Hacker News Reader

Comment by Alex3917 | Hacker News Reader

> Among all projects, more than 60% use a Django release with one or more known security vulnerabilities. Only 2% are using a secure Django release.

Probably because 95% of projects on GitHub are homework assignments for job interviews that never get updated after they're submitted.

View on HN

I tend not to pin versions. When I generate requirements files, I use pip-chill (disclaimer: I made it) to avoid listing redundant dependencies.

Interesting. To me pip-tools seems like a better fit for this use case, in terms of letting you specify a requirements.in file that gets compiled to a requirement.txt file. This allows you to selectively pin dependencies of other packages if you have some use case for doing so.

Something related that would be nice though is having pip list -o only output dependencies in the requirements.in file if it exists, or else that are primary dependencies.

You can tell it to generate the list without version numbers so you can get a clean requirements.in for pip-tools to compile.

I didn't use to pin versions until last weekend i experienced https://pypi.python.org/pypi/requests going through 15 revs within 3 days.

I say I tend. I never said I never do it. ;-)

My development environment is not pinned. When I set up CI, I do it with bot pinned (as it goes to production) and unpinned (from dev) requirements, both generated using pip-chill.

Agreed. Would be interested to hear what happens when you filter for projects that have had any activity in the last month (say).

Jay (at PyUp) - any idea?

The query I ran against the GitHub dataset has no activity/age/popularity data, just plain requirements files.

I'll write a follow up post on this :)

I'd add in a minimum of 100 or so stars also. Anything less than that is probably a personal project and not a package.

Eh, that would miss my two stars django package then.[1] 100 is steep, and django packages are almost universally titled django-project-name so you could just find repos starting with django- with recent commits

[1] https://github.com/audiolion/django-groups-cache

Awesome, looking forward to it, and nice work on PyUp!

You may be interested in the GHTorrent database on BigQuery:

https://bigquery.cloud.google.com/dataset/ghtorrent-bq:ght

I would also be interested in seeing if a project has any significant amount of stars to filter out "homework assignments" that likely doesn't see any real use.

Really?, i know "professional" projects using django versions seven years old...

One of the companies I work with has been using Django for sites since it was in beta. They are always years behind in releases.

Sometimes you can build a small but profitable business and not do everything right from a technical perspective.

Still, you'd never see the code on a public Github repo.

Reply on news.ycombinator.com