Summary
The runtime dependency python-lsp-server[all]>=1.10 pulls in the optional Pylint provider even though Pylint is disabled by default in Python LSP Server. Pylint is GPL-2.0-or-later, creating an avoidable copyleft distribution/compliance concern for the bundled runtime.
This is not a vulnerability. The development-only Pylint entry under e2e/requirements.txt is a separate, legitimate tool-use case and is not part of the runtime package.
Proposed fix
Replace the broad all extra with the explicit non-Pylint providers currently supplied by it:
- autopep8
- flake8
- mccabe
- pycodestyle
- pydocstyle
- pyflakes
- rope
- yapf
This preserves the existing LSP linting, formatting, and refactoring providers while removing only the disabled optional Pylint runtime dependency.
Validation
python -m uv lock --checkpython -m uv tree --no-dev includes all selected providers and no Pylintpython -m uv run --no-dev pylsp --help- Runtime probe:
pylsp=True, pylint=False
git diff --check
Summary
The runtime dependency
python-lsp-server[all]>=1.10pulls in the optional Pylint provider even though Pylint is disabled by default in Python LSP Server. Pylint is GPL-2.0-or-later, creating an avoidable copyleft distribution/compliance concern for the bundled runtime.This is not a vulnerability. The development-only Pylint entry under
e2e/requirements.txtis a separate, legitimate tool-use case and is not part of the runtime package.Proposed fix
Replace the broad
allextra with the explicit non-Pylint providers currently supplied by it:This preserves the existing LSP linting, formatting, and refactoring providers while removing only the disabled optional Pylint runtime dependency.
Validation
python -m uv lock --checkpython -m uv tree --no-devincludes all selected providers and no Pylintpython -m uv run --no-dev pylsp --helppylsp=True,pylint=Falsegit diff --check