Skip to content

[Code scan] Legacy setup_requires path can break package metadata builds #140

Description

@njzjz

Source: Codex global repository scan of deepmodeling/dpti at commit b719828.
Project: DeepModeling Agent Code Scan

Problem
setup.py uses legacy setup_requires=['setuptools_scm']. In a current Python 3.13/setuptools environment, python setup.py egg_info tried to fetch/build an egg and failed while importing setuptools_scm with ModuleNotFoundError: No module named 'vcs_versioning'. This can break source distribution or install metadata generation paths that still run setup commands.

Code references

dpti/setup.py

Line 16 in b719828

use_scm_version={'write_to': 'dpti/_version.py'},

dpti/setup.py

Line 17 in b719828

setup_requires=['setuptools_scm'],

- run: python setup.py sdist

Reproduction
Run:

python setup.py egg_info

Expected result
Package metadata generation should use a modern PEP 517/518 build configuration, for example pyproject.toml build requirements, instead of relying on deprecated setup_requires egg fetching.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    Status
    Todo

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions