coldfront icon indicating copy to clipboard operation
coldfront copied to clipboard

Replace doi2bib with a util function to remove future package dependency

Open jrlagrone opened this issue 6 months ago • 5 comments

Replace the functionality of the git_bib function from doi2bib.

This is mainly to address CVE-2025-50817 -- doi2bib uses the future package and doi2bib appears to no longer be actively maintained. It appears to me that the functionality being used in ColdFront is a simple url request to the crossref.org rest api so just re-implement that.

Note: the following have not been updated (but should be).

  • ~~the tests in publication will no longer work as written (I didn't fully comprehend what it was actually doing, but I can circle back when I have more time available and try to update them)~~
  • ~~The packages doi2bib and future should no longer be dependencies in the uv file. I'm still running an older version using setup.py / requirements.txt, so I didn't test. My assumption is that is a trivial change.~~

jrlagrone avatar Aug 19 '25 16:08 jrlagrone