Replace pipenv with a better dependency management tool about osv.dev HOT 5 OPEN

fwiw we've moved everything at Ackama to use Poetry, though we were previously primarily using pip / pip-compile

from osv.dev.

/cc @di for input

from osv.dev.

@G-Rath pip-compile is one of the choices we are thinking of going with, any particular reason you folks moved to Poetry?

from osv.dev.

It was primarily that we found Poetry tends to mirror a lot of the other dependency managers we're using like npm, composer, bundler, making us feel better about managing dependencies with it e.g. we can do "poetry update " to get a security update for some nested child package without having everything else upgraded or having to add that package as a direct dependency, and all the packages are captured in the single predictably-placed file that is poetry.lock regardless of what group they're in (rather than requirements.dev and what have you)

from osv.dev.

FWIW: Poetry's resolution strategy doesn't exactly match pip's, meaning that the two shouldn't be assumed to be always consistent/identical for all resolutions. This may or may not matter, depending on your deployment environment/conditions 🙂

In terms of consistency with the larger ecosystem (and PyPA in particular), my recommendation would be pip-compile: it uses pip's own resolver, and would mirror what PyPI and other large codebases use to keep their Python dependencies fully pinned.

from osv.dev.