29 of the 100 most-downloaded PyPI projects have a version that names two different code states

Описание и применение

29 из 100 самых скачиваемых проектов PyPI имеют дублирующие версии, указывающие на разные состояния кода. Автор создал инструмент closure-drift для обнаружения таких конфликтов.

Задача

Two release tags can declare the same version while pointing to different code, causing ambiguity for users and tools.

Результат

29 of the 100 most-downloaded PyPI projects had at least one duplicate version tag pointing to different code states.

Рабочий процесс

• 1. Build a tool to compare code states for identical version tags.
• 2. Run the tool on the 100 most-downloaded PyPI projects with public repos.
• 3. Record results: 59 projects had unique versions, 29 had duplicates, 4 had insufficient tags, 8 inconclusive.
• 4. Publish findings and the tool (closure-drift).

Доказательства

Every collision is listed and can be checked by hand. In requests:

I built a small tool to check it and ran it on the 100 most-downloaded PyPI projects with a public repository.

Every collision is listed and can be checked by hand. In requests: $ closure-drift --compare v2.16.0 v2.16.1 DIFFERS UNDER ONE LABEL: both declare 2.16.0, and the code differs in 2 path(s).