Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feat: Support restricting package installation by datetime upper bound #135

Open
notatallshaw opened this issue Jan 4, 2024 · 2 comments

Comments

@notatallshaw
Copy link

notatallshaw commented Jan 4, 2024

Since PEP 700 simple index index API 1.1 and above has supported the field upload-time. It would be useful for many use cases to support restricting what packages are installed by specifying an upper limit on this upload-time.

Particularly because:

  1. Libraries are strongly discouraged from providing upper bounds
  2. Metadata can not be changed once uploaded to PyPI
  3. Leading to the problem: If library A depends on library B and B releases a version that is incompatible with A, then a new version of A can get released that excludes the incompatible version of B, but this can mean that package installer might just backtrack on A and install functionality incompatible versions of A and B even though their metadata doesn't describe it

Therefore installing older requirements can sometimes be significantly helped by adding an upper limit on upload-time.

@wolfv
Copy link
Member

wolfv commented Jan 5, 2024

Is this also how the pypi timemachine works? Would definitely be a cool feature! (https://pypi.org/project/pypi-timemachine/)

@notatallshaw
Copy link
Author

notatallshaw commented Jan 5, 2024

No, pypi timemachine was created before and hasn't been updated since PEP 700.

It uses the PyPI JSON API, which is a non-standard API: https://warehouse.pypa.io/api-reference/json.html. e.g. https://pypi.org/pypi/requests/json

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: No status
Development

No branches or pull requests

2 participants