
Security News
The Nightmare Before Deployment
Season’s greetings from Socket, and here’s to a calm end of year: clean dependencies, boring pipelines, no surprises.
importlab
Advanced tools
Importlab is a library for Python that automatically infers dependencies and calculates a dependency graph. It can perform dependency ordering of a set of files, including cycle detection.
Importlab's main use case is to work with static analysis tools that process one file at a time, ensuring that a file's dependencies are analysed before it is.
(This is not an official Google product.)
Apache 2.0
Importlab can be installed from pip
::
pip install importlab
To check out and install the latest source code
::
git clone https://github.com/google/importlab.git
cd importlab
python setup.py install
Importlab is primarily intended to be used as a library. It takes one or more python files as arguments, and generates an import graph, typically used to process files in dependency order.
It is currently integrated into
pytype <https://github.com/google/pytype>__
Importlab ships with a small command-line tool, also called
importlab, which can display some information about a project's
import graph.
::
usage: importlab [-h] [--tree] [--unresolved] [filename [filename ...]]
positional arguments:
filename input file(s)
optional arguments:
-h, --help show this help message and exit
--tree Display import tree.
--unresolved Display unresolved dependencies.
Makefile generation, to take advantage of make's incremental
update and parallel execution features
Integration with other static analysis tools
FAQs
A library to calculate python dependency graphs.
We found that importlab demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Season’s greetings from Socket, and here’s to a calm end of year: clean dependencies, boring pipelines, no surprises.

Research
/Security News
Impostor NuGet package Tracer.Fody.NLog typosquats Tracer.Fody and its author, using homoglyph tricks, and exfiltrates Stratis wallet JSON/passwords to a Russian IP address.

Security News
Deno 2.6 introduces deno audit with a new --socket flag that plugs directly into Socket to bring supply chain security checks into the Deno CLI.