Hacker News Reader

Comment by alexanderh | Hacker News Reader

This is what I came to the comment section to say... You absolutely can pin dependencies.... da fudge?

Sounds like this guy needs to finish learning Python before he learns something else.

From what you suggested, to containerizing things with something like Docker, there are ways to make Python more easily distributable.

View on HN

What if the depedencies you pinned have non-pinned depedencies?

packageA==1.0.0 depends itself on packageB

Therefore, you can find yourself with a different set of deps. Had a bug like this once.

Pip freeze will pin explicit as well as transitive dependencies

It's a hassle to do this correctly and upgrade the dependencies. Use poetry.

pip freeze > requirements.txt

That only generates a lock file. When you want to upgrade some of your dependencies and recalculate the correct versions, it doesn't help.

How's that an issue? Here's an example of what happens: https://gist.github.com/robertlagrant/23489d8970ef6b49960307...

Someone else already responded. It's a one-line command.

I never could get poetry to work right; it's configs are sort of messy. pip freeze > requirements is built in. The only thing it doesn't pin is the python version itself.

As explained elsewhere in this thread, the one line command only generates a lock file. This doesn't manage the dependencies so if you want to upgrade cool-lib and recalculate all the transient dependencies so they fit with the rest of your libraries, you cannot afaik.

Bad non-solutions being built in are a bad thing.

This is not actually true. :-) Pip will install transitive deps from a requirements file unless you add the “no deps” flag. Pip freeze doesn’t pin anything. It just dumps stuff into a text file. If it’s a complete list, it has the side effect of pinning, but that’s not guaranteed by pip freeze in any way.

You just pin the sub-dependency. This is builtin functionality for all the python environment managers.

Reply on news.ycombinator.com