4 ms·
Ah, wild west package repositories... Only yesterday the developers of Itsdangerous went and deleted their recently-released 1.0.0 version. That's right. Delet
by ris 8y ago
Ah, wild west package repositories...
Only yesterday the developers of Itsdangerous went and deleted their recently-released 1.0.0 version. That's right. Deleted. Gone. Anyone who made the upgrade and for some insane reason were using pip in their release pipeline suddenly had an un-deployable app.
And people complain that they don't want maintainers "getting in the way" between them and developers.
- Terr_ 8y ago> itsdangerous Truth in advertising then.
- ryebit 8y agoThat's one big reason my company deploys everything through a devpi proxy. Not only can I blacklist versions, override with our own patched versions... But can also guarantee if I installed it during testing, it'll be there in production. (Also, updating production isn't affected by pypi / GitHub / etc going down). Devpi has its own design issues, but certainly a reliable and workable solution.
- js2 8y agohttps://github.com/pallets/itsdangerous/issues/112 https://github.com/pallets/itsdangerous/issues/112 > I’m sorry for the inconvenience caused but I missed that there was a signature change that made it into 1.0. I yanked the release now because this change had some very bad consequences and yanking the release is less risky in comparison. Ugh, why not release 1.0.1 with the change reverted? That would be the right thing to do whether 1.0 were yanked or not.
- aidos 8y agoI sounds like mitsuhiko was between a rock and a hard place and had to do damage control to mitigate the situation. Without looking into the details, reverting wasn’t a straightforward option.
- deleted 8y ago[deleted]