3 ms·
requirements.txt don't track transitive dependencies. Your project could break if a dependency decided to swap out its own dependencies. This isn't theoretical
by yen223 9y ago
requirements.txt don't track transitive dependencies. Your project could break if a dependency decided to swap out its own dependencies. This isn't theoretical either - it happened to us in production.
We are using `pip-tools` to manage that: https://github.com/jazzband/pip-tools https://github.com/jazzband/pip-tools
- Spiritus 9y agoWhat do you mean? `pip freeze > requirements.txt.lock` will freeze all your current deps, including transitive.
- yen223 9y agoThis is only practical if you only have one set of requirements. If you have multiple sets of requirements (for dev vs testing vs production, eg), this becomes impractical real quick. You'll essentially have to tear down and rebuild your dependencies multiple times to update your reqs.