Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Promote pinning sub-dependencies in constraints.txt #7807

Closed
wants to merge 3 commits into from
Closed

Promote pinning sub-dependencies in constraints.txt #7807

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
995ed9b
Promote pinning sub-dependencies in constraints.txt
m-aciek Mar 1, 2020
c646245
Create news fragment
m-aciek Mar 1, 2020
431c407
Fix links
m-aciek Mar 1, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 13 additions & 7 deletions docs/html/user_guide.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -685,18 +685,24 @@ Pinned Version Numbers
----------------------

Pinning the versions of your dependencies in the requirements file
protects you from bugs or incompatibilities in newly released versions::
protects you from bugs or incompatibilities in newly released versions:

``requirements.txt``::

SomePackage == 1.2.3

``constraints.txt``::

DependencyOfSomePackage == 4.5.6

Using :ref:`pip freeze` to generate the requirements file will ensure that not
only the top-level dependencies are included but their sub-dependencies as
well, and so on. Perform the installation using :ref:`--no-deps
<install_--no-deps>` for an extra dose of insurance against installing
anything not explicitly listed.
Perform the installation using both :ref:`-r requirements.txt <install_--requirement>`
and :ref:`-c constraints.txt <install_--constraint>` to ensure that both top-level and
all sub-dependecies will be installed in their pinned versions. You can use
:ref:`pip show` as a help in creating requirements and constraints files –
``Requires`` section shows list of dependencies of package and ``Version``
section shows a version that has been resolved for it.

This strategy is easy to implement and works across OSes and architectures.
This strategy works across OSes and architectures.
However, it trusts PyPI and the certificate authority chain. It
also relies on indices and find-links locations not allowing
packages to change without a version increase. (PyPI does protect
Expand Down
1 change: 1 addition & 0 deletions news/7802.doc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Promote pinning sub-dependencies in constraints.txt