Poetry uses Pip, right? Where does setuptools fit? distutils? What are wheels, eggs?... Where does Poetry fit vis-a-vis virtualenv?...
I started a new job last year at a place that has a large percentage of their codebase in Python after many years of working with OO and relatively "modern" PHP. Of course, taking PHP's reputation online to heart, you can imagine my glee! To know that I would soon be working with a language that has a little more respect, clout, and professionalism!
Oh, how wrong I was.
One of the first things I noticed was the package management disaster, along with the virtual environment and local/global package issues. Just shy of a year later, and I'm absolutely flabbergasted that Python doesn't get utterly roasted online for how bad and fragmented some of the tooling is. I could go on about other frustrations I have with the broader Python ecosystem, but I'll just leave it at the point that Python folks shouldn't cast _too_ many stones in the direction of JS or PHP without knowing what the current state of tooling in those languages are.
I'll note that my other complaint is the quality of many open source libraries are a significant step below their counterparts in PHP, Ruby or JS. Django, boto and presumably the data science libraries are top notch, but after that even heavily used projects like celery lack the level of polish that major projects in other languages have.
For example stuff like dependency confusion i.e. public package with potentially malicious code overwriting private package are impossible in Composer by design.
https://twitter.com/seldaek/status/1359417655762055171
But pip, npm and RubyGems failed to protect against dependency confusion. So Apple, Microsoft and dozens of other companies pulled malicious code.
https://medium.com/@alex.birsan/dependency-confusion-4a5d60f...
We are very lucky to have awesome Jordi Boggiano in the PHP ecosystem.
He is doing gods work on Composer and Packgist.
The above works fine. I honestly don't know what poetry adds aside from a different way to invoke the same tools.
Let's says if one of packages that you depend on decided to depend on some third package. The maintainer of that third package decides to stop maintaining it and gives it to someone else. This someone else decides to inject bitcoin mining into the third package.
How will you know with pip that you are not pulling malicious code into production?
This is super common in the DS/ML space, and until recently, pip was actively unhelpful (i see you have numpy version x, let's install version y silently because you definitely hand review all the transitive dependencies before installing a new package).
Otherwise, I have no idea how to handle cross language dependencies well. My guess would be that operating system package managers ought to handle it, but I never tried to work with something like Debian repositories. Judging by what I've heard from other people it's a lot of pain.
If they don't you are expected to have a working C/C++ compiler set up which is definitely not ideal. At least on linux it's often as simple as installing a build-essentials package. No clue what that'd be like on other OSes since I don't use them.
I think my issues are really with pip and it's dependency resolver. Give me conda every day, it may take a while but it handles compiled dependencies and doesn't break my environment without at least telling me.
And yes, I use docker containers now.
Security by "it hasn't happen yet" is not a security.