Skip to content

fix: declare all direct deps in [tempo] extra, add lazy import guards#105

Merged
brendanjryan merged 7 commits intomainfrom
fix/robust-optional-deps
Apr 1, 2026
Merged

fix: declare all direct deps in [tempo] extra, add lazy import guards#105
brendanjryan merged 7 commits intomainfrom
fix/robust-optional-deps

Conversation

@brendanjryan
Copy link
Copy Markdown
Collaborator

@brendanjryan brendanjryan commented Apr 1, 2026

Problem

The [tempo] extra only declared pytempo and pydantic, relying on transitive deps from pytempo — which is fragile and doesn't guarantee eth-hash[pycryptodome] (the backend extra specifically).

Changes

Dependency declarations

  • Add explicit deps to [tempo] extra: eth-account, eth-hash[pycryptodome], attrs, rlp
  • Remove unused python-dotenv from [server] extra (never imported anywhere in src/)

Lazy import guards

  • mpp.methods.tempo.__init__ and mpp.extensions.mcp.__init__ now use __getattr__ lazy loading
  • Missing extras produce clear messages: Cannot import 'ChargeIntent' ... Install the "tempo" extra: pip install "pympp[tempo]"
  • _attribution.py defers eth_hash.auto.keccak import to function call time instead of module level

brendanjryan and others added 2 commits March 31, 2026 21:04
- Add eth-account, eth-hash[pycryptodome], attrs, rlp to [tempo] extra
- Remove unused python-dotenv from [server] extra
- Add lazy __getattr__ loading to mpp.methods.tempo and mpp.extensions.mcp
  so missing extras produce clear install hints instead of cryptic errors
- Defer eth_hash import in _attribution.py to avoid eager dep loading
- Add py.typed marker and Typing :: Typed classifier
- Add test_optional_deps.py for import isolation validation
- Bump to 0.5.1

Fixes: users having to manually pip install eth_hash attrs pydantic eth_account
@socket-security
Copy link
Copy Markdown

socket-security bot commented Apr 1, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedattrs@​26.1.0100100100100100
Addedeth-account@​0.13.7100100100100100
Addedrlp@​4.1.0100100100100100
Addedeth-hash@​0.8.0100100100100100

View full report

@brendanjryan brendanjryan merged commit e8998dc into main Apr 1, 2026
9 checks passed
@github-actions github-actions bot mentioned this pull request Apr 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant