pip & Dependency Management

Introduction

pip installs from PyPI. Modern projects pin deps in pyproject.toml or use a lockfile for reproducibility.

Understanding the topic

Core concepts to understand:

• pip install pkg from PyPI.
• pip freeze > requirements.txt.
• pip install -r requirements.txt.
• Lockfile = exact versions + transitive deps.

Syntax reference

Visual flow / code:

# Install
pip install requests==2.31.0
pip install -r requirements.txt

# Freeze current env
pip freeze > requirements.txt

# Compile a lockfile (pip-tools)
pip-compile pyproject.toml

# uv: super-fast install
uv pip install -r requirements.txt

Execution workflow

Real-world use

Use lockfiles (poetry.lock, uv.lock, requirements.lock) for reproducible builds. pip freeze alone is fragile.

Best practices

• Pin major versions in deps.
• Use lockfile for prod.
• Audit with pip-audit.

Common mistakes

• Installing unpinned packages — breaks at the worst time.

Hands-on exercise

Interview preparation — practice these questions:

• pip vs pipx?
• requirements.txt vs lockfile?
• What's a transitive dependency?

Summary

In summary: Pin + lock = reproducible. Modern tools (uv/poetry) are faster + safer.