Enhancement request | | Support for PEP 723 Inline Script Metadata

[yna1]

Description

Enhancement for support of Python PEP 723 (Inline Script Metadata) to improve dependency detection. The inline metadata syntax includes information such as Python version compatibility and a list of dependencies, as shown in the example below.

# /// script
# requires-python = ">=3.11"
# dependencies = [
#   "requests<3",
#   "rich",
# ]
# ///
import requests
from rich.pretty import pprint
resp = requests.get("https://peps.python.org/api/peps.json")
data = resp.json()
pprint([(k, v["title"]) for k, v in data.items()][:10])

PEP 723 Consideration:
Support for PEP 723 would allow the declaration of dependencies directly within the script itself. This feature would require parsing the Python files (at least the first lines to extract metadata), which could potentially impact scanning performance.

References:

https://peps.python.org/pep-0723/

Target

Filesystem

Scanner

Vulnerability

[nikpivkin]

Hi @yna1 !

PEP 723 mentions that the target audience for this proposal is people writing scripts that are not intended for distribution. Also a search for Python files on GitHub that use script metadata returned very few results.

/сс @knqyf263