Hypermodern Python Tooling

Chapter 4. Dependency Management

Python programmers benefit from a rich ecosystem of third-party libraries and tools. Standing on the shoulders of giants comes at a price: the packages you depend on for your projects generally depend on a number of packages themselves. All of these are moving targets—​as long as any project is alive, its maintainers will publish a stream of releases to fix bugs, add features, and adapt to the evolving ecosystem.

Managing dependencies is a major challenge when you maintain software over time. You need to keep your project up-to-date, if only to close security vulnerabilities in a timely fashion. Often this requires updating your dependencies to the latest version—​few open source projects have the resources to distribute security updates for older releases. You’ll be updating dependencies all the time! Making the process as frictionless, automated, and reliable as possible comes with a huge payoff.

Dependencies of a Python project are the third-party packages that must be installed in its environment.¹ Most commonly, you incur a dependency on a package because it distributes a module you import. We also say that the project requires a package.

Many projects also use third-party tools for developer tasks—​like running the test suite or building documentation. These packages are known as development dependencies: end users don’t need them to run your code. A related case is the build dependencies from Chapter 3, which let you create packages for ...