Skip to content

Replace toml dependency with tomli #828

@mkniewallner

Description

@mkniewallner

Is your feature request related to a problem? Please describe.
Support for defining bandit options in pyproject.toml was added in #401, using toml library.

toml contributions have been stagnating, and the last commit dates back (at the time of writing) to November 1st, 2020.

tomli library is another library that has multiple advantages over toml:

  • it is well maintained, as can be seen in the contributions graph
  • it supports version 1.0.0 of the TOML specification (toml only supports 0.5.0, as can be seen here and in 1.0 release? uiri/toml#300)
  • PEP 680, which will add a TOML parser to Python 3.11 stdlib, has been accepted, and the code will be based on tomli library, as specified here, so this would be easier to conditionally import either tomli or tomllib based on the Python version, as APIs should be identical
  • a lot of widely used Python projects have switched to it (black, mypy, pytest, pip, ...), for some of the reasons mentioned above, so this would also make the ecosystem more consistent, especially for people that use features of TOML 1.0 in their pyproject.toml

Describe the solution you'd like
Relying on tomli library for parsing options defined in pyproject.toml instead of toml library.

Describe alternatives you've considered
Keep relying on toml for parsing options defined in pyproject.toml.

Additional context
n/a

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions