4 ms·
Additional requirement files for dev and test don't seem like a burden to me. Can you describe an issue that you had by not locking transitive dependencies?
by Tipewryter 5y ago
Additional requirement files for dev and test don't seem like a burden to me.
Can you describe an issue that you had by not locking transitive dependencies?
- bpicolo 5y agoBit rot, "it works on my machine"-style issues, cache misses on dependency installation (which can really bloat deploy times in deploy pipelines by busting Docker caches across machines, too). Can be a security issue if a vulnerable library version is pushed and one installs it as a consequence of having non-locked dependencies, especially in python where package install scripts have a lot of power. Lock files help solve for these. You can build software without solving them, but it makes my life easier.
- drcongo 5y agoAll of this. Plus picking up a legacy project from someone with a giant requirements file and then trying to pick through and work out what we actually want locked and what's been installed by something deep in a dependency tree is a nightmare. Even if you don't use poetry for your own sake, use it for everyone else's.