Currently, the pyproject.toml file contains both package specific metadata and dependencies (organized into [project] tables, link) and development dependencies and settings for the package (organized into [tools] tables, link). Particulalry, the development dependencies currently masquerade as package extras (which they’re not):

I’m starting to think that it makes much sense to separate the package related dependencies & metadata (the pyproject.toml) from the package’s development dependencies & tools settings (e.g. a develop-requirements.txt and a develop.toml file), in order to avoid leaking dev deps and settings into a published sdist package (related PR #948).

That way, a published sdist package would contain only data required for its installation, and not leak development information.

Hmm… 🤔