Sorry Python but it is what it is.

You are viewing a single thread.
View all comments View context
21 points

pip also has lock files

pip freeze > requirements.txt

permalink
report
parent
reply
7 points

Would that just create a list of the current packages/versions without actually locking anything?

permalink
report
parent
reply
8 points
*

Would that just create a list of the current packages/versions

Yes, and all downstream dependencies

without actually locking anything?

What do you mean? Nothing stops someone from manually installing an npm package that differs from package-lock.json - this behaves the same. If you pip install -r requirements.txt it installs the exact versions specified by the package maintainer, just like npm install the only difference is python requires you to specify the “lock file” instead of implicitly reading one from the CWD

permalink
report
parent
reply
3 points
*

As I understand, when you update npm packages, if a package/version is specified in package-lock.json, it will not get updated past that version. But running those pip commands you mentioned is only going to affect what version gets installed initially. From what I can tell, nothing about those commands is stopping pip from eventually updating a package past what you had specified in the requirements.txt that you installed from.

permalink
report
parent
reply
0 points

That’s not a lockfile. This would be the equivalent of package.json

permalink
report
parent
reply
-2 points

How is it not a lock file?

package.json doesn’t contain the exact version number of all downstream dependencies, this does

permalink
report
parent
reply
0 points

Lockfile contains exact state of the npm-managed code, making it reproducible exactly the same every time.

For example without lockfile in your package.json you can have version 5.2.x. In your working directory, you use 5.2.1, however on repo, 5.2.2 has appeared, matching your criteria. Now let’s say a new bug appeared in 5.2.2.

Now you have mismatched vendor code, that can make your code behave differently on your machine, and your coworker’s machine, making you hunt for bug that wasn’t even on your side.

Lockfile prevents that by saving an actual state of vendor code.

permalink
report
parent
reply

Programmer Humor

!programmerhumor@lemmy.ml

Create post

Post funny things about programming here! (Or just rant about your favourite programming language.)

Rules:

  • Posts must be relevant to programming, programmers, or computer science.
  • No NSFW content.
  • Jokes must be in good taste. No hate speech, bigotry, etc.

Community stats

  • 4.3K

    Monthly active users

  • 1.5K

    Posts

  • 35K

    Comments