Security
- Build a package's
--metadataand--computedsuffix once pertextorrichtree instead of once per line that shows the package, so a long metadata value no longer slows down a tree that repeats the package (#796) by @gaborbernat. - Compute the
--summarymax depth in linear time, counting a dependency cycle as all of its packages, so a dozen packages that require each other no longer stall the command (#793) by @gaborbernat. - Count a
RECORDrow toward--computed sizeand--summaryonly when it resolves to a regular file inside the installation prefix of the site directory, so absolute paths,..segments and symbolic links inRECORDno longer add the size of files elsewhere on the machine (#781) by @gaborbernat. - Drop the user and password from the remote URL of an editable git, hg, svn or bzr checkout in freeze output, as pipdeptree already does for a recorded direct URL (#783) by @gaborbernat.
- Escape backslashes in Graphviz labels, so a package name, version or
--metadatavalue can no longer end its label early and add statements to the DOT source (#777) by @gaborbernat. - Escape package metadata in Mermaid output, so it can no longer add statements to the diagram. Quotes,
#,&,<,>, backticks and control characters in node labels become entity codes, and a package whose canonical name is empty or holds characters other than lowercase letters, digits and-gets apackage_<n>node id (#776) by @gaborbernat. - Keep memory use linear in the size of a
Requires-Distline that requests many extras and that many extras activate; pipdeptree no longer stores one copy of the requested extras per activating extra (#780) by @gaborbernat. - List a package's dependencies once per top-level package in the
text,rich,freezeandjson-treetrees, forward and--reverse, and end each later line for it, and the line that closes a dependency cycle, in(*)("repeated": trueinjson-tree). Tree output now grows with the number of dependency edges instead of the number of paths through them (#798) by @gaborbernat. - Query another interpreter from an empty temporary directory and drop the
''entry thatpython -cputs onsys.path, so modules and.dist-infodirectories in the current directory no longer load during the query or show up as installed packages (#787) by @gaborbernat. - Reject a package
NameorVersionlonger than 255 bytes; pipdeptree leaves out an installed distribution with one as invalid metadata, andfrom-lockstops with an error. Warnings and reverse JSON copy the name once per requirement or edge, so one long name could make pipdeptree write hundreds of megabytes (#794) by @gaborbernat. - Remove the user name and password from index URLs before
from-indexpasses them to Nab, which does not send them, so resolver errors no longer print them (#790) by @gaborbernat. - Replace control characters other than tab with U+FFFD in package names, versions, metadata header values,
direct_url.jsonfields and lock file strings, so a package can no longer send escape sequences to the terminal, cut a Graphviz label short or crash--summary -o rich(#778) by @gaborbernat. - Replace each character that cannot appear in a project name or version with
?in freeze output, so a name or version from a lock file or package metadata can no longer add lines, options or a coding declaration to the requirements file (#800) by @gaborbernat. - Report a
from-lockTOML parse error by line and column with the parser's message, without quoting the line of the file where parsing stopped (#782) by @gaborbernat. - Select a requirement's children and check its version conflict once per edge in
text,richandjson-treeoutput, instead of on every line that shows the edge, so a package required through many lines no longer slows rendering (#797) by @gaborbernat. - Stop
--freezefrom checking whether a local git, hg or bzr remote exists and from resolving its links; pipdeptree writes the remote as afile://URL as configured, so the output no longer shows which paths exist on the host (#785) by @gaborbernat. - Stop
--freezefrom following a symbolic link when it reads an.egg-linkor legacy.svn/entriesfile, and require an integer revision in.svn/entries, so the output can no longer include lines of another file (#786) by @gaborbernat. - Stop
--freezefrom running hooks, aliases or extensions from an editable install's.hg/hgrc; pipdeptree runshgwithHGRCSKIPREPO=1and readspaths.defaultfrom that file as plain text (#791) by @gaborbernat. - Stop
from-indexfrom looking for a Nab workspace above the project it generates in the temporary directory, so anab.tomlorpyproject.tomlthere can no longer add local sources to the resolve; a lone--pyprojectstill finds its workspace (#789) by @gaborbernat. - Stop
from-indexfrom running the build backend of sdists downloaded from the index when the input lists a local or git source. Only listed git sources may build beyond Nab's default, and a listed local source builds as before (#788) by @gaborbernat. - Stop replacing
${NAME}with the value of an environment variable in direct references (name @ url) read from installed metadata and lock files; pipdeptree compares and validates those URLs as written (#784) by @gaborbernat. - Stop the Graphviz
dotprocess after 300 seconds and exit with an error, so a graph that is slow to lay out no longer keeps-o graphviz-<format>waiting with no limit (#775) by @gaborbernat. - Stop tree output (
text,rich,freezeandjson-tree) with an error when a dependency chain nests deeper than 200 levels, where it used to overflow the stack and kill the process, including a Python process that calledpipdeptree.render(). Cycle warnings no longer recurse (#799) by @gaborbernat.