Skip to content

Pin every line in requirements.txt #2

@DevanshSrajput

Description

@DevanshSrajput

Context
Only pandas is pinned (to 2.2.3). The other ten deps float to
whatever is latest on PyPI at install time. That makes a clean
install today produce a different lockfile than a clean install
six months from now — and a different lockfile than the one
Streamlit Cloud is using right now. Reproducible builds need every
line pinned.

What to change
In requirements.txt, add ==X.Y.Z to every unpinned line. A
tested set is:

numpy==1.26.4
pandas==2.2.3          # already pinned
matplotlib==3.8.2
seaborn==0.13.2
PyPDF2==3.0.1
python-docx==1.1.0
Pillow==10.2.0
pytesseract==0.3.10
requests==2.31.0
httpx==0.27.0
streamlit==1.32.0
python-dotenv==1.0.1

Pick the lowest set that the test suite (python -m unittest discover -s tests -v) still passes under, and document the pin
date in a comment at the top of the file.

How to verify

  • grep -E '^[a-zA-Z]' requirements.txt | grep -v '==' | wc -l
    prints 0 (every line is pinned).
  • pip install --upgrade-strategy=only-if-needed -r requirements.txt
    succeeds on a clean venv.
  • python -m unittest discover -s tests -v is green.
  • A fresh pip freeze matches requirements.txt line for line
    (modulo the pip/setuptools/wheel lines pip adds itself).

Skill: dependency management.
Estimated effort: M (testing the pins takes most of the time).

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions