<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta content="text/html;charset=UTF-8" http-equiv="Content-Type"></head><body ><div style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10pt;"><div class="zmail_extra" data-zbluepencil-ignore="true"><div>Hello fellow QGISrs,<br></div><blockquote id="blockquote_zmail" style="margin: 0px;"><div><div style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10pt"><div><br></div><div><br></div><div>I maintain a couple of plugins that require a substantial number of extra Python packages (many of which have compiled/binary components). Hence, those plugins install all such requirements in a folder directly inside the plugin itself, keeping it quite clean when the user wants to remove said plugins.<br></div><div><br></div><div><br></div><div>I have been doing it this way for many years now, but this weekend I received security alerts that both plugins were taken down due to code that downloads extra dependencies (offending code at <a href="https://github.com/AequilibraE/qaequilibrae/blob/develop/qaequilibrae/download_extra_packages_class.py" target="_blank">qaequilibrae/qaequilibrae/download_extra_packages_class.py at develop ยท AequilibraE/qaequilibrae</a>).<br></div><div><br></div><div>Does anyone have any recommendations on how to proceed? What is currently the recommended way for plugins to install further dependencies?<br></div><div><br></div><div>Cheers,<br></div><div>Pedro
<br></div></div></div></blockquote></div><div><br></div></div><br></body></html>