Skip to content

bug: detectExternalDeps does not strip PEP 508 environment markers or inline comments from requirements.txt / pyproject.toml #478

@claude

Description

@claude

The detectExternalDeps function in internal/local/local.go does not handle two common Python dep-spec patterns.

1. PEP 508 environment markers (; separator)

A line like requests; python_version >= "3.0" is processed as:

  • The separator loop strips >= at the marker position, not the package boundary
  • Result added to deps: "requests; python_version" — wrong

For marker-only-< form: Flask; python_version < "3.8" produces "Flask; python_version" — wrong

2. Inline comments

A line like requests # needed for API has no version specifier, so none of the current separators match. The whole string becomes the package name — wrong (pip itself strips inline comments).

Affected locations

  • internal/local/local.go:213-227 — requirements.txt parser
  • internal/local/local.go:291-302 — pyproject.toml single-line array parser
  • internal/local/local.go:315-325 — pyproject.toml multi-line array parser

Missing test coverage

internal/local/local_test.go covers version specifiers, extras, PEP 508 direct URLs, and flags — but has no tests for environment markers or inline comments.

Fix

Prepend ";" and " #" to the separator list at all three parser sites, so everything from those characters onward is stripped. Add test cases for both patterns.

@claude please implement this

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions