10 Python Requirements.txt Best Practices

Requirements.txt is an important file for Python developers. It contains a list of all the packages and their versions that are required for a project. It is used to ensure that the same versions of packages are installed on all the machines that are running the project.

In this article, we will discuss 10 best practices for creating and managing requirements.txt files. We will also discuss how to use them to ensure that all the machines running the project have the same versions of packages installed.

1. Keep your requirements.txt file up to date

When you install a package, it’s important to keep track of the version number. This is because different versions of packages can have different features and bug fixes that may be necessary for your project. If you don’t keep track of the version numbers in your requirements.txt file, then you won’t know which version of the package you’re using when you deploy your code.

It’s also important to update your requirements.txt file whenever you add or remove a package from your project. This ensures that all the dependencies are properly installed on any machine where you deploy your code.

Finally, if you use virtual environments, make sure to include the environment name in your requirements.txt file so that other developers can easily recreate the same environment.

2. Pin all the things!

When you pin a package, you specify the exact version of that package to be installed. This ensures that your application will always use the same version of the package, even if there are newer versions available. Pinning packages also helps prevent unexpected changes in behavior due to updates or bug fixes in new versions of the package.

Pinning all the things is especially important for production applications, where stability and reliability are paramount. It’s also a good idea to keep an eye on the changelogs of pinned packages so you can update them when necessary.

3. Use a virtualenv

A virtualenv is a tool that creates an isolated environment for your Python project. This means that any packages you install in the virtualenv will be installed only within that environment, and won’t affect other projects or the global Python installation on your system.

Using a virtualenv also helps to ensure that all of the dependencies listed in your requirements.txt file are available when you deploy your application. That way, you can be sure that everything works as expected when it’s time to go live.

4. Don’t use -e when installing packages

The -e flag allows you to install packages from a source other than the Python Package Index (PyPI). This can be useful if you need to install a package that isn’t available on PyPI, but it also introduces potential security risks. Packages installed with the -e flag are not checked for vulnerabilities or malicious code, so they could contain malicious code that could compromise your system.

For this reason, it’s best practice to only use the -e flag when absolutely necessary and to always check any packages installed with the -e flag for vulnerabilities before using them in production.

5. Always pin specific versions of dependencies

When you don’t pin specific versions of dependencies, your application may break when a new version of the dependency is released. This can be especially problematic if the new version introduces breaking changes or deprecates features that your application relies on.

By pinning specific versions of dependencies, you ensure that your application will always use the same version of the dependency and won’t break due to unexpected updates. This also makes it easier for other developers to understand what versions of dependencies are being used in the project.

6. Use hashes for security

Hashes are a way of verifying that the packages you’re installing haven’t been tampered with. This is especially important when downloading from third-party sources, as malicious actors could have modified the code to include malware or other malicious content.

By using hashes, you can ensure that the package you download is exactly what it claims to be. To do this, simply add a hash for each package in your requirements.txt file. For example:

requests==2.24.0 –hash=sha256:f9d8e3a7c6b1f5f4f8fbe0767a2687a4f8cf5a01a035ddd7cd4586759700f8ac

7. Be explicit about Python version

When you specify the Python version in your requirements.txt file, it ensures that all of the packages and dependencies are compatible with the same version of Python. This helps to avoid any potential conflicts or errors when running your code.

It’s also important to note that if you don’t explicitly state the Python version, then pip will default to the latest version available. This could lead to unexpected results as some packages may not be compatible with the latest version of Python. Therefore, it’s best practice to always include the Python version in your requirements.txt file.

8. Specify what you need, not how to get it

When you specify how to get a package, such as using pip install or git clone, you are tying your project to a specific version of the package. This can cause problems if the package is updated and breaks compatibility with your code. By specifying what you need instead, you allow for flexibility in how it is installed.

For example, instead of writing “pip install requests==2.22.0”, you should write “requests>=2.22.0”. This allows any version of requests that is 2.22.0 or higher to be used, which gives you more control over the packages you use and helps ensure compatibility.

9. Use pip-tools to manage your requirements.txt files

Pip-tools is a package that allows you to easily manage your requirements.txt files, and it helps ensure that all of the packages in your file are up-to-date. It also makes it easier to add new packages or remove old ones without having to manually edit the file. This can save time and help prevent errors when managing large projects with multiple dependencies. Additionally, pip-tools provides helpful features such as version pinning, which ensures that specific versions of packages are used instead of the latest version available.

10. Use poetry to manage your projects and dependencies

Poetry is a dependency management tool for Python that allows you to easily manage your project’s dependencies, as well as their versions. It also helps you create and maintain virtual environments, which are isolated workspaces where you can install packages without affecting the rest of your system. This makes it easier to keep track of what packages are installed in each environment, and ensures that all of your projects have the same version of the package installed.

Using poetry also simplifies the process of creating requirements.txt files. Poetry will automatically generate a requirements.txt file with all of the necessary information about your project’s dependencies, including their exact versions. This eliminates the need to manually update the file every time you add or remove a package from your project.