licenses – NOTICE.txt and licenses.json Answers question does my toolchain include virus licensed packages?

• interrogate – Any code documentation missing? Does not enforce documentation quality.

• wreck – sync requirements files; otherwise it’s tedious (i’m the author)

• uv and ruff

If it can be helped, don’t want Rust nor nodejs in my toolchain. Recommending to Python coders who are very likely not Rust or node.js experts is malpractice or unethical (call it what you may). If you had a problem with any non-Python packages would be at the mercy of non-Python communities. i’m struggling just with Python community black issue 2514 now you want us to broaden that struggle?

And if people are too dumb or lazy to learn how requirement file hierarchies work, perhaps they shouldn’t be Python coders.

Disclosure: author of wreck

Dependabot got annoying. For logging-strict git repo, turned off dependency graph. Blindly updating mostly nodejs crap is insane, it’s a supply chain attack waiting to happen.

Disclosure: author of logging-strict

The OP mentioned dealing with user input via pydantic. Which acts schema-like. strictyaml does the same for YAML config files where runtime validated against a schema.

And here is why all the other config file formats are dodgy, why-not written by author of strictyaml (not me).

Disclosure: Author of types-strictyaml, logging-strict, pytest-logging-strict, and sphinx-external-toc-strict. So yes i drank the kool-aid, but welcome challenges to preference for YAML config file format over others.

Don’t want individual dependency packages listed within pyproject.toml. Breaks the hierarchical nature of requirements files.

There is only so much enshitification my eyes can endure.

I’m the author of wreck.

lazy imports – ftw!

built-in sentinel – finally

I’m confused once py315 comes out why to stick with any previous version. As author of multiple packages, why would wait for several years before getting the benefits of lazy imports? This is not a rhetorical question, i’m requesting feedback why would you continue to wait?

This point is not clear to me.

Remember back in the day … raw SQL. All the children in unison say, “Woah”!

There is no avoiding the database part: model module, alembic migrations, static type checking, UDF, UDF rtyping, string PRAGMAs/SET|SHOW. And a beautiful config file to link them all!

Database work is very time consuming.

have to reevaluate if async is that important to me or not.

Why would be concerning yourself about that? Should have both [a]sync support throughout. Discussing this shouldn’t even be a topic it should be the norm.

why no one is talking about Django is just rhetorical clickbait title to start a conversation about Django. You are interpreting it literally.

Once the topic of Django is discussed, may lead into the conversation about SQLAlchemy. Then comparing the two. Then complaining about one or the other.

Doubt there will be anyone experienced in both. I can talk about SQLAlchemy, but keep my mouth shut about Django. So enjoy to hear what others have to say about Django.

Let them speak!

Reply to /u/onlinepersona SQLAlchemy crocodile tears.

Really need a layer between SQLAlchemy and FastAPI (or litestar, …). Otherwise would be messing around with SQLAlchemy/alembic internals for years. SQLAlchemy is an incredible time sink without that additional layer.

Created just such a package just never got around to publishing it:

• static type checking throughout
• sync and async support throughout
• alembic support (both async and sync)
• multiple databases. One per config file!
• model built from dotted path of (sqlmodel and sqla mixins) components module
• UDF (user defined functions)
• database settings (PRAGMA, SHOW, SET, …)
• sqlite-[pysqlite|sqlcipher|aiosqlite] and postgresql-[psycopg2|asyncpg] supported
• config does not store the password

Issues:

• retire sqlite-sqlcipher PRAGMA rekey and key. Password in config unsafe
• authentication by pulling from a password manager not implemented
• strict validation of postgresql SHOW/SET keys incomplete

The only thing i don’t like is the naming of the folder, dist. Which is reserved in Python for python -m build. The docs should not be promoting the use of that folder.

Identify where itertools or itertools-more should be used instead.

Found this which is Rust-free

https://pypi.org/project/refurb/

Better question is Iterator or Generator?

Identify where itertools or itertools-more should be used instead.

The later question i don’t have an answer to. If anyone wants to take a crack at it.

Somehow, not by me, the disclosure was deleted. The issues raised have not been addressed. Way to handle it, ignore it. LOL!

So the head in sand approach it is. Or fck off it’s as-is (aka MIT licensed). Either github or the author pulled a MSFT. Unfortunately cannot tell who deleted it.

I feel vindicated. Didn’t get the impression this author can be collaborated with.

These packages aren’t intended to be curl and they shouldn’t be capable of being curl. So it’s unexpected behavior from these packages. The worst that can happen is use in ddos attacks or sabotaging a user’s files by overwriting them.

The package doesn’t alter fs permissions, but can write anywhere that has permission to do so.

Is this not enough?

Also way to go not taking the side of:

• an active member of this community

• someone understanding and in a position to increase browser support for selenium webdrivers

• a coder who’d care and doesn’t suck at coding

So what do you get for the Captain Obvious comment besides being right? A clock is right twice a day. But no dopamine hit from a clock.

A better strategy, would be to ask about how to go about increasing selenium web driver browser support and whether a more flexible package is in the works. Not to defend a hopeless package in dire need of a rewrite. Or to provide the info i ask for about how to go about responsibly disclosing security issues.

Understand your heart is in the right place. Hope you can understand that alone isn’t the only consideration or way to look at this. You can press the issue and still come away with nothing.

rinse wash repeat and still the reflex reaction will remain the same. I’m suggesting trying something else.

Yes. That would be a fair assessment. Don’t disagree with you.

Do you think made the wrong ethical call? My position is the author isn’t a serious person who’ll:

• respond
• know how to deal with a PR
• care

So it’s better to inform anyone happening upon get-gecko-driver and get-chrome-driver and do it ASAP. Which i did.

Lets say wanted to responsibly disclose, for a change, these security issues. For future reference, is there a step to step guide for Python on how to do that.