docs: clarify dependency-confusion warning refers to --extra-index-url #13611
Conversation
Make the warning in the pip install docs explicitly name --extra-index-url so readers cannot misinterpret which option the warning refers to.
|
Hi @isaacaman, thanks a lot for your contribution to pip! |
|
Hello @sepehr-rs, thanks for the review and for pointing that out. I’ve added a news fragment at news/13609.doc.rst in this branch. Please tell me if you'd like me to do something else. |
Thank you! |
Wow, All checks are green now 🎉 Thanks a lot! |
Great! Now it should be just a matter of waiting for a maintainer to review and give the final approval. |
docs/html/cli/pip_install.rst
Outdated
| will ensure it gets chosen over the private package. | ||
| Using the ``--extra-index-url`` option to search for packages which are | ||
| not in the main repository (for example, private packages) is unsafe. | ||
| This is a class of security issue known as dependency confusion — an |
There was a problem hiding this comment.
Just a quick question, is there a reason you chose to remove the https://azure.microsoft.com/en-us/resources/3-ways-to-mitigate-risk-using-private-package-feeds/ link here?
There was a problem hiding this comment.
I did it accidentally, I'll add it right now.
Co-authored-by: Paul Moore <[email protected]>
This small docs change makes it explicit that the dependency-confusion warning applies to the
--extra-index-urloption. The previous wording ("Using this option...") can be ambiguous in the surrounding examples.No code changes — docs-only fix. Closes #13609.