Update from master - #4
Open
pathcl wants to merge 1757 commits into
Open
Conversation
vinta
force-pushed
the
master
branch
3 times, most recently
from
June 6, 2019 19:56
23abd09 to
40cd98b
Compare
The previous description 'JavaScript Object Signing and Encryption draft implementation' was inaccurate. Authlib is a comprehensive Python library for building OAuth 1.0, OAuth 2.0, and OpenID Connect clients and servers.
- sanic: Remove 'Python 3.6+' version constraint (now requires Python >=3.10 per PyPI metadata) - django-guardian: Remove 'Django 1.2+' version constraint (outdated reference, now requires Python >=3.10 per PyPI metadata)
Python 2 reached end-of-life in January 2020. The 'Python 2/3 compatible' qualifier is no longer relevant and misleading. Updated to match the official repository description.
fix: update chardet description to remove outdated Python 2 reference
fix: update outdated version references in descriptions
Add outlines to AI and Agents (Data Layer)
fix: correct authlib description in Authentication section
The old review-pending-prs command carried a stale copy of CONTRIBUTING.md's rejection rules (100-star bar, "too niche") that contradicted the current shortlist model. This skill screens from the diff only, delegates admission judgment to the audit-the-list skill, then acts on GitHub: merge with section reconcile, AskUserQuestion-gated closes. Co-Authored-By: Claude <noreply@anthropic.com>
Superseded by the rewritten .claude/skills/review-prs/SKILL.md committed just before (9ce2a21); leaving it in place would keep a stale second copy of the PR-review instructions. Co-Authored-By: Claude <noreply@anthropic.com>
Add seleniumbase to Testing — Browser Automation as a challenger (2.86M downloads/month via pepy vs selenium 56.9M; admitted by maintainer decision). Entry placed per Entry Ordering, display name set to the canonical PyPI package name.
Two live review-prs runs surfaced fixes: - Merge conflicts move from the screen-out rules to a local-merge path in the Merge arm; 7/10 PRs conflicted only from the reform's stale bases, and one such PR had already been merged this way. - Target use case is now resolved from the current README instead of stale diff context, since most PR bases no longer match live sections. - Judge gets a third verdict: no fitting use case is a structure question, carried to Act for the maintainer to decide. - Act's Close step gets a batching and checklist note, and the whole step gets an explicit completion criterion after a verdict nearly fell out of the question batches. - Drop the "claude reviewed" label mechanism entirely: the fetch filter, the Park arm, and the labeled-open terminal state. Co-Authored-By: Claude <noreply@anthropic.com>
The "most diffs sit on stale bases" claim was a one-time artifact of the shortlist reform, not a durable fact about future PRs. Reworded to state that diff context lines show the base the PR was written on, which may have changed since, while keeping conflict-to-Merge-arm routing. Co-Authored-By: Claude <noreply@anthropic.com>
Project now requires Python >=3.14; the pin fails live (verified during PR review), and plain uv run / make resolves correctly without it. Co-Authored-By: Claude <noreply@anthropic.com>
Pydantic Services took over stewardship of the stalling httpx under the httpx2 name, Starlette already switched its TestClient, and it hit 144M downloads/month (pepy) within 3 months of first release at Production/Stable v2.12.0. Placed last in the challenger tier behind urllib3 per the downloads-descending ordering rule. Fork format and a rewritten description distinguish it from httpx, whose PyPI summary is identical. Co-Authored-By: Claude <noreply@anthropic.com>
v7 blocks checking out fork PR heads under pull_request_target and workflow_run. Neither workflow here uses those triggers, so the only effect is staying current with the other repos.
Audit of proposed additions from a YouTube video roundup. transitions has not been pushed since 2025-09-11 and crosses the 12-month activity line on 2026-09-11, while python-statemachine is actively developed (pushed 2026-08-17, version 3.2.1 released 2026-08-01) and covers strictly more (SCXML-compliant statecharts, compound and parallel states, history, sync and async). Downloads 1,422,332/month vs transitions 3,137,416/month (pepy.tech, 2026-08-23). Co-Authored-By: Claude <noreply@anthropic.com>
Audit of proposed additions from a YouTube video roundup. Admitted as a challenger: 761,507 downloads/month (pepy.tech, 2026-08-23) already outranks the incumbent prospector (497,880), the repo is active (pushed 2026-08-21, version 7.0.1, Production/Stable) and it has reached 794 stars since being created in January 2024. It fills a real gap: ruff's PLR0912 measures cyclomatic complexity while complexipy measures cognitive complexity, and the two are complementary. Adoption-trajectory evidence is thin, so the challenger tier is a judgment call. Placed last in the subcategory since position marks tier and challengers follow obvious choices. Co-Authored-By: Claude <noreply@anthropic.com>
Obvious choice for physical units and dimensional analysis in Python: 8,647,557 downloads/month (pepy.tech, 2026-08-23), more than twice astropy (3,713,879) and thirty-six times obspy (237,352), 2,781 stars, created 2012, pushed 2026-08-05. PyPI classifier still reads Beta at v0.25.3, treated as stale given fourteen years of history and download scale (judgment call). Listed under Physics and Engineering per maintainer choice over minting a Units and Quantities subcategory. Co-Authored-By: Claude <noreply@anthropic.com>
Material for MkDocs went into maintenance mode on 2025-11-05 and its own team called upstream mkdocs unmaintained since 2024-08 and a supply chain risk; the mkdocs repo was last pushed 2025-10-20. Since mkdocs-material hard-depends on mkdocs, mkdocs' download count is almost entirely mkdocs-material pulling it in (18,360,677/month vs mkdocs-material's 18,167,775/month, ~1% delta), so dropping the redundant direct entry costs little. zensical is a clean replacement with no mkdocs dependency, built by the same Material for MkDocs team, at 1,585,786 downloads/month and 5,540 stars, pushed 2026-08-21. Added as a challenger, placed last below pdoc, keeping the section at 5 of 5. Approved via verdict preview. Co-Authored-By: Claude <noreply@anthropic.com>
Add a Stability Exceptions section to docs/audit-logs.md documenting the zensical override (admitted pre-1.0 to displace a dying mkdocs upstream). Add a matching evidence bullet to CLAUDE.md and AGENTS.md warning that a download count is not automatically independent demand when one listed entry depends on another, using mkdocs / mkdocs-material as the worked example. Both facts were discovered during this sitting and need to persist so the next audit doesn't rediscover them. Co-Authored-By: Claude <noreply@anthropic.com>
…column Standard-library entries rendered "Not on PyPI" in the PyPI Downloads column, which read like missing data rather than a deliberate category — the build already forces downloads to None for them so they never pick up a same-named PyPI backport. They now render a "Stdlib" badge instead, while genuine non-PyPI entries keep "Not on PyPI". The filter tag is renamed to match, so the source-type value, the row filter tag, and the synthetic category heading all read Stdlib now. The literal "Built-in" strings scattered through build.py are routed through the existing BUILTIN_FILTER constant so the label lives in one place. The category page slug stays "built-in" so the public URL /categories/built-in/ does not break. Co-Authored-By: Claude <noreply@anthropic.com>
django.db.models, geodjango, httpx.URL and uv audit were rendering "Not on PyPI" alongside eighteen genuinely standalone projects that simply are not packaged on PyPI, conflating two different reasons for a missing download count. These four entries now carry a "(part of X)" description prefix in README.md, mirroring the existing "(Python standard library)" convention. build.py reads that prefix into a bundled flag that both templates render as a "Bundled" badge. The prefix approach was chosen over a separate data file so README.md stays the single source of content truth, and over inferring from the entry name because geodjango is neither dotted nor spaced and would have been missed. Redundant tail wording was trimmed from the httpx.URL, geodjango and uv audit descriptions now that the prefix names the parent. The new entry format is documented in CONTRIBUTING.md and the vocabulary in CONTEXT.md. Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude <noreply@anthropic.com>
azure-sdk-for-python and google-cloud-python were rendering "Not on PyPI", which is misleading. Both do ship on PyPI, just as many per-service packages (azure-identity, azure-storage-blob, google-cloud-storage, etc.) rather than under the repo name. pypi_name_overrides.json already recorded that distinction in its reason field; those two entries now carry an optional "badge" value that build.py reads into the PyPI Downloads column. The other sixteen no-count entries (cpython, renpy, agent skill repos, etc.) keep "Not on PyPI" since that remains accurate for them. Co-Authored-By: Claude <noreply@anthropic.com>
Keep the docs link inline in the description instead of as the primary entry link, matching the format used by other entries. Co-Authored-By: Claude <noreply@anthropic.com>
Renaming the entry from "uv audit" to "uv-audit" made the name PyPI-shaped: normalize() leaves spaces alone, so "uv audit" failed PYPI_NAME_RE and collect_names skipped it, but "uv-audit" passes, so the next sweep would have queried PyPI for it.
A uv-audit package does exist on PyPI, but it is version 0.1.9 by Alekse Marusich of rocshers, an unrelated third-party tool whose summary ("uv Tool for checking dependencies for vulnerabilities") is close enough to be mistaken for Astral's built-in uv audit subcommand. Without the override the entry would have shown that stranger's download count and lost its Bundled badge.
The sweep now writes uv-audit as NOT_FOUND, which load_downloads skips, so the badge is unaffected.
Co-Authored-By: Claude <noreply@anthropic.com>
The uv-audit bug had no automated guard: pypi_name_overrides.json is a manual registry, so a wrong-package mapping is only caught if someone already suspects it. Two broader checks were measured against the real list and rejected. Checking that PyPI metadata links back to the entry's GitHub repo would not have caught uv-audit, since that package declares no home_page or project_urls, landing it in a 26-entry bucket of packages that simply don't declare a repo (numba, selenium, pyglet, etc.), plus 10 benign cases of orgs moving or splitting bindings. Flagging display-name/repo-name mismatches yields 46 hits, all legitimate python-X-repo-to-X-package pairs, with uv-build sitting among them despite being a real Astral package with the identical shape to uv-audit. What discriminates is the bundled marker itself: a "(part of X)" entry ships inside something else and has no package of its own, so the sweep must never query it. This test walks the real README and requires a null override for every bundled entry whose normalized name is PyPI-shaped. Verified it fails with exactly the uv-audit message when that override is removed, and passes with it restored, across the three current bundled entries with no false positives. It runs offline, fitting the existing network-less CI. Co-Authored-By: Claude <noreply@anthropic.com>
The uv-audit bug has no automatic guard outside the bundled-entry case, so the hazard has to live in the audit process instead. The sweep only queries names matching PYPI_NAME_RE, so a display name with a space is skipped outright; renaming it into a PyPI-shaped name starts it being queried, which is how 'uv audit' became 'uv-audit' and picked up an unrelated third-party package by rocshers. The gotcha tells the auditor to fetch PyPI metadata for any renamed entry and add a null override when the package isn't the linked project. It also records two broader checks that were measured against the full list and rejected, so a future audit doesn't spend time re-proposing them: the repo-backlink check misses this case entirely since uv-audit declares no repo URL, as do 26 legitimate entries, and it flags 10 benign org moves; the name-versus-repo-name check returns 46 hits that are all legitimate, including uv-build with the shape identical to uv-audit. Co-Authored-By: Claude <noreply@anthropic.com>
In the last review-prs run, closing comments were posted to GitHub without the maintainer ever seeing their full text - the AskUserQuestion options carried one-line paraphrases and the actual comment bytes first appeared inside the gh pr close --comment command. The old wording ("AskUserQuestion presenting the draft closing comment") was satisfiable by a summary. The Close arm now prints each draft verbatim in chat (fenced block, PR number as label) before the AskUserQuestion, and the step's completion criterion binds every posted comment to be byte-identical to a printed draft or to the maintainer's custom text.
Co-Authored-By: Claude <noreply@anthropic.com>
PR numbers named in chat during a review-prs run should be clickable so the maintainer can open each PR in the browser while deciding on it. Defines the PR link convention once in the intro and uses it at both chat sites: the closing-comment draft label and the final summary table. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why this framework/library/software/resource is awesome?
A few sentences describing the reason.
Vote for this pull request
Who agrees that this change should be merged could add your reactions (e.g. 👍) to this pull request.