If anyone hasn't seen it, now is a good time to look at <a href="https://python-poetry.org/" rel="nofollow">https://python-poetry.org/</a> It is rapidly becoming _the_ package manager to use. I've used it in a bunch of personal and professional projects with zero issues. It's been rock solid so far, and I'm definitely a massive fan.
The release notes are here [1] and I assume the reason this is being posted is because of:<p>> The new resolver now resolves packages in a deterministic order. (<a href="https://github.com/pypa/pip/pull/9100" rel="nofollow">https://github.com/pypa/pip/pull/9100</a>)<p>[1] <a href="https://pip.pypa.io/en/stable/news/#id1" rel="nofollow">https://pip.pypa.io/en/stable/news/#id1</a>
Here's a longer article about the resolver: <a href="https://pyfound.blogspot.com/2020/03/new-pip-resolver-to-roll-out-this-year.html" rel="nofollow">https://pyfound.blogspot.com/2020/03/new-pip-resolver-to-rol...</a>
So if I understand correctly, pip will now install the list of packages in the same order instead of choosing randomly, so that when there are version conflicts, you always get the same result?<p>I'm surprised I never ran into the issue, but I suppose it mainly show up if you have a large number of dependencies?
It's not super relevant, but I was poking around their CI infrastructure, and I noted the use of a temporary RAM disk to speed-up tests:<p><a href="https://github.com/pypa/pip/blob/master/.azure-pipelines/scripts/New-RAMDisk.ps1" rel="nofollow">https://github.com/pypa/pip/blob/master/.azure-pipelines/scr...</a><p>I'm very surprised. Is this common?
Also maybe worth mentioning the PyPI team has 1-to-1 UX feedback/study for `pip` <a href="https://www.ei8fdb.org/thoughts/2020/03/pip-ux-study-recruitment/" rel="nofollow">https://www.ei8fdb.org/thoughts/2020/03/pip-ux-study-recruit...</a>. I'd be more interested opting in for open web survey (question and answer field) though. Nevertheless, great to see they're open to user feedback in forms other than Git issues.
Your package manager should be boring, extremely backward and forward compatible, and never broken. Experience has shown this not to be true for python. Several times over the years i’ve found myself, pinning, upgrading, downgrading, or otherwise juggling versions of setuptools and pip in order to work around some bug. Historically I have had far more problems with the machinery to install python packages I have had with all of the other python packages being installed combined, and that is absurd.
Since this pull isn’t very helpful, the NEWS file with what’s changed is at <a href="https://github.com/pypa/pip/blob/master/NEWS.rst#203-2020-11-30" rel="nofollow">https://github.com/pypa/pip/blob/master/NEWS.rst#203-2020-11...</a>
Seen a few mentions of poetry. Not many for pip-tools which has been around longer, is less opinionated and has many of the same benefits <a href="https://github.com/jazzband/pip-tools" rel="nofollow">https://github.com/jazzband/pip-tools</a>
IME, pip and its inclusion in python installations made a great and very positive difference for using Python on Windows: before, third-party installations mostly (sic) didn’t succeed; after, they almost always succeed. I’m grateful.
Hynek, a CPython committer, had written a blog post[1] the state of Python application dependencies in 2018, updated in 2019 (no change in 2020, I asked). It was also surfaced on HN 3 times but did not get much attention[2]<p>[1]: <a href="https://hynek.me/articles/python-app-deps-2018/#petry" rel="nofollow">https://hynek.me/articles/python-app-deps-2018/#petry</a><p>[2]: <a href="https://hn.algolia.com/?q=python-app-deps-2018" rel="nofollow">https://hn.algolia.com/?q=python-app-deps-2018</a>
pip-review works great for keeping packages up to date.<p><a href="https://pypi.org/project/pip-review/" rel="nofollow">https://pypi.org/project/pip-review/</a><p>> pip-review
Faker==4.18.0 is available (you have 4.17.1)
pip==20.3 is available (you have 20.2.4)<p>> pip-review --auto --verbose
Collecting Faker==4.18.0
Downloading Faker-4.18.0-py3-none-any.whl (1.1 MB)
|| 1.1 MB 730 kB/s
Collecting pip==20.3
Downloading pip-20.3-py2.py3-none-any.whl (1.5 MB)
|| 1.5 MB 2.0 MB/s
Requirement already satisfied: python-dateutil>=2.4 in /usr/local/lib/python3.8/site-packages (from Faker==4.18.0) (2.8.1)
Requirement already satisfied: text-unidecode==1.3 in /usr/local/lib/python3.8/site-packages (from Faker==4.18.0) (1.3)
Requirement already satisfied: six>=1.5 in /usr/local/lib/python3.8/site-packages (from python-dateutil>=2.4->Faker==4.18.0) (1.15.0)
Installing collected packages: Faker, pip
Attempting uninstall: Faker
Found existing installation: Faker 4.17.1
Uninstalling Faker-4.17.1:
Successfully uninstalled Faker-4.17.1
Attempting uninstall: pip
Found existing installation: pip 20.2.4
Uninstalling pip-20.2.4:
Successfully uninstalled pip-20.2.4
ERROR: After October 2020 you may experience errors when installing or updating packages. This is because pip will change the way that it resolves dependency conflicts.<p>We recommend you use --use-feature=2020-resolver to test your packages with the new resolver before it becomes the default.<p>lektor 3.2.0 requires Werkzeug<1, but you'll have werkzeug 1.0.1 which is incompatible.
Successfully installed Faker-4.18.0 pip-20.3
new version of rust comes out.<p>me: ooo... new shiny toys.<p>new version of pip comes out. again.<p>me: :( this will probably break something. again.<p>I now just tell people to use conda.
Yay! I already got tired of typing <i>--use-feature=2020-resolver</i>.<p>With this, it's a lot easier to upgrade everything without getting conflicts: <i>pip freeze | cut -d= -f1 | xargs pip install --upgrade</i>.
We changed the URL from <a href="https://github.com/pypa/pip/pull/9177" rel="nofollow">https://github.com/pypa/pip/pull/9177</a> to the first link that the main comment there (<a href="https://github.com/pypa/pip/pull/9177#issuecomment-735830828" rel="nofollow">https://github.com/pypa/pip/pull/9177#issuecomment-735830828</a>) is pointing HN readers to. I presume that's the most informative one.
Sadly, pip 20.3 seems to have broken docker builds in one of my projects. The symptom is that the pip install seems to hang indefinitely (>40000 seconds). I switched back to 20.2 for now.
I prefer this resolver to `pip freeze` type pinning for dependency pull safety. Pip freeze makes it a nightmare to remove old packages if you have hundreds of packages frozen.
Get on Poetry, people.<p>Most Python devs don't seem to realize that the packaging problem is now solved:<p><a href="https://python-poetry.org/" rel="nofollow">https://python-poetry.org/</a>