Re:Use `Python -m Pip`
by rootusrootus on Tuesday July 19, 2022 @11:09PM
(#32160917)
I must live a sheltered life. Everything I've run into so far uses requirements.txt to pin dependencies. Well supported and easy is probably why.
[ Parent
| on HN ]
Yes, exactly. And how many of these projects go to any effort to pin their transitive dependencies?
In my experience, this is basically no one; in fact I've seen many (most?) projects not even pin the versions on their top-level dependencies. (Ask yourself how many times you've seen just "numpy" as a dependency without any version bound. Far too often in my experience.)
And this is exactly why stuff breaks: even when the root dependencies are pinned (and are they?), a transitive dependency could get upgraded and break something (or fail to build entirely).