Package managers and dependencies
Most programs are built on code other people wrote and shared as packages. Follow one line in requirements.txt as pip picks a version that fits your rule, installs it and everything it needs into a virtual environment, and a lock file records the exact versions so the same install works again tomorrow.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01What does pip do?
pip is Python's package manager: it fetches packages from PyPI (the Python Package Index) and installs them. npm does the same job for JavaScript.
02Your requirements.txt says requests>=2.32,<3. Which version is allowed?
2.33.0 is at least 2.32 and below 3, so it fits. 2.31.0 is too old, and 3.0.0 and 4.1.2 are new MAJOR versions, which may break code that uses them.
03Under semantic versioning, a package goes from 2.32.3 to 2.32.4. What should that mean?
The last number is PATCH: backward-compatible bug fixes. MINOR (the middle number) adds features; MAJOR (the first) is for changes that can break your code.
04You list only requests, but pip installs urllib3, idna, certifi and charset-normalizer too. What are they?
requests declares its own dependencies, and pip installs those as well. Dependencies of your dependencies are called transitive dependencies.
05Why commit a lock file such as the output of pip freeze, or package-lock.json?
A lock file pins every package, transitive ones included, to one exact version. Installing from it later, on another machine, gives the same set you tested.
Glossary
- Package
- Code someone wrote and published so others can install and reuse it, such as requests.
- Registry
- The online store packages are published to: PyPI for Python, the npm registry for JavaScript.
- Package manager
- The tool that finds, downloads and installs packages: pip for Python, npm for JavaScript.
- Dependency
- A package your code needs. A transitive dependency is one that your dependencies need.
- Semantic versioning
- Version numbers written MAJOR.MINOR.PATCH: breaking changes, new features, bug fixes.
- Virtual environment
- A folder of installed packages for one project, made with python -m venv, so projects don't clash.
- Lock file
- A file listing the exact version of every installed package, so an install can be repeated exactly.
- Typosquatting
- Publishing a harmful package under a name one typo away from a popular one, hoping people mistype.
Notes and sources
- The versions are real PyPI releases, frozen at 1 November 2024. Install today and pip picks newer ones (requests itself has moved on), which is exactly why lock files exist.
- Semantic versioning is a promise package authors choose to make, not a rule pip enforces. Python versions follow PEP 440, which allows MAJOR.MINOR.PATCH and more; certifi, for example, is versioned by date.
- pip’s real resolver also backtracks when two packages need clashing versions, and it skips yanked releases. Here nothing clashes, so the newest version that fits always wins.
- pip freeze is the simplest lock. Tools such as pip-tools, Poetry (poetry.lock) and uv (uv.lock), and the standard pylock.toml format (PEP 751), also record where each file came from and its hash.
- Semantic Versioning 2.0.0
- Python Packaging User Guide: Version specifiers (PEP 440)
- Python Packaging User Guide: Installing packages
- pip documentation: Requirements file format
- pip documentation: Repeatable installs
- pip documentation: Secure installs
- Python documentation: venv, creation of virtual environments
- PyPI: requests 2.32.3 (release metadata and dependencies)
- PEP 751: A file format to record Python dependencies for installation reproducibility
- npm Docs: package-lock.json
- npm Docs: About semantic versioning
- npm Docs: Threats and mitigations
Quiz Unlocks after the last step.