Ways to die

Open source projects can die when maintainers stop responding, pull requests go unreviewed, and releases stall for long periods. Examples include Bulma pull requests with no maintainer response for years and diskcache receiving little follow-up after being hired by OpenAI. A practical workflow for dependency locking uses uv to export a pylock.toml lockfile, with a recommendation to run uv export --format pylock.toml -o pylock.toml. Installing from a pylock.toml lockfile with pip can be done by using -r, since tools treat it like a requirements file. Lifeguard is a static analyzer that detects lazy import incompatibilities and reduces adoption overhead, targeting general use by Python 3.15 final.

"Bulma PRs still from 2023, issues and PRs with no maintainer response for years, last release 1.5 years ago diskcache Similar, got hired by OpenAI, crickets after that"

"Tim Hopper Tim walks through using uv, pip and pdm to create pylock.toml files. Recommendation: use uv export --format pylock.toml -o pylock.toml He also has How to install from a pylock.toml lockfile with pip but the short version is:use -r because tools treat it like a requirements file"

"Lifeguard is a static analyzer to detect Lazy Imports incompatibilities and ease the adoption overhead for Lazy Imports in Python. I'm more excited about lazy imports after my Cutting Python Web App Memory Over 31% experience Some Python patterns depend on imports executing immediately. For example: Module-level side effects - a module that registers a handler or modifies global state at import time will behave differently if that import is deferred. The registry pattern - a module that registers itself (e.g., adding to a global dict) when imported will silently fail to register under Lazy Imports. sys.modules manipulation - code that reads or writes sys.modules assumes prior imports have already executed. Metaclasses and __init_subclass__ - class creation side effects may depend on imports being resolved."

Read at Pythonbytes