Using newer versions than 3.8.1 as dependencies in testpypi

[Drummersbrother]

I develop a package that depends on aiohttp>=3.12.14, and i would like to test my package / have CI flows that first push it to testpypi and then only after everything looks good, pushes to normal pypi. However, when using uv it doesn't seem like i can install my package from testpypi, because aiohttp is not updated enough on testpypi ( in fact seems to only have been uploaded there in 2022, version 3.8.1 https://test.pypi.org/project/aiohttp/#history ). (same issue when adding the --index-strategy unsafe-best-match flag)

Is there any way to solve this?

[webknjaz]

That's a uv question 🤷‍♂️. Either ask them or don't use it.

[Dreamsorcerer]

Didn't we discuss publishing to test pypi somewhere though? The linked package doesn't appear to have been uploaded by us though.

[webknjaz]

Wow, I missed that. It looks like the same person also published aiosignal: https://test.pypi.org/user/mnaskret/.

This is exactly why TestPyPI should be used with extreme care. One might end up being exposed to gnarly supply chain attacks through dependency confusion just because they allowed an extra index in their config/command..

We should take over it, or at least take down those untrusted dists. I'll file a request.

[webknjaz]

We should take over it, or at least take down those untrusted dists. I'll file a request.

Done: pypi/support#7517 / pypi/support#7518.