Pin dependencies to exact versions in requirements.txt for reproducible builds
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 68/100
- Issue type
- Refactor
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- python
- Domain
- build-system
Research direction
Start by opening requirements.txt and reviewing the unpinned entries such as Flask and click. Run pip install -r requirements.txt in a fresh virtual environment, then use pip freeze to inspect the resolved versions. Done means requirements.txt pins its dependencies so repeated installations resolve to the same specified versions.
Written by the indexing model from the issue text.
Description
What is the issue?
requirements.txt lists dependencies without pinned versions, meaning pip installs the latest compatible versions each time. This makes the environment non-deterministic: different developers and CI runs can end up with different package versions, leading to inconsistent behavior or unexpected breakages.
(Suggested by @Pa04rth in #854)
Expected Behaviour
Every pip install -r requirements.txt should produce an identical environment regardless of when it is run.
Actual Behaviour
Dependencies are unpinned (e.g. Flask, click), so pip resolves to whatever is latest at install time.
Steps to reproduce
- Open
requirements.txtand note entries likeFlask,clickhave no version pins. - Create a fresh virtual environment and run
pip install -r requirements.txt. - Run
pip freezeand observe that pip has resolved specific versions not specified inrequirements.txt, showing the environment is determined at install time.
- Dominant language
- Python
- Stars
- 180
- Forks
- 137
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 21
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from OWASP/OpenCRE
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 1/5 Under an hour Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 5/5 Over a week Newbie friendliness 42/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100