I'm developing a application in Python and I've found various packages on pypi which appear to be what I need.However, how do I know I can trust these lesser known packages - it only has a couple hundred downloads a month? Should I look at the tests/the source code? Perhaps write my own tests for these packages?Any advise will be appreciated.
Assess the quality of third party python packages
python
I follow this criteria:Is the package widely used? How many projects that I consider to be large and important are using this package? How often are issues fixed, and commits pushed? Good examples of widely used and actively maintained packages are SQLAlchemy and Django, so I tend to think of them as reference for how well maintained I wish all packages were.Is the project still actively maintained? How often are there new commits, bug fixes, and issues being closed? There are many packages on PyPI which actually work fine, but they aren't that active.How thoroughly tested is this package? The more stable it is running on the interpreter you're using, the easier it is to determine how stable it will be in the future, and the easier it will be to fork it and maintain it yourself, if need be.If there is no viable substitute for a package, and it's not that actively maintained now, I try to speak to the upstream developers. They may have abandoned the package, or it may be that people simply aren't submitting issues. If it has been abandoned, but it may be useful to other people, consider forking it.Another viable strategy is building a Facade for the package, and writing your code to depend on this Facade, not on the package itself. That way, you could replace implementations in the future.