How a hidden dependency crashed a popular database tool

A single import breaks the command line

Developer Simon Willison released version 4.2.1 of his sqlite-utils package to patch a critical crashing bug introduced in version 4.2. The issue stemmed from a single line of code importing "Self" from the typing_extensions package. Because typing_extensions was not listed as a core dependency for sqlite-utils, users running the tool directly via "uvx sqlite-utils" experienced immediate crashes.

The illusion of a working local environment

The code ran perfectly fine on Willison's machine and passed his tests. The typing_extensions package had been implicitly installed as a transitive dependency through other packages in his dev dependency group. The crash only affected end users installing the production build without those dev tools. This highlights the recurring danger of the "it works on my machine" syndrome.

Using uv for fast isolated testing

Willison quickly resolved the blind spot using the uv package manager for isolated testing. He implemented a smoke test command: "uv run --isolated --no-default-groups sqlite-utils --help". The --no-default-groups flag prevents the installation of the default development dependencies, and the --isolated flag ignores any existing local virtual environment. This precisely simulates the clean state an end user encounters.

The push for mandatory isolated smoke tests

The real proof that the developer ecosystem is learning from this will be the adoption of such isolated smoke tests as a mandatory step in CI/CD pipelines. Until running a tool stripped of its development dependencies becomes standard practice before every release, trivial missing-import bugs will continue to crash essential libraries.

Lilith's verdict

Your local virtual environment is a terrarium. Until you force your code to run in an isolated space stripped of its development baggage, you have no idea if your software actually works or if it's just surviving in captivity.