Re:Python Best Practices for a New Project in 2021
by Tipewryter on Monday July 05, 2021 @10:06AM
(#27738140)
Additional requirement files for dev and test don't seem like a burden to me.
Can you describe an issue that you had by not locking transitive dependencies?
Re:Python Best Practices for a New Project in 2021
by bpicolo on Monday July 05, 2021 @10:13AM
(#27738206)
Bit rot, "it works on my machine"-style issues, cache misses on dependency installation (which can really bloat deploy times in deploy pipelines by busting Docker caches across machines, too). Can be a security issue if a vulnerable library version is pushed and one installs it as a consequence of having non-locked dependencies, especially in python where package install scripts have a lot of power.
Lock files help solve for these. You can build software without solving them, but it makes my life easier.
Re:Python Best Practices for a New Project in 2021
by drcongo on Monday July 05, 2021 @11:29AM
(#27738941)
All of this. Plus picking up a legacy project from someone with a giant requirements file and then trying to pick through and work out what we actually want locked and what's been installed by something deep in a dependency tree is a nightmare. Even if you don't use poetry for your own sake, use it for everyone else's.
Poetry does I expect a package manager to do, and does it well, especially when working with a team of developers on an application versus individually. There's not a compelling reason for me to use pip directly as a less functional alternative.