Repository navigation
Security concerns due to lazy-imports package in the python generator #21831
Description
I don't want to be a buzzkill or step on someone's toes. Still, with that change, you are potentially pushing a dependency with nine GitHub stars and two maintainers into millions of micro-services. I'd reconsider...
Originally posted by @Thommy257 in #21486 (comment)
Hi all,
In your latest release, v7.15.0, you included a package called lazy-imports required to run the generated API client code (see #21486). Due to a lack of maintenance and public verification, this package poses a significant security risk. I suggest undoing this change or internalising it into openapi-generator.
Also, this PR probably broke many CI/CD pipelines. And for those that didn't break, many microservices got silently injected with a package not verified by a large open source community.
Activity
Trolldemorted commentedon Sep 5, 2025
Is there a measurable benefit from using
lazy-importsthat would make the supply chain security risk worth it?katrinm86 commentedon Sep 5, 2025
they package itself is not that important i guess but the effect is: goauthentik/authentik#10865
some generated clients took very long on importing, which makes it really cumbersome for scripts
tamird commentedon Jul 23, 2026
The Python generator can preserve deferred model and API imports without introducing a third-party runtime dependency or replacing entries in sys.modules. #24402 implements standard-library PEP 562 lazy exports, retains typing, public exports and caching, and removes lazy-imports from all generated Python packaging metadata.
— tamirdex
tamird commentedon Jul 31, 2026
I think this issue can be closed out now? @wing328