3 ms·

Mypy 0.900 Released

• remram 5y ago
  > you can explicitly install stub packages, usually called types-<name>. This seems like a very dangerous recommendation. Anybody can publish a types-<popular-lib> package, and a package can run arbitrary code on install. How can the PSF simultaneously refuse to support package namespaces and then write an article like this?
  • roopeshv 5y ago
    FTA: For security reasons, the suggested stubs are limited to only a small subset of manually selected packages that have been verified by the typeshed team. These packages include only stub files and no executable code.
    • remram 5y ago
      Yes but the article doesn't list them. You are encouraging people to type in 'pip install types-aiohttp' if they want types for that library, and took no step to ensure that won't be malicious.