Bug fixes
- Drop the user name and password from a direct URL in freeze output when the scheme holds a digit,
-or., such asstatic-httpors3. Before, pipdeptree printed such a URL as recorded, credentials included. Also drop them when the user name or password holds an@. pipdeptree used to cut the authority at the first@, so the rest of the password showed up as part of the host. The host now starts after the last@, as pip andurllibread it, and an@in the path, query or fragment no longer counts. The same rule applies to the remote of an editable VCS checkout (#809) by @gaborbernat. - Freeze a package as
-ewith the location from aNAME.egg-linkfile only when its metadata is an.egg-infodirectory in the directory that link names. That is the layoutsetup.py developleaves. A link with the package's name used to replace thename==versionpin of any install, such as a.dist-infopackage from a wheel (#813) by @gaborbernat. - Import
platformandjsonfor the running interpreter's query from its standard library and extension module directory alone, so a_wmi.pyor_json.pyin a directory pipdeptree inspects, or on asys.pathnarrowed beforepipdeptree.render(), no longer runs in the pipdeptree process (#823) by @gaborbernat. - Keep a license that holds a line separator such as U+2028 in one row of the notebook HTML table from
render(summary=True); the table used to split it into extra rows labeled with text from the license (#828) by @gaborbernat. - Look up
git,hg,svnandbzronPATHfrom the directory pipdeptree runs in when freezing an editable install. On Unix the child process changes into the editable project before it searchesPATH, so an empty or relative entry, such as a trailing separator,.or./bin, used to find a program inside that project. A file namedgitorbzrthere then ran in place of the real tool, with the permissions of the user who ran pipdeptree. pipdeptree now resolves the program itself and skips entries without an executable file, as the system lookup does. If no entry holds the tool, freeze reports it as missing. Windows already searched from pipdeptree's own directory and keeps its behavior (#810) by @gaborbernat. - Print a text Graphviz format such as
-o graphviz-svgor-o graphviz-pson a terminal even whendot's output is not valid UTF-8, as with a non-ASCII--metadatavalue in PostScript, instead of writing it to a temporary file and opening that in the default application (#822) by @gaborbernat. - Read at most 1 MiB of output from each
git,hg,svnandbzrcommand that freeze runs for an editable install. Before, pipdeptree kept everything a command printed. A repository config that repeats remote keys through includes madegitprint more than a gigabyte within its timeout, and pipdeptree's memory grew with it. A command that prints more than the limit on stdout or stderr now counts as failed, and freeze prints the record as it does for any other failed VCS command. Closing the pipe at the limit also ends a command that keeps writing, so it no longer runs until its timeout (#819) by @gaborbernat. - Report a
METADATAorPKG-INFOfile that is not a regular file under the missing or invalid metadata warning and skip its package. Headers larger than 16 MiB get the same treatment. A FIFO there made the scan wait for a writer. A link to/dev/zeromade it allocate memory until it aborted (#815) by @gaborbernat. - Spend at most 10 seconds per run on
git,hg,svnandbzrcommands that time out while freezing editable installs. Each record pointing at a stalled repository used to wait out its own 5 second timeout, so four such records took 20 seconds. Commands that finish in time do not count toward the limit. Once a run uses it up, later commands fail without starting, and each record whose lookup timed out gets a# Editable ... install whose lookup timed outcomment instead of the one for an install with no version control or no remote. A timed-outgitlookup still letshg,svnorbzrfind the checkout (#824) by @gaborbernat. - Stop reading
direct_url.jsonandRECORDat the top of a site directory as the files of a package whose metadata is a single.egg-infofile. Freeze output pinned such a package to the URL in thatdirect_url.json.--computed sizecounted the files thatRECORDlists (#812) by @gaborbernat. - Treat an empty
VIRTUAL_ENVorCONDA_PREFIXas unset when detecting the environment to inspect, so pipdeptree no longer runs abin/python(Scripts\python.exeon Windows) found relative to the working directory (#827) by @gaborbernat. - Write each character that stdout's encoding cannot represent as a backslash escape, such as
\xe9foréunderPYTHONIOENCODING=ascii, so package metadata no longer crashes pipdeptree withUnicodeEncodeErrorbefore it prints the tree or its warnings. Output redirected on Windows hit this for any character outside the ANSI code page (#821) by @gaborbernat. from-index --requirementsnow parses a requirements file at most once as requirements and once as constraints, however many-rand-clines include it. It used to parse such a file again for every include path, so a layout that repeats an include at several nesting levels took time multiplied by the repeat count at each level, and the resolver received each requirement once per path (#811) by @gaborbernat.from-index --requirementsnow reports a line it cannot parse as a requirement by file path and line number, for example/work/netrc:2: invalid requirement, instead of the parser message that repeats the line. An include that pointed at a file holding credentials, such as-r ~/.netrc, printed its first unparsable line, password included. Requirements passed on the command line keep the full parser message (#817) by @gaborbernat.from-index --requirementsnow stops withrequirements include nested deeper than 100 levelsand the path of the file at that depth when-rand-cincludes nest more than 100 levels deep. A chain of about 14,000 files used to overflow the stack and kill the process with a segmentation fault and no message (#816) by @gaborbernat.from-indexon Windows now hands a local source to the resolver as a plainC:\...path instead of the\\?\C:\...form, so a project whosepyproject.tomlsetsbackend-path = ["."]can build its metadata. The build frontend joined.to the\\?\path, which Windows does not normalize, and rejected the entry as missing (#826) by @gaborbernat.from-indexon Windows now treatsC:\path\to\projectand.\projectas local sources, on the command line and as requirements file lines, as pip does. It used to pass them to the PEP 508 parser, which rejected them for lacking a package name (#825) by @gaborbernat.
Packaging
- Publish the stable ABI wheel for arm64 macOS again, so CPython 3.11 to 3.14 on Apple Silicon installs a wheel instead of building the sdist. 4.2.10 and 4.2.11 shipped only interpreter-specific wheels there (#829) by @gaborbernat.