Change default API backend to PyQt6

[ShalokShalom]

Hi there :)

The README still reads: PyQt5 is used by default unless you set the QT_API environment variable.
I hope this is outdated info, since this is really insecure?

[dalthviz]

Hi @ShalokShalom thank you for the feedback! That is still the correct info: the default/initial binding that QtPy searchs for is PyQt5 unless you set QT_API.

Regarding security concerns, note that QtPy doesn't install PyQt5 (which indeed reached its EOL/EOS in May this year I believe) or any other binding so if you don't have it installed and instead you have a Qt6 binding (PyQt6 for example) QtPy will use it

Hope this info helps but if you have further concerns let us know!

[ShalokShalom]

Aha. I do think that having it declared that way, weakens the trust of the users.

People will be scared about, when they read it without this explaination.

Why do you still have it that way?

[dalthviz]

That has been the default for a long time and maybe one of the reasons that it is still the default is that changing it will also require changes in the logic that we use to check for bindings availability (currently the order is PyQt5 > PySide2 > PyQt6 > PySide6) 🤔

Regarding the current README interpretation, the full text currently is:

You need PyQt5, PySide2, PyQt6 or PySide6 installed in your system to make use of QtPy. If several of these packages are found, PyQt5 is used by default unless you set the QT_API environment variable.

Maybe we should be more explicit about the installation of binding and have something like:

You need PyQt5, PySide2, PyQt6 or PySide6 installed in your system to make use of QtPy (QtPy doesn't install any binding by itself). If several of these packages are found, PyQt5 is used by default unless you set the QT_API environment variable.

Anyhow, what do you think about this @ccordoba12 ? I guess another reason we haven't touched that is due to Spyder still using PyQt5 as default?

[ShalokShalom]

Wouldn't it be the easiest to just remove Qt5 support? And declare that people who still wanna use it (despite the security concerns) can use an older version?

Maybe release one last time, and then remove it?
No project should use that anymore, or?

---

I see Spyder does not mention anything about support for 6 here at all.

"Spyder can also be used as a PyQt5 extension library, allowing you to build upon its functionality and embed its components, such as the interactive console, in your own software"

[ccordoba12]

Anyhow, what do you think about this @ccordoba12 ?

Good idea @dalthviz! Please open a PR to add the sentence you posted above.

I guess another reason we haven't touched that is due to Spyder still using PyQt5 as default?

Yep, that's correct.

Wouldn't it be the easiest to just remove Qt5 support? And declare that people who still wanna use it (despite the security concerns) can use an older version?

@ShalokShalom, I don't see the need to do that because it's up to each project to decide what bindings they want to use (as @dalthviz said, Qtpy is binding agnostic).

In addition, we can't do that because Spyder still uses PyQt5, and we developed and maintain Qtpy for Spyder (although we're glad other projects find it useful).

However, we can switch the default backend to PyQt6.