Skylos with ai-defects scanning itself for project-level findings reports:
.../Projects/skylos-liveness-pr/pyproject.toml · 2 issues
█ HIGH SKY-D225 Hallucinated PyPI dependency version 'inquirer@3.0.3'. Version does not exist in PyPI.
AI Defect .../Projects/skylos-liveness-pr/pyproject.toml:74
█ HIGH SKY-D225 Hallucinated PyPI dependency version 'ca9@0.1.0'. Version does not exist in PyPI.
AI Defect .../Projects/skylos-liveness-pr/pyproject.toml:91
inquirer 3.0.3 is a true positive finding for this rule; that version does exist on npm, but is not a real version on pypi. According to a codex analysis, the nonexistent version number got introduced like so, and also affected flask-cors, but happened to change it to a version number that actually does also exist:
Skylos’s own 3.0.1, 3.0.2, and 3.0.3 release commits mechanically changed the dependency floor to the matching Skylos version.
The decisive bump version 3.0.3 commit changed all of >these together:Skylos 3.0.2 → 3.0.3
inquirer>=3.0.2 → >=3.0.3
flask-cors>=3.0.2 → >=3.0.3
ca9 is the maintainer's own other repo and as far as I can tell the exact version 0.1.0 really does not exist anywhere as a release version, the lowest version is 0.1.1 that I can see. Again it does still resolve, but it might be better to change it to a version number that is real, rather than treating the finding as a false positive.
Skylos with ai-defects scanning itself for project-level findings reports:
inquirer 3.0.3is a true positive finding for this rule; that version does exist on npm, but is not a real version on pypi. According to a codex analysis, the nonexistent version number got introduced like so, and also affectedflask-cors, but happened to change it to a version number that actually does also exist:ca9is the maintainer's own other repo and as far as I can tell the exact version0.1.0really does not exist anywhere as a release version, the lowest version is 0.1.1 that I can see. Again it does still resolve, but it might be better to change it to a version number that is real, rather than treating the finding as a false positive.