pip tools 6.0.1

Evaluation criteria

Is this dependency well-maintained?

pip-tools has had 93 releases between 26 September 2012 and 22 June 2021.

pip-tools is supported by the Jazzband "collaborative community to share the responsibility of maintaining Python-based projects".

How secure is this dependency?

Bandit finds no high-priority issues:

cfm@ozymandias{1053}$ bandit -r piptools    [~/Downloads/pip-tools-6.0.1 12:16]
[main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: None
[main]	INFO	running on Python 3.9.6
Run started:2021-09-21 19:16:36.035056

Test results:
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   Location: piptools/repositories/pypi.py:451
   More Info: https://bandit.readthedocs.io/en/latest/plugins/b101_assert_used.html
450	            if handler.name == "console":  # pragma: no branch
451	                assert isinstance(handler, logging.StreamHandler)
452	                handler.stream = log.stream

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   Location: piptools/scripts/compile.py:267
   More Info: https://bandit.readthedocs.io/en/latest/plugins/b101_assert_used.html
266	        # Close the file at the end of the context execution
267	        assert output_file is not None
268	        ctx.call_on_close(safecall(output_file.close_intelligently))

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   Location: piptools/utils.py:60
   More Info: https://bandit.readthedocs.io/en/latest/plugins/b101_assert_used.html
59	        key = req.name
60	    assert isinstance(key, str)
61	    key = key.replace("_", "-").lower()

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   Location: piptools/utils.py:258
   More Info: https://bandit.readthedocs.io/en/latest/plugins/b101_assert_used.html
257	
258	        assert isinstance(option, click.Option)
259	
260	        # Get the latest option name (usually it'll be a long name)
261	        option_long_name = option.opts[-1]

--------------------------------------------------

Code scanned:
	Total lines of code: 2363
	Total lines skipped (#nosec): 3

Run metrics:
	Total issues (by severity):
		Undefined: 0.0
		Low: 4.0
		Medium: 0.0
		High: 0.0
	Total issues (by confidence):
		Undefined: 0.0
		Low: 0.0
		Medium: 0.0
		High: 4.0
Files skipped (0):

How popular is this dependency?

pip-tools has 5.2K GitHub stars as of this review.

Review statement

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Reviewed from:

3b0c7b95e8d3dfb011bb42cb38f356fcf5d0630480462b59c4d0a112b8d90281  pip-tools-6.0.1.tar.gz
-----BEGIN PGP SIGNATURE-----

iQEyBAEBCgAdFiEE8m422wF7k3FrJQXVFKLelAvuBhMFAmFKL8cACgkQFKLelAvu
BhOJ3Qf47AQxmkchkvJkf7GurdmStDPHlwAwN+dAAGL1S7Uc7FAwa4vGfFR4aZjk
kxuYiLLRhOAXak68Rtr8rykUSwjOhul+D35BckCpHbSO3iJzm4Rm0iVcSvYSL9pp
3vcCoqV2OjlxArlKX+BbC3aSWWcpYNx2+ujBmHYVKYdN/SEW+QRXPHsIAB1qehCE
LGdtFQ2eXML+E3OoLpKp9xa39tn0yB2dptBD4lNXtZpvejWQUuKr/C9JEB9Wd1SF
hgy6PDPpKvbWOUpIoy+nKWAGRJAt02X2xQjXICJ3kwo9xx7RZoTuTU3i9hUoqG0f
icpLKBxyjfM2aHIkme0THMEyJ9sn
=U/NS
-----END PGP SIGNATURE-----