Context
Only pandas is pinned (to 2.2.3). The other ten deps float to
whatever is latest on PyPI at install time. That makes a clean
install today produce a different lockfile than a clean install
six months from now — and a different lockfile than the one
Streamlit Cloud is using right now. Reproducible builds need every
line pinned.
What to change
In requirements.txt, add ==X.Y.Z to every unpinned line. A
tested set is:
numpy==1.26.4
pandas==2.2.3 # already pinned
matplotlib==3.8.2
seaborn==0.13.2
PyPDF2==3.0.1
python-docx==1.1.0
Pillow==10.2.0
pytesseract==0.3.10
requests==2.31.0
httpx==0.27.0
streamlit==1.32.0
python-dotenv==1.0.1
Pick the lowest set that the test suite (python -m unittest discover -s tests -v) still passes under, and document the pin
date in a comment at the top of the file.
How to verify
grep -E '^[a-zA-Z]' requirements.txt | grep -v '==' | wc -l
prints 0 (every line is pinned).
pip install --upgrade-strategy=only-if-needed -r requirements.txt
succeeds on a clean venv.
python -m unittest discover -s tests -v is green.
- A fresh
pip freeze matches requirements.txt line for line
(modulo the pip/setuptools/wheel lines pip adds itself).
Skill: dependency management.
Estimated effort: M (testing the pins takes most of the time).
Context
Only
pandasis pinned (to2.2.3). The other ten deps float towhatever is latest on PyPI at install time. That makes a clean
install today produce a different lockfile than a clean install
six months from now — and a different lockfile than the one
Streamlit Cloud is using right now. Reproducible builds need every
line pinned.
What to change
In
requirements.txt, add==X.Y.Zto every unpinned line. Atested set is:
Pick the lowest set that the test suite (
python -m unittest discover -s tests -v) still passes under, and document the pindate in a comment at the top of the file.
How to verify
grep -E '^[a-zA-Z]' requirements.txt | grep -v '==' | wc -lprints
0(every line is pinned).pip install --upgrade-strategy=only-if-needed -r requirements.txtsucceeds on a clean venv.
python -m unittest discover -s tests -vis green.pip freezematchesrequirements.txtline for line(modulo the
pip/setuptools/wheellines pip adds itself).Skill: dependency management.
Estimated effort: M (testing the pins takes most of the time).