Pin dependencies to exact versions in requirements.txt for reproducible builds

Open Beginner friendly
#868 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
68/100
Issue type
Refactor
Clarity
Clearly specified
Activity status
Quiet
Tech stack
python
Domain
build-system

Research direction

Start by opening requirements.txt and reviewing the unpinned entries such as Flask and click. Run pip install -r requirements.txt in a fresh virtual environment, then use pip freeze to inspect the resolved versions. Done means requirements.txt pins its dependencies so repeated installations resolve to the same specified versions.

Written by the indexing model from the issue text.

Description

What is the issue?

requirements.txt lists dependencies without pinned versions, meaning pip installs the latest compatible versions each time. This makes the environment non-deterministic: different developers and CI runs can end up with different package versions, leading to inconsistent behavior or unexpected breakages.

(Suggested by @Pa04rth in #854)

Expected Behaviour

Every pip install -r requirements.txt should produce an identical environment regardless of when it is run.

Actual Behaviour

Dependencies are unpinned (e.g. Flask, click), so pip resolves to whatever is latest at install time.

Steps to reproduce
  1. Open requirements.txt and note entries like Flask, click have no version pins.
  2. Create a fresh virtual environment and run pip install -r requirements.txt.
  3. Run pip freeze and observe that pip has resolved specific versions not specified in requirements.txt, showing the environment is determined at install time.
Dominant language
Python
Stars
180
Forks
137
Avg merge
3d 23h
Merged PRs (30d)
21

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OWASP/OpenCRE

All issues in OWASP/OpenCRE

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.