4 ms·
But then you're suddenly responsible for keeping track of your subdependencies and updating the versions of each that you want. That should be up to the depende
by Scarblac 7y ago
But then you're suddenly responsible for keeping track of your subdependencies and updating the versions of each that you want. That should be up to the dependencies.
Also if you manage to drop a dependency, you don't have an easy way to remove the things from requirements.txt that are only there because they're a subdependency.
Putting it all in one requirements.txt is just too simplistic.
- guggle 7y agoIf I had such need, I guess I could have two versions of the requirements.txt: - One with direct dependencies (versions pinned) - One with direct dependencies + subdependencies (pip freeze output) Am I being too naive ? (obviously yes if such tool as pipenv exists, but I'm trying to figure why people need *.lock files).
- oblio 7y agoAre you only working on small projects? For reference, if your project is under 100k lines of code, it's small.
- guggle 7y agoBy your arbitrary metric, I work on both small and big projects. Not sure how the loc metric relates to the matter though.
- Scarblac 7y agoThis is close to what pipenv does. It also adds dependency management. If one subdependency is library_a > 1.0, and another is library_b < 2.0 while also e.g. 2.1 exists, then it will try to find a version between 1.0 and 2.0. Pip doesn't do that. So in my mind, that's what pipenv is -- pip, virtualenv, those two files, plus dependency management.
- icebraining 7y ago> One with direct dependencies + subdependencies (pip freeze output) That's a lock file...
- guggle 7y agoOk ! That's what I'd do then.