{"action":"created","issue":{"url":"https://api.github.com/repos/AuthorizeNet/sdk-python/issues/99","repository_url":"https://api.github.com/repos/AuthorizeNet/sdk-python","labels_url":"https://api.github.com/repos/AuthorizeNet/sdk-python/issues/99/labels{/name}","comments_url":"https://api.github.com/repos/AuthorizeNet/sdk-python/issues/99/comments","events_url":"https://api.github.com/repos/AuthorizeNet/sdk-python/issues/99/events","html_url":"https://github.com/AuthorizeNet/sdk-python/issues/99","id":321785582,"node_id":"MDU6SXNzdWUzMjE3ODU1ODI=","number":99,"title":"Apply Release Engineering and Pin Versions of Required Libraries","user":{"login":"theonewolf","id":522248,"node_id":"MDQ6VXNlcjUyMjI0OA==","avatar_url":"https://avatars2.githubusercontent.com/u/522248?v=4","gravatar_id":"","url":"https://api.github.com/users/theonewolf","html_url":"https://github.com/theonewolf","followers_url":"https://api.github.com/users/theonewolf/followers","following_url":"https://api.github.com/users/theonewolf/following{/other_user}","gists_url":"https://api.github.com/users/theonewolf/gists{/gist_id}","starred_url":"https://api.github.com/users/theonewolf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theonewolf/subscriptions","organizations_url":"https://api.github.com/users/theonewolf/orgs","repos_url":"https://api.github.com/users/theonewolf/repos","events_url":"https://api.github.com/users/theonewolf/events{/privacy}","received_events_url":"https://api.github.com/users/theonewolf/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2018-05-10T02:14:17Z","updated_at":"2018-06-04T14:57:30Z","closed_at":null,"author_association":"NONE","body":"You should explicitly list all required libraries, including `requests`, here:\r\n\r\nhttps://github.com/AuthorizeNet/sdk-python/blob/8eec6ea2941d5c35d08082d77c2b6800fd5192f9/setup.py#L66\r\n\r\nAnd you are being negligent by not specifying versions of each library you use.  If you do not pin versions of libraries, it is unclear what your test cases actually mean when they passed---we do not know what versions of libraries your software works with.\r\n\r\nSince commits are intermittent on this project, I highly recommend you pin the versions so that we don't have to worry about grabbing a new version that breaks your library---and in the worst case silently."},"comment":{"url":"https://api.github.com/repos/AuthorizeNet/sdk-python/issues/comments/394385109","html_url":"https://github.com/AuthorizeNet/sdk-python/issues/99#issuecomment-394385109","issue_url":"https://api.github.com/repos/AuthorizeNet/sdk-python/issues/99","id":394385109,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NDM4NTEwOQ==","user":{"login":"theonewolf","id":522248,"node_id":"MDQ6VXNlcjUyMjI0OA==","avatar_url":"https://avatars2.githubusercontent.com/u/522248?v=4","gravatar_id":"","url":"https://api.github.com/users/theonewolf","html_url":"https://github.com/theonewolf","followers_url":"https://api.github.com/users/theonewolf/followers","following_url":"https://api.github.com/users/theonewolf/following{/other_user}","gists_url":"https://api.github.com/users/theonewolf/gists{/gist_id}","starred_url":"https://api.github.com/users/theonewolf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theonewolf/subscriptions","organizations_url":"https://api.github.com/users/theonewolf/orgs","repos_url":"https://api.github.com/users/theonewolf/repos","events_url":"https://api.github.com/users/theonewolf/events{/privacy}","received_events_url":"https://api.github.com/users/theonewolf/received_events","type":"User","site_admin":false},"created_at":"2018-06-04T14:57:30Z","updated_at":"2018-06-04T14:57:30Z","author_association":"NONE","body":"@predatell safe engineering practices dictate ranges of versions that are inclusive of their bounds, and have undergone full unit + integration testing with the software artifact.\r\n\r\nYour suggestion of `lxml >= 4.0.0` is negligent and dangerous.  What if `5.0.0` introduces breaking API changes?  What if `4.1.0` introduces a **backdoor** into the codebase to steal CC info?  Or even just a plain remote code execution CVE?  We wouldn't want users blindly using that with this project!\r\n\r\nIt is much safer to use a precise range of versions that has been tested with."}}
{"actor":{"display_login":"theonewolf"}}