News for hackers. Stuff that matters.

A comment on Why not tell people to “simply” use pyenv, poetry or anaconda. Parent comment

Re:Why not tell people to “simply” use pyenv, poetry or anac... by linkdd on Tuesday June 13, 2023 @07:35AM (#36308656)
How is `node_modules` different from `/path/to/venv/lib/python3.X/site-packages` ?

Are PyPI, cargo, Maven, etc... all immune to supply chain attacks?

[ Parent | on HN ]
Re:Why not tell people to “simply” use pyenv, poetry or anac... by rcfox on Tuesday June 13, 2023 @07:57AM (#36308931)
One major difference is a venv doesn't allow nested dependencies. With npm, you might install version 2.3 of a package, only to find that some other package has installed version 1.4 under itself.

Python also has "wheels", which are pre-compiled distributions, rather than full-source distributions. These are often smaller and install faster.

[ Parent | on HN ]
Re:Why not tell people to “simply” use pyenv, poetry or anac... by heywhatupboys on Tuesday June 13, 2023 @04:59PM (#36317235)
> One major difference is a venv doesn't allow nested dependencies. With npm, you might install version 2.3 of a package, only to find that some other package has installed version 1.4 under itself.

a feature not a bug. Anyone who ahs built a sufficiently large project and had to abandon some dependencies know this pain

[ Parent | on HN ]