Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
What's the current version for each biological database?
A daily updated static listing of all current versions (that are incorporated) can be found at https://biopragmatics.github.io/bioversions.
import bioversions
assert bioversions.get_version('biogrid') == '4.2.192', 'This was true on Dec 5th, 2020!'
# If you want more information, use the resolve() function
bioversion = bioversions.resolve('biogrid')
assert bioversion.version == '4.2.192'
By default, the results are cached and only refreshed once per day with the help
of cachier
. The cache is stored in ~/.data/bioversions
. The cache location
can be overridden by setting the
BIOVERSIONS_HOME
environment variable via pystow
.
While https://biopragmatics.github.io/bioversions provides a daily updated static listing of the database, you can run a dynamic version with an API from your shell with:
$ bioversions web
Options can be listed with bioversions web --help
.
You can navigate to http://localhost:5000 to see all versions as HTML or programmatically resolve given databases with
the
http://localhost:5000/database/<name>
endpoint like in the following:
import requests
res = requests.get('http://localhost:5000/database/biogrid').json()
assert res['success']
assert res['result']['name'] == 'BioGRID'
assert res['result']['version'] == '4.2.192', 'This was true on Dec 5th, 2020!'
You can use bioversions get
to incorporate the latest versions in your shell scripts or REPL usage like in:
$ wget "https://downloads.thebiogrid.org/Download/BioGRID/Release-Archive/BIOGRID-$(bioversions get biogrid)/BIOGRID-ALL-$(bioversions get biogrid).mitab.zip"
The most recent release can be installed from PyPI with:
python3 -m pip install bioversions
The most recent code and data can be installed directly from GitHub with:
python3 -m pip install git+https://github.com/biopragmatics/bioversions.git
Contributions, whether filing an issue, making a pull request, or forking, are appreciated. See CONTRIBUTING.md for more information on getting involved.
To add more databases to the list, you can create a new submodule of
bioversions.sources
and extend the bioversions.utils.Getter
class to identify the most recent version for your
target database. See
bioversions.sources.biogrid
as an example.
The code in this package is licensed under the MIT License.
The Bioversions service was originally developed by the INDRA Lab, a part of the Laboratory of Systems Pharmacology and the Harvard Program in Therapeutic Science (HiTS) at Harvard Medical School.
The development of this package was partially funded by the DARPA Young Faculty Award W911NF2010255 (PI: Benjamin M. Gyori).
This package was created with @audreyfeldroy's cookiecutter package using @cthoyt's cookiecutter-snekpack template.
The final section of the README is for if you want to get involved by making a code contribution.
To install in development mode, use the following:
git clone git+https://github.com/biopragmatics/bioversions.git
cd bioversions
python3 -m pip install -e .
This project uses cruft
to keep boilerplate (i.e., configuration, contribution guidelines, documentation
configuration)
up-to-date with the upstream cookiecutter package. Update with the following:
python3 -m pip install cruft
cruft update
More info on Cruft's update command is available here.
After cloning the repository and installing tox
with
python3 -m pip install tox tox-uv
,
the unit tests in the tests/
folder can be run reproducibly with:
tox -e py
Additionally, these tests are automatically re-run with each commit in a GitHub Action.
The documentation can be built locally using the following:
git clone git+https://github.com/biopragmatics/bioversions.git
cd bioversions
tox -e docs
open docs/build/html/index.html
The documentation automatically installs the package as well as the docs
extra specified in the pyproject.toml
. sphinx
plugins
like texext
can be added there. Additionally, they need to be added to the
extensions
list in docs/source/conf.py
.
The documentation can be deployed to ReadTheDocs using
this guide.
The .readthedocs.yml
YAML file contains all the configuration you'll need.
You can also set up continuous integration on GitHub to check not only that
Sphinx can build the documentation in an isolated environment (i.e., with tox -e docs-test
)
but also that ReadTheDocs can build it too.
Zenodo is a long-term archival system that assigns a DOI to each release of your package.
After these steps, you're ready to go! After you make "release" on GitHub (steps for this are below), you can navigate to https://zenodo.org/account/settings/github/repository/biopragmatics/bioversions to see the DOI for the release and link to the Zenodo record for it.
You only have to do the following steps once.
You have to do the following steps once per machine.
$ uv tool install keyring
$ keyring set https://upload.pypi.org/legacy/ __token__
$ keyring set https://test.pypi.org/legacy/ __token__
Note that this deprecates previous workflows using .pypirc
.
After installing the package in development mode and installing
tox
with python3 -m pip install tox tox-uv
,
run the following from the console:
tox -e finish
This script does the following:
pyproject.toml
, CITATION.cff
, src/bioversions/version.py
,
and docs/source/conf.py
to not have the -dev
suffixuv build
uv publish
.tox -e bumpversion -- minor
after.This will trigger Zenodo to assign a DOI to your release as well.
FAQs
Get the current version for biological databases
We found that bioversions demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.