Any thoughts on populating the `dependencies` of a...
# developmentb
bitter-ability-32190
07/28/2022, 1:59 PMAny thoughts on populating the
dependenciespython_requirementbitter-ability-32190
07/28/2022, 1:59 PMCC @hundreds-father-404 and maybe @happy-kitchen-89482
bitter-ability-32190
07/28/2022, 2:13 PMI might even be able to test this out in an in-repo plugin with dep inference 🤔 .
e
enough-analyst-54434
07/28/2022, 2:36 PMThe provenance information is there in the lockfile, you're just looking for better viz tools to see it instead of reading the lock JSON basically?
b
bitter-ability-32190
07/28/2022, 2:37 PMYes AND specifically I want to use Pants'
pathse
enough-analyst-54434
07/28/2022, 2:38 PMOk.
b
bitter-ability-32190
07/28/2022, 2:38 PM"E.g. how many docker images are using this pkg, which has a vulnerability"
e
enough-analyst-54434
07/28/2022, 2:39 PMIt would be great if we could do this more wholistically and JVM, Go, etc. But one at a time works to get things rolling.
âž• 1
h
happy-kitchen-89482
07/28/2022, 4:46 PMYeah I would love it if paths worked here
b
bitter-ability-32190
07/28/2022, 4:47 PMI might hack this locally tomorrow and report back, if nothing pressing comes up
h
happy-kitchen-89482
07/28/2022, 4:47 PMWhat are the unintended consequences of adding the deps though? You'd have to do it transitively, and create a bunch of synthetic
python_requirementhappy-kitchen-89482
07/28/2022, 4:48 PMAnd it would pollute the output of
peeklisthappy-kitchen-89482
07/28/2022, 4:48 PMAnother way to do this would be for lockfiles to participate explicitly in
pathshappy-kitchen-89482
07/28/2022, 4:48 PMI fear the unintended consequences of putting transitive external stuff in the build graph directly