Skip to content

Skylos self-scan ai-defect findings #790

Description

@mcdigman

Skylos with ai-defects scanning itself for project-level findings reports:

  .../Projects/skylos-liveness-pr/pyproject.toml · 2 issues

    █  HIGH  SKY-D225  Hallucinated PyPI dependency version 'inquirer@3.0.3'. Version does not exist in PyPI.
      AI Defect  .../Projects/skylos-liveness-pr/pyproject.toml:74

    █  HIGH  SKY-D225  Hallucinated PyPI dependency version 'ca9@0.1.0'. Version does not exist in PyPI.
      AI Defect  .../Projects/skylos-liveness-pr/pyproject.toml:91
  1. inquirer 3.0.3 is a true positive finding for this rule; that version does exist on npm, but is not a real version on pypi. According to a codex analysis, the nonexistent version number got introduced like so, and also affected flask-cors, but happened to change it to a version number that actually does also exist:

Skylos’s own 3.0.1, 3.0.2, and 3.0.3 release commits mechanically changed the dependency floor to the matching Skylos version.
The decisive bump version 3.0.3 commit changed all of >these together:Skylos 3.0.2 → 3.0.3
inquirer>=3.0.2 → >=3.0.3
flask-cors>=3.0.2 → >=3.0.3

  1. ca9 is the maintainer's own other repo and as far as I can tell the exact version 0.1.0 really does not exist anywhere as a release version, the lowest version is 0.1.1 that I can see. Again it does still resolve, but it might be better to change it to a version number that is real, rather than treating the finding as a false positive.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions