Future of the project

[SMoraisAnsys]

Status update for community (Follow-up from new Maintainer)

With @raimon49's assistance, I have been onboarded as a maintainer of the project. For the sake of transparency, I want to update all the stakeholders (that's you involved in this discussion) and the community (for posterity). As mentioned before I plan to start with purely custodial upkeep. After I have had a chance to attend to the open PRs and related GHIs, I'll triage the rest of the open GHI, and then circle back to this discussion.

🎉 v-5.5.0 Released

Starting with the most significant news: Version 5.5.0 has been released (see the patch notes for more details).

Highlights:

• Multiple bug fixes and stability updates
• Improved support for PEP-639
• Released as a trusted publisher from GitHub with build provenance for supply-chain validation.

A heartfelt thank you to @cdce8p for their valuable contributions!

Maintenance Resilience Improvements and Plans

I have established and updated much of the project's automation into a minimal CI/CD pipeline. This foundational step is essential for ensuring the project remains well-maintained amidst the fast-paced landscape of modern technology trends.

I have addressed a significant portion of the backlog and identified the following candidate areas to focus on for the next few releases in the short-to-mid-term scope:

🔢 In no particular order:

• Improvements in handling non-trivial edge cases (e.g., enhanced handling for unexpected formats as raised in issues Better handling of licenses of pep-0621 based libraries #134, Lowercase files not found #208, and Partial matching goes wrong when partial match #231)
• Code quality enhancements (specifically, transitioning from a single-file monolith to a modular Python package as a prerequisite for items like Calling from within Python #81 and adopting a SOLID design)
• Compliance with Python Standards (e.g., full pyproject.toml compliance, PEP-0621 error compliance, PEP-440 version pinning support, etc.)
• Enhancements to CI/CD features, such as CI-friendly output modes in reference to issue Output dependency graph to identify source of bad license that triggered fails-on. #197 and supply-chain license provenance use-case support
• Development of interfaces for external license databases (e.g., issues Feature Request PEP 503 + PEP 691: License information from PyPi #30, Feature: Check OSS license compatibility #101, and Better handling of licenses of pep-0621 based libraries #134)
• Improvements to CI tests—adding environment caching, build artifacts, and at-scale testing (100+ packages)
• The ability to specify options in pyproject.toml and legacy setup.cfg files

These are broad ideas based on common themes identified in the backlog and my recent review of the codebase. What are your thoughts? Do any of these areas particularly interest you regarding how you use pip-licenses?

• Finally, in the long term, I still plan to continue focusing primarily on reviewing submitted PRs and GHIs, while allowing other interested community members to contribute new features. My focus will remain on maintaining the project effectively.

🙇 Thank you for taking the time to read this update and for your patience during this transition.

---

Original description from @SMoraisAnsys

The pip-licenses project hasn't received any commit to the main branch since multiple months and multiple PRs have been opened in the mean time without being reviewed.

For those who would like to continue using this project, we have forked it and are considering integrating some of the already open pull requests. Our goal is to ensure continuity while incorporating relevant contributions.

Here is a link to the fork: https://github.com/ansys/pip-licenses

[stefan6419846]

Just as a side note: For similar reasons (long announced library functionality) I have been maintaining a fork of this repository for about 1.5 years already as well: https://github.com/stefan6419846/pip-licenses-lib This should include most of the relevant fixes as well, although it completely omits all rendering functionality.

[anmol-aidora]

We at Aidora have also created a fork: https://github.com/aidora-inc/pip-licenses

[GergelyKalmar]

Would it perhaps make sense to create a separate fork under a joint organization to which multiple contributors can commit? It seems there is enough interest, but right now the efforts are quite fragmented. Also, many of the forks don't seem to be on pypi, reducing their usefulness.

[stefan6419846]

In theory, this might be a possible solution, although the preferred solution should still be to keep the original repository alive - maybe by adding a collaborator. Otherwise, everyone has to replace their dependencies. (I am aware that myself having a fork on PyPI for quite some time now contradicts this a bit, but past development has shown that for some features integration into the CLI proved to be challenging.)

[GergelyKalmar]

Sure, if @raimon49 was kind enough to provide maintainer rights to someone else, I agree that it would be a better option.

[johnthagen]

In the short term if @raimon49 is busy with other things, publishing a pip-licenses2 to PyPI that people can use would be great. If this project comes back, that's great, but at least in the meantime we can all rally around a package that can get updates.

That will also make it easy to merge those changes back into this repo if it comes back.

[gedalia]

it looks like @raimon49 has made a total of 3 commits in the last 6 months. Something might have come up in their life, My office also just forked it locally but would be nice not having to do that. Happy to up vote a new consortium that would maintain it and push it to pypi.

[stefan6419846]

Did anyone try to get in touch with the original author directly? The past has shown that this might have more impact due to GitHub notifications just flooding the inbox regularly.

[johnthagen]

@stefan6419846 I reached out to the author directly. I will report back if I get a response.

[johnthagen]

It has been two weeks without a response. I think it's time for a fork and publish to PyPI.