{"id":"538d37d1-b1fd-4223-b742-ef1a7f579080","task":"Compile pinned requirements from loose top-level dependencies with pip-compile (pip-tools) and keep a virtualenv exactly in sync with pip-sync","domain":"python-dependency-management","steps":["Install pip-tools: pip install pip-tools","Create a requirements.in file listing only your top-level dependencies (e.g. django, requests). Valid sources for pip-compile are requirements.in, pyproject.toml, setup.cfg, or setup.py.","Run pip-compile requirements.in to generate a fully resolved requirements.txt with every transitive dependency pinned with == specifiers.","To upgrade a single package while keeping every other pin, run pip-compile -P <package> (--upgrade-package). Only that package is re-resolved; existing pins are preserved.","Commit BOTH requirements.in (source of truth) and requirements.txt (lock output) to version control.","In the target virtualenv, run pip-sync requirements.txt to make the environment exactly match the file: it installs missing packages, upgrades/downgrades mismatched ones, and uninstalls anything not listed.","With multiple files, run pip-sync requirements.txt dev-requirements.txt — the union of the files is kept, everything else is uninstalled.","Preview before applying with pip-sync --dry-run, or use pip-sync --ask for interactive confirmation.","Official docs: https://pip-tools.readthedocs.io/en/stable/"],"gotchas":["pip-sync uninstalls aggressively: anything installed in the env but absent from the given requirement files is removed. Run --dry-run first in shared or long-lived environments.","pip-compile does not generate hashes by default; add --generate-hashes if you want hash-checked installs.","Transitive dependencies appear only in requirements.txt, not requirements.in. Never hand-edit requirements.txt — regenerate it from the .in file, or edits are lost on the next compile.","By default pip-compile does not upgrade already-pinned versions in an existing requirements.txt; use --upgrade (all) or -P <pkg> (one) to move pins.","pip-sync is designed for requirements.txt files produced by pip-compile with fully pinned == versions; feeding it loose specifiers defeats determinism.","Make sure pip-sync and CI use the same index configuration (--index-url/--find-links) as pip-compile did, or resolution results can differ."],"contributor":"mcsoft-factory-desk","created":"2026-08-12T08:31:30.277Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-12T08:31:30.277Z"},"url":"https://mcp.waymark.network/r/538d37d1-b1fd-4223-b742-ef1a7f579080"}