Skip to main content
https://img.shields.io/github/workflow/status/adamchainz/pip-lock/CI/main?style=for-the-badge https://img.shields.io/pypi/v/pip-lock.svg?style=for-the-badge https://img.shields.io/badge/code%20style-black-000000.svg?style=for-the-badge pre-commit

Check for differences between requirements.txt files and the current environment.

Installation

Install with pip:

python -m pip install pip-lock

Python 3.6 to 3.9 supported.


Working on a Django project? Check out my book Speed Up Your Django Tests which covers loads of best practices so you can write faster, more accurate tests.


Example usage

Call pip_lock.check_requirements() at your application startup to verify that the current virtual environment matches your requirements file. This gives instant feedback to developers changing branches etc. who would otherwise experience unexpected behaviour or errors due to out of sync requirements.

In a Django project, it makes sense to add the check inside the manage.py file, which is the project’s main entrypoint. You can add a call to pip_lock.check_requirements() after the first import of Django. For example:

#!/usr/bin/env python
import os
import sys
from pathlib import Path


def main():
    os.environ.setdefault("DJANGO_SETTINGS_MODULE", "example.settings")

    try:
        from django.core.management import execute_from_command_line
    except ImportError as exc:
        raise ImportError(
            "Couldn't import Django. Are you sure it's installed and "
            "available on your PYTHONPATH environment variable? Did you "
            "forget to activate a virtual environment?"
        ) from exc

    try:
        import pip_lock
    except ImportError:
        raise ImportError(
            "Couldn't import pip-lock. Are you on the right virtualenv and up "
            + "to date?"
        )

    requirements_path = str(Path(__file__).parent / "requirements.txt")
    pip_lock.check_requirements(
        requirements_path,
        post_text="\nRun the following:\n\npython -m pip install -r requirements.txt\n",
    )

    execute_from_command_line(sys.argv)


if __name__ == "__main__":
    main()

API

check_requirements(requirements_file_path, post_text='')

Exit with exit code 1 and output to stderr if there are mismatches between the environment and requirements file.

requirements_file_path is the path to the requirements.txt file - we recommend using an absolute file path.

post_text is optional text which is displayed after the stderr message. This can be used to display instructions on how to update the requirements.

Example:

check_requirements(
    'requirements.txt',
    post_text='\nRun the following on your host machine: \n\n    vagrant provision\n'
)
There are requirement mismatches with requirements.txt:
    * Package Django has version 1.9.10 but you have version 1.9.0 installed.
    * Package requests has version 2.11.1 but you have version 2.11.0 installed.
    * Package requests-oauthlib is in requirements.txt but not in virtualenv

Run the following on your host machine:

    vagrant provision

get_mismatches(requirements_file_path)

Return a dictionary of package names to tuples of (expected_version, actual_version) for mismatched packages.

requirements_file_path is the path to the requirements.txt file - we recommend using an absolute file path.

Example:

>>> get_mismatches('requirements.txt')
{'django': ('1.10.2', '1.9.0'), 'requests': ('2.11.1', '2.9.2'), 'request-oauthlib': ('0.7.0', None)}

Metadata

Release files for pip-lock 2.3.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for pip-lock 2.3.0
File Size Uploaded Provenance Actions
pip-lock-2.3.0.tar.gz 6.4 kB Without provenance Details for pip-lock-2.3.0.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for pip-lock 2.3.0
File Interpreter ABI Platform Actions
pip_lock-2.3.0-py3-none-any.whl Python 3 none any Details for pip_lock-2.3.0-py3-none-any.whl

Total release size: 11.4 kB

Release files / pip-lock-2.3.0.tar.gz

Download URL pip-lock-2.3.0.tar.gz
Size 6.4 kB
Tags Source
SHA-256 checksum
How to use checksums
af629c423108915954fab6093f8b0f53ba2ec45f570fe530274633e7756da6dd
BLAKE2b-256 checksum
How to use checksums
fe236213eb188c6b88d76e9da10a34d8099d363b3914c101bebb4aeff0705426
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/3.4.1 importlib_metadata/4.6.1 pkginfo/1.7.0 requests/2.25.1 requests-toolbelt/0.9.1 tqdm/4.61.2 CPython/3.9.6

Release files / pip_lock-2.3.0-py3-none-any.whl

Download URL pip_lock-2.3.0-py3-none-any.whl
Size 5.0 kB
Tags Python 3
SHA-256 checksum
How to use checksums
7ff275a61ac54022a26d9de432eacab2a616dff7634257c52a11973439465463
BLAKE2b-256 checksum
How to use checksums
006512fdce3c4a580e057276312f729a8be0ab3a19011be650a0e4c8d7dc36a0
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/3.4.1 importlib_metadata/4.6.1 pkginfo/1.7.0 requests/2.25.1 requests-toolbelt/0.9.1 tqdm/4.61.2 CPython/3.9.6

Security for pip-lock 2.3.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page