If I had such need, I guess I could have two versions of the requirements.txt:
- One with direct dependencies (versions pinned) - One with direct dependencies + subdependencies (pip freeze output)
Am I being too naive ? (obviously yes if such tool as pipenv exists, but I'm trying to figure why people need *.lock files).
Re:If this project is dead, just tell us
by Scarblac on Friday December 13, 2019 @10:54AM
(#21782638)
This is close to what pipenv does.
It also adds dependency management. If one subdependency is library_a > 1.0, and another is library_b < 2.0 while also e.g. 2.1 exists, then it will try to find a version between 1.0 and 2.0. Pip doesn't do that.
So in my mind, that's what pipenv is -- pip, virtualenv, those two files, plus dependency management.
Re:If this project is dead, just tell us
by icebraining on Friday December 13, 2019 @10:57AM
(#21782659)
> One with direct dependencies + subdependencies (pip freeze output)
That's a lock file...
Ok ! That's what I'd do then.
Are you only working on small projects? For reference, if your project is under 100k lines of code, it's small.
Also if you manage to drop a dependency, you don't have an easy way to remove the things from requirements.txt that are only there because they're a subdependency.
Putting it all in one requirements.txt is just too simplistic.