this post was submitted on 13 Oct 2023
6 points (87.5% liked)

Programmer Humor

32724 readers
153 users here now

Post funny things about programming here! (Or just rant about your favourite programming language.)

Rules:

founded 5 years ago
MODERATORS
 

Sorry Python but it is what it is.

you are viewing a single comment's thread
view the rest of the comments
[–] bjorney@lemmy.ca 2 points 1 year ago (2 children)

pip also has lock files

pip freeze > requirements.txt

[–] SatyrSack@lemmy.one 0 points 1 year ago (1 children)

Would that just create a list of the current packages/versions without actually locking anything?

[–] bjorney@lemmy.ca 1 points 1 year ago* (last edited 1 year ago) (1 children)

Would that just create a list of the current packages/versions

Yes, and all downstream dependencies

without actually locking anything?

What do you mean? Nothing stops someone from manually installing an npm package that differs from package-lock.json - this behaves the same. If you pip install -r requirements.txt it installs the exact versions specified by the package maintainer, just like npm install the only difference is python requires you to specify the "lock file" instead of implicitly reading one from the CWD

[–] SatyrSack@lemmy.one -1 points 1 year ago* (last edited 1 year ago)

As I understand, when you update npm packages, if a package/version is specified in package-lock.json, it will not get updated past that version. But running those pip commands you mentioned is only going to affect what version gets installed initially. From what I can tell, nothing about those commands is stopping pip from eventually updating a package past what you had specified in the requirements.txt that you installed from.

[–] soeren@iusearchlinux.fyi -1 points 1 year ago

That's not a lockfile. This would be the equivalent of package.json