
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
setuptools-declarative-requirements
Advanced tools
setuptools Config Requirements Files SupportThis projects adds the ability for projects using setuptools declarative configuration to specify requirements using requirements files.
Anyway, if you know what you're doing, then this library solves the missing feature of defining requirements using requirements files.
setup.cfgYour setup.cfg should include a section named requirements-files, like:
[requirements-files]
setup_requires = requirements/setup.txt
install_requires = requirements/base.txt
tests_require = requirements/tests.txt
extras_require =
docs = requirements/docs.txt
cli = requirements/cli.txt
For the example shown above, in setup.cfg, add something like:
[options.data_files]
. = requirements/*.txt
Or something like the folowing on your MANIFEST.in:
include requirements/*.txt
Or, if you use setuptools-scm, the requirements files need to be committed to the SCM repo.
pyproject.tomlYour pyproject.toml should also include setuptools-declarative-requirements:
[build-system]
requires = ["setuptools>=50.3.2", "wheel", "setuptools-declarative-requirements"]
build-backend = "setuptools.build_meta"
setup.pySome projects still use a setup.py shim, similar to:
#!/usr/bin/env python
import setuptools
if __name__ == "__main__":
setuptools.setup()
If this is your case, your setup.cfg needs an extra bit of tweak. Make sure you have
setuptools-declarative-requirements in your setup_requires:
[options]
setup_requires =
setuptools>=50.3.2
setuptools-declarative-requirements
The only thing it does is include every non empty line from your requirements files which does
not start with #, -r or --.
FAQs
File support for setuptools declarative setup.cfg
We found that setuptools-declarative-requirements demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.