python-packaging

Dependency management involves using tools like Poetry, pip, or uv to specify package versions, resolve conflicts between requirements, and create lock files that pin exact versions for reproducible builds across environments.

Virtual environments isolate project dependencies from your system Python. Tools like Poetry and uv automate environment creation and management, while pip requires manual setup with venv or virtualenv to prevent dependency conflicts.

Security scanning tools like pip-audit and safety audit your installed packages against vulnerability databases, identifying outdated or compromised versions so you can update before deploying to production.

Poetry, pip, and uv each handle dependency resolution and lock files differently. Poetry automates virtual environments and provides lock files by default, uv offers speed optimizations, while pip requires manual lock-file generation and environment management.

Lock file migration captures current dependency versions into a locked state using Poetry or uv, ensuring all developers and deployments use identical package versions, eliminating version drift and build inconsistencies.

Pinning exact versions in lock files ensures reproducible builds and prevents surprise breakage from minor or patch updates. Version ranges provide flexibility but risk compatibility issues when transitive dependencies update unexpectedly.