jazzband/pip-tools
Pip Tools
pip-tools is a set of utilities for Python dependency pinning, lockfile management, and virtual environment synchronization. It functions as a requirement compiler that resolves high-level package declarations into a pinned list of specific versions and content hashes to ensure repeatable builds across different environments.
The tool differentiates itself by providing a mechanism to refresh locked dependencies to their latest compatible versions without manual editing. It supports a layered dependency workflow, allowing one requirements file to act as a constraint for another to maintain compatible package sets across different deployment tiers.
The system covers broader capabilities including dependency compilation, recursive dependency expansion, and the generation of cryptographic hashes for package integrity verification. It also includes utilities to align a virtual environment's installed packages to match the exact versions listed in a lock file.
Features
- Requirements Compilers - Resolves high-level dependency declarations into a pinned, flat list of packages to ensure consistent installations.
- Dependency Constraints - Defines version compatibility rules to filter and lock sub-dependencies using external constraint files.
- Project Lockfile Management - Maintains consistent dependency versions by generating and updating project lockfiles with security hashes.
- Python Package Managers - Manages Python project dependencies, virtual environments, and the locking of packages to specific versions.
- Environment Synchronizers - Aligns the local virtual environment with a defined dependency state by installing or removing packages.
- Lock Files - Produces persistent lock files recording exact dependency versions and hashes for deterministic builds.
- Library Version Resolution - Implements logic for calculating compatible library version sets to satisfy overlapping requirements.
- Environment Synchronizers - Provides a utility to synchronize a virtual environment's installed packages to exactly match a pinned requirements file.
- Repeatable Build Tooling - Generates pinned requirements files with hashes to ensure installations use identical package versions and checksums.
- Layered Dependency Constraints - Supports using pinned requirements files as constraints for other layers to separate production and development environments.
- Layered Requirements Workflows - Manages separate but compatible dependency sets for different deployment stages using constraints.
- Python Environment Managers - Provides tools for synchronizing virtual environments to match locked requirements files.
- Dependency Version Updates - Provides utilities to refresh pinned package versions to the latest compatible releases.
- Cryptographic Hash Verifiers - Generates cryptographic content hashes to verify that downloaded packages match the original compiled versions.
- Dependency Integrity Verifiers - Includes content hashes in output requirements files to verify package integrity during installation.
- Dependency Tree Traversers - Recursively maps and flattens the full hierarchy of transitive dependencies into a single output file.
- Package Managers - Keeps pinned dependencies up to date and reproducible.
