Should `[python_infer].unowned_dependency_behavior...
# development
b
Should
[python_infer].unowned_dependency_behavior
be mutually exclusive with the new resolve mechanism? The problem it was meant to solve seems to be solved by `enable_resolves`:
Enforces that all transitive dependencies are in the lockfile, whereas constraints allow you to leave off dependencies. This ensures your build is more stable and reduces the risk of supply chain attacks.
h
I don't think so, the error is much more eager with
unowned_dependency_behavior
. Note the difference from direct vs transitive third-party requirements. The new lockfiles will error if any requirement is missing, including transitive.
unowneded_dependency_behavior
only errors on missing direct requirements - that's a good thing, as it's more obvious how to fix that and fixing that should theoretically fix missing third-party
🤔 1
b
Makes sense and fair enough 👍