Hey Joona,
I have looked into qpip, but it is not sufficient. Not only do most
dependencies have binaries, but the process also creates a somewhat cumbersome
installation workflow for non-technical users.
In the end, the problem seems to be that the plugins I am talking about are not
really GIS plugins, but rather bigger pieces of software with a very
significant QGIS component, mostly for visualization purposes, so I must grant
that as a large part of the problem.
We will likely explore deploying custom plugin repositories and developing full
installers. It's inconvenient for users, but there isn't another alternative I
can see right now.
Cheers,
Pedro
From: Joona Laine <[email protected]>
To: "Pedro Camargo"<[email protected]>
Cc: "Qgis Developer"<[email protected]>
Date: Mon, 25 May 2026 15:47:55 +1000
Subject: Re: [QGIS-Developer] Security issues with plugins
Hello Pedro,
qgis-plugin-dev-tools ( https://github.com/nlsfi/qgis-plugin-dev-tools#setup )
solves the dependency issue by including the dependencies with the plugin
package.
It can easily handle most of (non-binary) requirements by automatically
rewriting the imports of theses vendored dependencies in the build process.
This way it is possible to have multiple plugins using different version of the
same requirement without any conflicts.
It is also possible to include binary dependencies but there is no operation
system specific logic built yet at the moment.
There is also a tool called qpip ( https://github.com/opengisch/qpip ) for
dependency management, which might be worth checking out.
Cheers,
Joona
ma 25.5.2026 klo 6.35 Pedro Camargo via QGIS-Developer (
mailto:[email protected] ) kirjoitti:
Hey Nyall,
I hear you, but let me highlight two points of my original post.
The plugin asks the user whether they want to install the dependencies.
The dependencies are installed in the plugin folder and can therefore be
removed without causing any lasting damage to the user's QGIS installation.
Installing additional dependencies in QGIS remains a painful task for less
technical users, adding another (somewhat unnecessary) hurdle to adoption.
On that note, a fair question could be: Is there a recommended low-effort (for
users) path to install extra dependencies for plugins?
If not, is that something being considered for the near future?
Cheers,
Pedro
From: Nyall Dawson < mailto:[email protected] >
To: "Pedro Camargo"< mailto:[email protected] >
Cc: "Qgis Developer"< mailto:[email protected] >
Date: Mon, 25 May 2026 11:12:20 +1000
Subject: Re: [QGIS-Developer] Security issues with plugins
On Mon, 25 May 2026 at 08:27, Pedro Camargo via QGIS-Developer <
mailto:[email protected] > wrote:
>
> Hello fellow QGISrs,
>
>
>
> I maintain a couple of plugins that require a substantial number of extra
> Python packages (many of which have compiled/binary components). Hence, those
> plugins install all such requirements in a folder directly inside the plugin
> itself, keeping it quite clean when the user wants to remove said plugins.
>
>
> I have been doing it this way for many years now, but this weekend I received
> security alerts that both plugins were taken down due to code that downloads
> extra dependencies (offending code at
> qaequilibrae/qaequilibrae/download_extra_packages_class.py at develop ·
> AequilibraE/qaequilibrae).
>
> Does anyone have any recommendations on how to proceed? What is currently
> the recommended way for plugins to install further dependencies?
My personal 2c: a plugin should NEVER automatically install dependencies like
this. Rather, you should detect missing dependencies, warn the user, and point
them to a documentation page directing them how to install the missing
libraries on different operating systems.
I think it's EXTREMELY dangerous for a plugin to assume that it can mess with
the user's operating system in this way, as it risks completely breaking their
QGIS install or even their wider python environment. I would like to see us
explicitly blocking all plugins from the repository that do this in future. 👎
Nyall
>
> Cheers,
> Pedro
>
>
>
> _______________________________________________
> QGIS-Developer mailing list
> mailto:[email protected]
> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
> Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
_______________________________________________
QGIS-Developer mailing list
mailto:[email protected]
List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
_______________________________________________
QGIS-Developer mailing list
[email protected]
List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
