News for hackers. Stuff that matters.
Re:Python Best Practices for a New Project in 2021 by bpicolo on Monday July 05, 2021 @09:54AM (#27738006)
Pip is fine, it depends on your goals. I've found requirements.txt less enjoyable to maintain for several reasons – you need to separate dev, test dependencies on your own time, there's no notion of a lockfile for transitive dependencies (`pip freeze` notably doesn't separate actual dependencies from transitive dependencies). pip is also darn slow at installing dependencies once you hit a certain scale, and poetry outperforms it pretty substantially.

Poetry does I expect a package manager to do, and does it well, especially when working with a team of developers on an application versus individually. There's not a compelling reason for me to use pip directly as a less functional alternative.

Re:Python Best Practices for a New Project in 2021 by Tipewryter on Monday July 05, 2021 @10:06AM (#27738140)
Additional requirement files for dev and test don't seem like a burden to me.

Can you describe an issue that you had by not locking transitive dependencies?

Re:Python Best Practices for a New Project in 2021 by bpicolo on Monday July 05, 2021 @10:13AM (#27738206)
Bit rot, "it works on my machine"-style issues, cache misses on dependency installation (which can really bloat deploy times in deploy pipelines by busting Docker caches across machines, too). Can be a security issue if a vulnerable library version is pushed and one installs it as a consequence of having non-locked dependencies, especially in python where package install scripts have a lot of power.

Lock files help solve for these. You can build software without solving them, but it makes my life easier.

Re:Python Best Practices for a New Project in 2021 by drcongo on Monday July 05, 2021 @11:29AM (#27738941)
All of this. Plus picking up a legacy project from someone with a giant requirements file and then trying to pick through and work out what we actually want locked and what's been installed by something deep in a dependency tree is a nightmare. Even if you don't use poetry for your own sake, use it for everyone else's.