Feature request: let pypi query the latest release string from the repository homepage to determine whether the package is latest or not

[dgutson]

Describe the bug
https://pypi.org/project/binwalk/ reports Latest Version, whereas the latest version is 2.3.4 (
I'm not sure if this is manually set, or automatically. If the latter, then this is a bug.

Expected behavior
Should show that this is not the latest version

To Reproduce
Go to the page

My Platform
N/A

[di]

Hi, this issue tracker is for issues with the codebase behind https://pypi.org itself, not the projects hosted on PyPI. This project has only make the single release listed to PyPI.

You should report this issue to the tracker for the project in question instead.

[dgutson]

@di I know that, as I said at the beginning, manual or automatic.

So, what prevents pypi to automatically determine whether the project is up to date or not? It could use github's API.

[miketheman]

@dgutson I think an important distinction is that PyPI is not equivalent to a project's source - which could be GitHub, it could be anything - there's no requirement for these to be connected.
PyPI's notion of "latest" is the most recently-released package on the platform - and if the maintainers of the project have not elected to publish, that's entirely their prerogative.

In essence, PyPI is behaving 100% correctly - the latest version is indeed the latest version we have, which is why you should communicate the lack of a newer release to the project maintainers.

[di]

ReFirmLabs/binwalk#523 seems to be the relevant issue

[dgutson]

@miketheman I perfectly understand what PyPI is and its relationship with github or others (gitlab, bitbuket, etc).

I'll turn this a feature request: let PyPI connect to different source providers (based on the homepage field) and determine whether the package in PyPI is the latest build or not.

@di thanks, binwalk was just an example.

[dgutson]

@miketheman would you consider pls to re-open now that it is re-scoped and I changed the title?

[miketheman]

@dgutson Considering the description and conversation, I'd recommend opening a fresh feature request issue with the specifics.
I will point out that there's already complexity in "trusting" the repository metadata since it's not verified.
See #8462 #10917 for some previous issues on this topic.